-- 后台 RBAC 权限模型。保留 admin_users.role 兼容旧账号，权限通过角色键动态解析。
CREATE TABLE IF NOT EXISTS admin_roles (
  role_key TEXT PRIMARY KEY,
  role_name TEXT NOT NULL,
  description TEXT NOT NULL DEFAULT '',
  is_system BOOLEAN NOT NULL DEFAULT TRUE,
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

CREATE TABLE IF NOT EXISTS admin_permissions (
  permission_key TEXT PRIMARY KEY,
  permission_name TEXT NOT NULL,
  permission_group TEXT NOT NULL DEFAULT '',
  description TEXT NOT NULL DEFAULT '',
  is_system BOOLEAN NOT NULL DEFAULT TRUE,
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

CREATE TABLE IF NOT EXISTS admin_role_permissions (
  role_key TEXT NOT NULL REFERENCES admin_roles(role_key) ON DELETE CASCADE,
  permission_key TEXT NOT NULL REFERENCES admin_permissions(permission_key) ON DELETE CASCADE,
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  PRIMARY KEY (role_key, permission_key)
);

INSERT INTO admin_roles (role_key, role_name, description)
VALUES
  ('admin', '管理员', '拥有全部后台权限'),
  ('operator', '普通运营', '负责接单平台和订单运营'),
  ('support', '客服', '负责客服处理和售后协助')
ON CONFLICT (role_key) DO UPDATE SET
  role_name = EXCLUDED.role_name,
  description = EXCLUDED.description,
  updated_at = NOW();

INSERT INTO admin_permissions (permission_key, permission_name, permission_group, description)
VALUES
  ('worker_order.view', '查看接单订单', '接单管理', '查看接单平台订单及详情'),
  ('worker_order.edit', '编辑接单订单', '接单管理', '修改接单订单基础资料'),
  ('worker_order.configure_share', '配置拼单', '接单管理', '配置接单订单拼单规则'),
  ('worker_order.assign', '指派打手', '接单管理', '指派或取消指派打手'),
  ('worker_order.return_to_hall', '撤单并退回大厅', '接单管理', '将进行中的订单撤回抢单大厅'),
  ('worker_order.cancel', '撤单并取消订单', '接单管理', '取消订单并终止后续履约'),
  ('worker_order.cancel_share', '撤销拼单参与者', '接单管理', '撤销拼单中的单个参与者'),
  ('worker_order.delete', '删除接单订单', '接单管理', '删除尚未履约的接单订单'),
  ('worker_order.publish', '发布接单订单', '接单管理', '发布或下架接单订单'),
  ('worker_order.accept', '验收接单订单', '接单管理', '验收接单订单和拼单份额'),
  ('worker_order.reopen', '重新启用订单', '接单管理', '重新启用已取消的接单订单'),
  ('worker_order.update_material', '更新订单资料', '接单管理', '补充或更新订单资料'),
  ('worker_order.manage_problem', '处理问题单', '接单管理', '标记和处置问题单'),
  ('worker_order.deduct_deposit', '扣除押金', '接单管理', '处理待解冻押金'),
  ('worker_cancel_request.review', '审核撤单申请', '接单管理', '审核打手提交的撤单申请')
ON CONFLICT (permission_key) DO UPDATE SET
  permission_name = EXCLUDED.permission_name,
  permission_group = EXCLUDED.permission_group,
  description = EXCLUDED.description,
  updated_at = NOW();

-- 管理员默认拥有全部已登记权限。
INSERT INTO admin_role_permissions (role_key, permission_key)
SELECT 'admin', permission_key FROM admin_permissions
ON CONFLICT DO NOTHING;

-- 普通运营保持现有完整接单操作；客服默认不拥有高风险直接撤单权限。
INSERT INTO admin_role_permissions (role_key, permission_key)
SELECT 'operator', permission_key
FROM admin_permissions
ON CONFLICT DO NOTHING;

INSERT INTO admin_role_permissions (role_key, permission_key)
SELECT 'support', permission_key
FROM admin_permissions
WHERE permission_key IN (
  'worker_order.view',
  'worker_order.edit',
  'worker_order.assign',
  'worker_order.publish',
  'worker_order.update_material',
  'worker_order.manage_problem',
  'worker_cancel_request.review'
)
ON CONFLICT DO NOTHING;

CREATE INDEX IF NOT EXISTS idx_admin_role_permissions_permission
  ON admin_role_permissions(permission_key, role_key);
