#!/usr/bin/env node
const assert = require('assert');
const fs = require('fs');
const os = require('os');
const path = require('path');

const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'qiwei-group-ops-access-'));
process.env.QIWEI_OUTPUTS_DIR = path.join(tempDir, 'outputs');
const { getGroupOperationsStore } = require('../mcp/src/core/group-operations-store');
const { qiweiGroupOpsManageAccess, qiweiGroupOpsManagePlaybook, qiweiGroupOpsGeneratePlan, qiweiGroupOpsExecuteItem } = require('../mcp/src/tools/qiwei-group-operations-run');
const store = getGroupOperationsStore();

(async () => {
  try {
    const key = 'access-smoke';
    const hq = 'hq-test';
    const manager = 'store-manager-test';
    const auditor = 'auditor-test';
    const bootstrapped = await qiweiGroupOpsManageAccess({ accountKey: key, action: 'upsert', principal: hq, role: 'headquarters_admin', actor: hq, bootstrapConfirmed: true });
    assert.equal(bootstrapped.status, 'ok');
    assert.equal((await qiweiGroupOpsManageAccess({ accountKey: key, action: 'upsert', principal: manager, requester: hq, role: 'store_manager', storeScope: ['store-a'], actor: hq })).status, 'ok');
    assert.equal((await qiweiGroupOpsManageAccess({ accountKey: key, action: 'upsert', principal: auditor, requester: hq, role: 'auditor', actor: hq })).status, 'ok');

    const created = await qiweiGroupOpsManagePlaybook({ accountKey: key, action: 'create', name: '权限测试 SOP', groupType: 'customer', content: { cadence: [{ template: '测试 {{room_name}}' }] }, actor: hq, principal: hq });
    assert.equal(created.status, 'ok');
    const playbookId = created.data.playbook.id;
    assert.equal((await qiweiGroupOpsManagePlaybook({ accountKey: key, action: 'publish', playbookId, confirmed: true, actor: hq, principal: hq })).status, 'ok');
    store.upsertGroup(key, { roomId: 'room-a', roomName: '门店 A 群', storeId: 'store-a', playbookId }, hq);
    store.upsertGroup(key, { roomId: 'room-b', roomName: '门店 B 群', storeId: 'store-b', playbookId }, hq);

    const allowedPlan = await qiweiGroupOpsGeneratePlan({ accountKey: key, principal: manager, actor: manager, roomId: 'room-a', planDate: '2026-07-20' });
    assert.equal(allowedPlan.status, 'ok');
    const deniedPlan = await qiweiGroupOpsGeneratePlan({ accountKey: key, principal: manager, actor: manager, roomId: 'room-b', planDate: '2026-07-20' });
    assert.equal(deniedPlan.status, 'error');
    assert.match(deniedPlan.assistantMessage, /无权操作门店/);
    const deniedPublish = await qiweiGroupOpsManagePlaybook({ accountKey: key, principal: manager, actor: manager, action: 'publish', playbookId, confirmed: true });
    assert.equal(deniedPublish.status, 'error');
    const itemId = allowedPlan.data.plan.items[0].id;
    const deniedExecute = await qiweiGroupOpsExecuteItem({ accountKey: key, principal: auditor, actor: auditor, itemId, action: 'approve' });
    assert.equal(deniedExecute.status, 'error');
    assert.match(deniedExecute.assistantMessage, /没有 execute_items 权限/);
    console.log('group-operations access smoke: ok');
  } finally {
    store.close();
    fs.rmSync(tempDir, { recursive: true, force: true });
  }
})().catch(error => { console.error(error.stack || error.message); process.exit(1); });