ctms/frontend/src/api/projectPermissions.ts

import { apiGet, apiPut, apiPost, apiDelete, type ApiRequestConfig } from "./axios";
import type {
  ApiEndpointPermissionsResponse,
  ApiEndpointPermissionsUpdate,
  ApiOperation,
  PermissionMetricsResponse,
  CacheStatsResponse,
  AlertsResponse,
  HealthResponse,
  AccessLogsResponse,
  SecurityAccessLogsResponse,
  TrendsResponse,
  TopDeniedResponse,
  StatsSummaryResponse,
  IpLocationsResponse,
} from "../types/api";

// 接口级权限
export const fetchApiEndpointPermissions = (studyId: string, config?: ApiRequestConfig) =>
  apiGet<ApiEndpointPermissionsResponse>(`/api/v1/studies/${studyId}/api-permissions`, config);

export const fetchMyApiEndpointPermissions = (studyId: string, config?: ApiRequestConfig) =>
  apiGet<ApiEndpointPermissionsResponse>(`/api/v1/studies/${studyId}/api-permissions/me`, config);

export const updateApiEndpointPermissions = (
  studyId: string,
  payload: ApiEndpointPermissionsUpdate,
  options?: { confirm_prerequisite_adjustments?: boolean },
) =>
  apiPut<ApiEndpointPermissionsResponse>(`/api/v1/studies/${studyId}/api-permissions`, payload, {
    params: options?.confirm_prerequisite_adjustments ? { confirm_prerequisite_adjustments: true } : undefined,
  });

export const fetchApiOperations = () =>
  apiGet<{ operations: ApiOperation[] }>(`/api/v1/api-permissions/operations`);

// 系统监测API
export const fetchPermissionMetrics = () =>
  apiGet<PermissionMetricsResponse>(`/api/v1/permission-monitoring/metrics`);

export const fetchCacheStats = () =>
  apiGet<CacheStatsResponse>(`/api/v1/permission-monitoring/cache-stats`);

export const fetchPermissionAlerts = (level?: string, limit?: number) =>
  apiGet<AlertsResponse>(`/api/v1/permission-monitoring/alerts`, {
    params: { level, limit },
  });

export const fetchPermissionHealth = () =>
  apiGet<HealthResponse>(`/api/v1/permission-monitoring/health`);

export const resetPermissionMetrics = () =>
  apiPost<void>(`/api/v1/permission-monitoring/reset-metrics`);

export const clearPermissionAlerts = () =>
  apiPost<void>(`/api/v1/permission-monitoring/clear-alerts`);

// 系统监测 - 新增API
export const fetchAccessLogs = (params: {
  study_id?: string;
  user_id?: string;
  endpoint_key?: string;
  role?: string;
  allowed?: boolean;
  start_time?: string;
  end_time?: string;
  page?: number;
  page_size?: number;
}) => apiGet<AccessLogsResponse>(`/api/v1/permission-monitoring/access-logs`, { params });

export const fetchSecurityAccessLogs = (params?: {
  status_min?: number;
  auth_status?: string;
  client_type?: string;
  client_version?: string;
  page?: number;
  page_size?: number;
}) => apiGet<SecurityAccessLogsResponse>(`/api/v1/permission-monitoring/security-logs`, { params });

export const fetchPermissionTrends = (period: "24h" | "7d" | "30d" = "24h") =>
  apiGet<TrendsResponse>(`/api/v1/permission-monitoring/trends`, { params: { period } });

export const fetchTopDenied = (params?: { days?: number; limit?: number }) =>
  apiGet<TopDeniedResponse>(`/api/v1/permission-monitoring/top-denied`, { params });

export const fetchIpLocations = (params?: { days?: number; limit?: number }) =>
  apiGet<IpLocationsResponse>(`/api/v1/permission-monitoring/ip-locations`, { params });

export const fetchStatsSummary = () =>
  apiGet<StatsSummaryResponse>(`/api/v1/permission-monitoring/stats-summary`);

// 权限模板API
export interface PermissionTemplate {
  id: string;
  name: string;
  description: string | null;
  template_type: "ROLE" | "SCENARIO" | "CUSTOM";
  is_system: boolean;
  created_by: string | null;
  created_at: string;
  updated_at: string;
  permissions: Record<string, Record<string, boolean>>;
  tags: string | null;
  category: string | null;
  recommended_roles: string | null;
  versions: Array<{ id: string; version: number; change_log: string | null; created_at: string }>;
}

export interface PermissionTemplateCreate {
  name: string;
  description?: string;
  template_type: "ROLE" | "SCENARIO" | "CUSTOM";
  permissions: Record<string, Record<string, boolean>>;
  tags?: string;
  category?: string;
  recommended_roles?: string;
}

export interface ApplyTemplateRequest {
  template_id: string;
  roles?: string[];
  override?: boolean;
}

export interface ApplyTemplateResponse {
  study_id: string;
  applied_roles: string[];
  permissions: Record<string, Record<string, { allowed: boolean }>>;
}

export const fetchPermissionTemplates = (params?: { template_type?: string; category?: string }) =>
  apiGet<PermissionTemplate[]>(`/api/v1/permission-templates`, { params });

export const fetchPermissionTemplate = (templateId: string) =>
  apiGet<PermissionTemplate>(`/api/v1/permission-templates/${templateId}`);

export const createPermissionTemplate = (payload: PermissionTemplateCreate) =>
  apiPost<PermissionTemplate>(`/api/v1/permission-templates`, payload);

export const updatePermissionTemplate = (templateId: string, payload: Partial<PermissionTemplateCreate>) =>
  apiPut<PermissionTemplate>(`/api/v1/permission-templates/${templateId}`, payload);

export const deletePermissionTemplate = (templateId: string) =>
  apiDelete<void>(`/api/v1/permission-templates/${templateId}`);

export const applyPermissionTemplate = (studyId: string, payload: ApplyTemplateRequest) =>
  apiPost<ApplyTemplateResponse>(
    `/api/v1/studies/${studyId}/permission-templates/${payload.template_id}/apply`,
    payload,
  );

// 系统级权限
export interface SystemPermissionItem {
  permission_key: string;
  module: string;
  module_label: string;
  action: string;
  description: string;
  roles: string[];
}

export interface SystemPermissionsResponse {
  permissions: SystemPermissionItem[];
  module_labels: Record<string, string>;
}

export const fetchSystemPermissions = () =>
  apiGet<SystemPermissionsResponse>(`/api/v1/system-permissions`);

// 项目角色生效管理
export const fetchActiveRoles = (studyId: string) =>
  apiGet<{ active_roles: string[] }>(`/api/v1/studies/${studyId}/active-roles`);

export const updateActiveRoles = (studyId: string, activeRoles: string[]) =>
  apiPut<{ active_roles: string[] }>(`/api/v1/studies/${studyId}/active-roles`, { active_roles: activeRoles });