"""造 RBAC 测试数据，验证真实链路身份加载与越权拦截。

数据使用 9001/9002 号段，便于清理，不影响业务数据。
"""

from __future__ import annotations

import asyncio
from datetime import UTC, datetime

from sqlalchemy import text

from app.core.contracts import RequestContext
from app.infrastructure.db import SessionFactory
from app.service.identity_service import IdentityService

CUSTOMER_USER = "9001"
RISK_USER = "9002"


async def seed() -> None:
    now = datetime.now(UTC).replace(tzinfo=None)
    async with SessionFactory() as session:
        await session.execute(text("DELETE FROM sys_role_permission WHERE role_id IN (9001,9002)"))
        await session.execute(text("DELETE FROM sys_user_role WHERE user_id IN (9001,9002)"))
        await session.execute(text("DELETE FROM sys_permission WHERE id=9001"))
        await session.execute(text("DELETE FROM sys_role WHERE id IN (9001,9002)"))
        await session.execute(text("DELETE FROM sys_user WHERE id IN (9001,9002)"))
        await session.execute(
            text(
                "INSERT INTO sys_user (id, user_no, username, password_hash, user_type,"
                " professional_investor_status, fund_account_status, status, created_at, updated_at)"
                " VALUES (9001,'T-CUST','cust_t','x','customer','none','closed','正常',:now,:now),"
                "        (9002,'T-RISK','risk_t','x','employee','none','closed','正常',:now,:now)"
            ),
            {"now": now},
        )
        await session.execute(
            text(
                "INSERT INTO sys_role (id, role_code, role_name, status, created_at, updated_at)"
                " VALUES (9001,'customer','客户','active',:now,:now),"
                "        (9002,'risk_operator','风控专员','active',:now,:now)"
            ),
            {"now": now},
        )
        await session.execute(
            text(
                "INSERT INTO sys_permission"
                " (id, permission_code, resource, action, data_scope, created_at, updated_at)"
                " VALUES (9001,'agent:run','agent','run','self',:now,:now)"
            ),
            {"now": now},
        )
        await session.execute(
            text(
                "INSERT INTO sys_user_role (user_id, role_id, assigned_at)"
                " VALUES (9001,9001,:now),(9002,9002,:now)"
            ),
            {"now": now},
        )
        await session.execute(
            text(
                "INSERT INTO sys_role_permission (role_id, permission_id, created_at)"
                " VALUES (9001,9001,:now),(9002,9001,:now)"
            ),
            {"now": now},
        )
        await session.commit()


async def verify() -> None:
    service = IdentityService()
    for label, user_id in (("customer", CUSTOMER_USER), ("risk_operator", RISK_USER)):
        context = await service.resolve(
            RequestContext(user_id=user_id, trace_id="verify-trace")
        )
        print(
            f"{label:14s} roles={context.roles} permissions={context.permissions} "
            f"portal={context.portal} data_scope={context.data_scope}"
        )


async def main() -> None:
    await seed()
    await verify()


if __name__ == "__main__":
    asyncio.run(main())