#!/usr/bin/env node
import {writeFileSync,mkdirSync} from 'node:fs';
import {resolve} from 'node:path';
import {STORE_PRIVATE_CLASSES,privateClassPermissions} from './store-access-policy.mjs';
const base=(process.env.XIAOSHU_PARSE_URL||'https://server.xiaoshu.pro/parse').replace(/\/$/,''),app=process.env.XIAOSHU_PARSE_APP_ID||'7pIbDBJmKx_main',key=process.env.XIAOSHU_MASTER_KEY;
if(!key)throw Error('缺少 XIAOSHU_MASTER_KEY');
async function request(path,method='GET',body){const r=await fetch(base+path,{method,headers:{'X-Parse-Application-Id':app,'X-Parse-Master-Key':key,'Content-Type':'application/json'},...(body?{body:JSON.stringify(body)}:{})});const value=await r.json();if(!r.ok)throw Error(`${path}: ${value.error||r.status}`);return value;}
const schemas=(await request('/schemas')).results,items=STORE_PRIVATE_CLASSES.map(name=>schemas.find(s=>s.className===name)).filter(Boolean),out=resolve(process.env.XIAOSHU_BACKUP_DIR||'.local/store-scope-backup');
mkdirSync(out,{recursive:true,mode:0o700});const filename=resolve(out,`permissions-${Date.now()}.json`);writeFileSync(filename,JSON.stringify(items.map(s=>({className:s.className,classLevelPermissions:s.classLevelPermissions})),null,2),{mode:0o600});
console.log(`已备份 ${items.length} 个表的权限：${filename}`);
if(process.argv.includes('--apply'))for(const schema of items){await request('/schemas/'+schema.className,'PUT',{classLevelPermissions:privateClassPermissions(schema.classLevelPermissions)});console.log('已限制直接访问：'+schema.className);}
else console.log('只读检查完成；--apply 才会应用权限。数据库函数请通过受保护迁移通道安装 scripts/sql/store-scope.sql。');