"""确保提现审核权限码 005bb，并按俱乐部挂到指定角色（可重复执行）。

权限码全局共用；隔离靠 Role.ClubID + 请求头俱乐部。
集团高管仍可跨俱乐部；俱乐部管理员仅本俱乐部。

用法示例：
  python manage.py seed_club_withdraw_audit_perm
  python manage.py seed_club_withdraw_audit_perm --club-id lxs --role-name 管理员
  python manage.py seed_club_withdraw_audit_perm --all-clubs --role-name 管理员
  python manage.py seed_club_withdraw_audit_perm --all-clubs --role-name 管理员 --dry-run
"""
import uuid

from django.core.management.base import BaseCommand, CommandError
from django.db import transaction
from django.utils import timezone

from gvsdsdk.models import Permission, Role, RolePermission

from jituan.models import Club

WITHDRAW_AUDIT_PERM = '005bb'
WITHDRAW_AUDIT_NAME = '提现审核（按俱乐部）'
WITHDRAW_AUDIT_DESC = (
    '审核本俱乐部提现申请（同意/拒绝/自动打款待收款）。'
    '跨俱乐部仅集团高管可操作；须配合后台角色 ClubID 与数据范围任职。'
)
WITHDRAW_AUDIT_CATEGORY = '提现管理'


class Command(BaseCommand):
    help = '写入 005bb 提现审核权限码，并按俱乐部挂到角色'

    def add_arguments(self, parser):
        parser.add_argument(
            '--club-id', default='', help='仅处理该俱乐部角色（如 lxs / xq）',
        )
        parser.add_argument(
            '--all-clubs', action='store_true', help='处理全部启用中的俱乐部',
        )
        parser.add_argument(
            '--role-name', default='',
            help='角色名（如「管理员」）；为空则只确保权限码存在，不挂角色',
        )
        parser.add_argument(
            '--dry-run', action='store_true', help='只打印不写入',
        )

    def handle(self, *args, **options):
        dry_run = options['dry_run']
        club_id = (options.get('club_id') or '').strip()
        all_clubs = options.get('all_clubs')
        role_name = (options.get('role_name') or '').strip()

        sample = Permission.objects.filter(PermStatus=1).first()
        tenant_uuid = sample.TenantUUID if sample else uuid.UUID(
            '00000000-0000-0000-0000-000000000001'
        ).bytes

        perm = Permission.objects.filter(PermCode=WITHDRAW_AUDIT_PERM).first()
        if perm:
            self.stdout.write(f'  权限码已存在: {WITHDRAW_AUDIT_PERM}')
            if not dry_run and (perm.PermName != WITHDRAW_AUDIT_NAME or not perm.PermDesc):
                perm.PermName = WITHDRAW_AUDIT_NAME
                perm.PermDesc = WITHDRAW_AUDIT_DESC
                perm.PermCategory = WITHDRAW_AUDIT_CATEGORY
                perm.save(update_fields=['PermName', 'PermDesc', 'PermCategory'])
                self.stdout.write(self.style.SUCCESS('  已更新 005bb 名称/说明'))
        else:
            if dry_run:
                self.stdout.write(f'would create perm {WITHDRAW_AUDIT_PERM}')
            else:
                perm = Permission.objects.create(
                    PermUUID=uuid.uuid4().bytes,
                    TenantUUID=tenant_uuid,
                    PermCode=WITHDRAW_AUDIT_PERM,
                    PermName=WITHDRAW_AUDIT_NAME,
                    PermDesc=WITHDRAW_AUDIT_DESC,
                    PermCategory=WITHDRAW_AUDIT_CATEGORY,
                    PermStatus=1,
                    CreateTime=timezone.now(),
                )
                self.stdout.write(self.style.SUCCESS(f'  新增权限: {WITHDRAW_AUDIT_PERM}'))

        if not role_name:
            self.stdout.write(
                self.style.WARNING(
                    '未指定 --role-name：仅确保权限码。'
                    '给俱乐部挂权请加：--club-id lxs --role-name 管理员'
                )
            )
            return

        if not club_id and not all_clubs:
            raise CommandError('挂角色时请指定 --club-id 或 --all-clubs')

        if all_clubs:
            club_ids = list(
                Club.query.filter(status=1).values_list('club_id', flat=True)
            )
        else:
            if not Club.query.filter(club_id=club_id, status=1).exists():
                raise CommandError(f'俱乐部不存在或未启用: {club_id}')
            club_ids = [club_id]

        if not perm and dry_run:
            self.stdout.write('dry-run: skip role binding (perm not loaded)')
            return

        linked = 0
        missing_roles = 0
        with transaction.atomic():
            for cid in club_ids:
                role = Role.objects.filter(
                    RoleName=role_name, ClubID=cid, RoleStatus=1,
                ).first()
                if not role:
                    missing_roles += 1
                    self.stdout.write(
                        self.style.WARNING(f'  [{cid}] 无角色「{role_name}」，跳过')
                    )
                    continue
                exists = RolePermission.objects.filter(
                    RoleUUID=role.RoleUUID, PermUUID=perm.PermUUID,
                ).exists()
                if exists:
                    self.stdout.write(f'  [{cid}] 角色「{role_name}」已有 {WITHDRAW_AUDIT_PERM}')
                    continue
                if dry_run:
                    self.stdout.write(
                        f'would link {WITHDRAW_AUDIT_PERM} -> [{cid}] {role_name}'
                    )
                    linked += 1
                    continue
                RolePermission.objects.create(
                    RolePermUUID=uuid.uuid4().bytes,
                    RoleUUID=role.RoleUUID,
                    PermUUID=perm.PermUUID,
                    CreateTime=timezone.now(),
                )
                linked += 1
                self.stdout.write(
                    self.style.SUCCESS(
                        f'  [{cid}] 已给角色「{role_name}」挂上 {WITHDRAW_AUDIT_PERM}'
                    )
                )

        self.stdout.write(
            self.style.SUCCESS(
                f'完成：挂权 {linked}，缺角色 {missing_roles}。'
                f'另请确认该账号在「数据范围配置」有对应俱乐部 SINGLE_CLUB 任职。'
            )
        )