-- =============================================================================
-- 脚本名称: 011_teacher_student_remove_permissions.sql
-- 业务模块: 教师与学员零引用安全删除权限节点注册 (ZERO-REFERENCE SAFE DELETE RBAC)
-- 适用数据库: KingbaseES, schema public
-- 范围: 仅限 sys_menu 按钮级权限增量注册，不改动已有角色分配 (sys_role_menu Δ = 0)
-- 幂等性设计: 支持重复执行，WHERE NOT EXISTS 防重，无破坏性语句
-- 安全红线:
--   1. 严禁执行 007_dicts.sql
--   2. 严禁清空/重建 sys_menu
--   3. 严禁重置角色权限
--   4. 严禁给 train_admin (role_id = 3) 自动赋权，保持 TRAIN_ADMIN_*_REMOVE = NO
-- =============================================================================

BEGIN;

-- 前置碰撞检查
DO $$
BEGIN
    IF EXISTS (
        SELECT 1 FROM public.sys_menu
        WHERE menu_id = 2245 AND perms <> 'train:teacher:remove'
    ) THEN
        RAISE EXCEPTION 'Menu ID 2245 collides with an existing menu item';
    END IF;

    IF EXISTS (
        SELECT 1 FROM public.sys_menu
        WHERE menu_id = 2246 AND perms <> 'train:student:remove'
    ) THEN
        RAISE EXCEPTION 'Menu ID 2246 collides with an existing menu item';
    END IF;
END $$;

-- 1. 教师删除按钮权限 (train:teacher:remove, parent: 2155 教师管理)
INSERT INTO public.sys_menu
    (menu_id, menu_name, parent_id, order_num, path, component, query, is_frame, is_cache,
     menu_type, visible, status, perms, icon, create_by, create_time, remark)
SELECT 2245, '教师删除', 2155, 7, '#', '', '', 1, 0,
       'F', '0', '0', 'train:teacher:remove', '#', 'admin', CURRENT_TIMESTAMP, '教师档案安全删除'
WHERE NOT EXISTS (SELECT 1 FROM public.sys_menu WHERE perms = 'train:teacher:remove');

-- 2. 学员删除按钮权限 (train:student:remove, parent: 2156 学员管理)
INSERT INTO public.sys_menu
    (menu_id, menu_name, parent_id, order_num, path, component, query, is_frame, is_cache,
     menu_type, visible, status, perms, icon, create_by, create_time, remark)
SELECT 2246, '学员删除', 2156, 6, '#', '', '', 1, 0,
       'F', '0', '0', 'train:student:remove', '#', 'admin', CURRENT_TIMESTAMP, '学员档案安全删除'
WHERE NOT EXISTS (SELECT 1 FROM public.sys_menu WHERE perms = 'train:student:remove');

-- 3. 后置自检验收 (断言权限存在且唯一，且未向 train_admin 越权授权)
DO $$
BEGIN
    IF (SELECT count(*) FROM public.sys_menu WHERE perms = 'train:teacher:remove' AND parent_id = 2155 AND menu_type = 'F') <> 1 THEN
        RAISE EXCEPTION 'Teacher remove permission registration verification failed';
    END IF;

    IF (SELECT count(*) FROM public.sys_menu WHERE perms = 'train:student:remove' AND parent_id = 2156 AND menu_type = 'F') <> 1 THEN
        RAISE EXCEPTION 'Student remove permission registration verification failed';
    END IF;

    -- 严格断言 train_admin (role_id = 3) 未被分配这两个权限
    IF EXISTS (
        SELECT 1 FROM public.sys_role_menu rm
        JOIN public.sys_menu m ON rm.menu_id = m.menu_id
        WHERE rm.role_id = 3 AND m.perms IN ('train:teacher:remove', 'train:student:remove')
    ) THEN
        RAISE EXCEPTION 'FATAL: train_admin must not be granted teacher/student remove permissions';
    END IF;
END $$;

COMMIT;