SET NAMES utf8mb4;

CREATE TABLE IF NOT EXISTS admin_roles (
  id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
  role_code VARCHAR(50) NOT NULL,
  role_name VARCHAR(80) NOT NULL,
  description VARCHAR(255) NOT NULL DEFAULT '',
  built_in TINYINT(1) NOT NULL DEFAULT 0,
  status TINYINT UNSIGNED NOT NULL DEFAULT 1,
  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3),
  PRIMARY KEY (id),
  UNIQUE KEY uk_admin_roles_code (role_code)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

CREATE TABLE IF NOT EXISTS admin_permissions (
  permission_code VARCHAR(80) NOT NULL,
  permission_name VARCHAR(100) NOT NULL,
  permission_group VARCHAR(50) NOT NULL,
  sort_order INT NOT NULL DEFAULT 0,
  PRIMARY KEY (permission_code),
  KEY idx_admin_permissions_group (permission_group, sort_order)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

CREATE TABLE IF NOT EXISTS admin_role_permissions (
  role_id BIGINT UNSIGNED NOT NULL,
  permission_code VARCHAR(80) NOT NULL,
  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
  PRIMARY KEY (role_id, permission_code),
  CONSTRAINT fk_admin_role_permissions_role FOREIGN KEY (role_id) REFERENCES admin_roles(id) ON DELETE CASCADE,
  CONSTRAINT fk_admin_role_permissions_permission FOREIGN KEY (permission_code) REFERENCES admin_permissions(permission_code) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

CREATE TABLE IF NOT EXISTS admin_user_roles (
  admin_user_id BIGINT UNSIGNED NOT NULL,
  role_id BIGINT UNSIGNED NOT NULL,
  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
  PRIMARY KEY (admin_user_id, role_id),
  KEY idx_admin_user_roles_role (role_id),
  CONSTRAINT fk_admin_user_roles_user FOREIGN KEY (admin_user_id) REFERENCES admin_users(id) ON DELETE CASCADE,
  CONSTRAINT fk_admin_user_roles_role FOREIGN KEY (role_id) REFERENCES admin_roles(id) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

INSERT INTO admin_permissions (permission_code, permission_name, permission_group, sort_order) VALUES
  ('dashboard:view', '查看运营概览', 'dashboard', 10),
  ('users:view', '查看用户', 'users', 20),
  ('users:manage', '编辑用户资料和会员', 'users', 21),
  ('users:security', '重置密码和强制下线', 'users', 22),
  ('verification:manage', '审核用户认证', 'users', 23),
  ('violations:manage', '处理违规和账号处罚', 'users', 24),
  ('content:view', '查看动态内容', 'content', 30),
  ('content:manage', '删除和处置动态', 'content', 31),
  ('messages:view', '查看聊天消息记录', 'content', 32),
  ('reports:handle', '处理举报', 'risk', 40),
  ('risk:view', '查看风险信息', 'risk', 41),
  ('membership:manage', '管理会员套餐', 'commerce', 50),
  ('orders:view', '查看订单', 'commerce', 51),
  ('orders:manage', '变更订单和退款', 'commerce', 52),
  ('system:manage', '管理系统、集成和管理员', 'system', 60)
ON DUPLICATE KEY UPDATE
  permission_name=VALUES(permission_name),
  permission_group=VALUES(permission_group),
  sort_order=VALUES(sort_order);

INSERT INTO admin_roles (role_code, role_name, description, built_in, status)
VALUES ('super_admin', '超级管理员', '拥有平台全部权限；内置角色不可删除', 1, 1)
ON DUPLICATE KEY UPDATE role_name=VALUES(role_name), description=VALUES(description), built_in=1, status=1;

INSERT IGNORE INTO admin_role_permissions (role_id, permission_code)
SELECT r.id, p.permission_code
FROM admin_roles r CROSS JOIN admin_permissions p
WHERE r.role_code='super_admin';

-- Existing administrators keep their current capabilities after RBAC is enabled.
INSERT IGNORE INTO admin_user_roles (admin_user_id, role_id)
SELECT a.id, r.id
FROM admin_users a JOIN admin_roles r ON r.role_code='super_admin';