#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""三部门逐月拆分_demo.html 行级授权实测（Chrome headless=old）。

每种身份：dump DOM → 解析授权条 + 下钻表；做泄露断言；出截图。
"""
import json, os, re, subprocess, sys, io, time

CH = '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome'
SCR = '/Users/liuxinyuan/.hermes/profiles/zone-b/cache/scratch/authrow'
SHOTS = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))),
                     '工具/仪表盘/_shots_authrow')
BASE = 'http://127.0.0.1:8765/工具/仪表盘/三部门逐月拆分_demo.html'
os.makedirs(SCR, exist_ok=True)
os.makedirs(SHOTS, exist_ok=True)

def run(args, timeout=90):
    p = subprocess.run(args, capture_output=True, text=True, timeout=timeout)
    return p.stdout, p.stderr, p.returncode

def dump(url, tag, screenshot=None):
    prof = os.path.join(SCR, 'prof_' + tag)
    args = [CH, '--headless=old', '--disable-gpu', '--no-sandbox', '--no-first-run',
            '--no-default-browser-check', '--disable-breakpad', '--hide-scrollbars',
            '--user-data-dir=' + prof, '--window-size=1680,1400',
            '--virtual-time-budget=8000']
    if screenshot:
        args.append('--screenshot=' + screenshot)
    else:
        args.append('--dump-dom')
    args.append(url)
    out, err, rc = run(args)
    return out, err, rc

def clean(html):
    t = re.sub(r'<script[^>]*>.*?</script>', ' ', html, flags=re.S)
    t = re.sub(r'<style[^>]*>.*?</style>', ' ', t, flags=re.S)
    t = re.sub(r'<[^>]+>', ' ', t)
    return re.sub(r'\s+', ' ', t)

def parse_authbar(html):
    m = re.search(r'id="authbar"[^>]*>(.*?)</div>', html, re.S)
    return re.sub(r'<[^>]+>', '', m.group(1)).strip() if m else 'NOT FOUND'

def parse_drill(html):
    m = re.search(r'id="tbl-drill"(.*?)</table>', html, re.S)
    if not m: return None, [], 0.0
    seg = m.group(1)
    rows = re.findall(r'<tr><td class="name"[^>]*>(.*?)</td>\s*<td class="mono">([\d,\.\-]+)</td>\s*<td class="mono">([\d\.\-]+)%</td></tr>', seg)
    tot = sum(float(r[1].replace(',', '')) for r in rows if r[1] not in ('—',))
    summary = re.search(r'id="drill-sum"[^>]*>(.*?)</span>', seg)
    return seg, rows, tot

IDENTITIES = [
    ('admin',   {'u': '刘新元', 'r': 'admin', 'd': '诊断原料销售部'}),
    ('gm',      {'u': '何超锦', 'r': 'gm',    'd': '营销中心'}),
    ('sales',   {'u': '赵云浩', 'r': 'sales', 'd': '大客户部'}),
    ('anon',    None),
]

OTHER_NAMES = ['西安华伟科技有限公司', '珠海丽珠试剂股份有限公司', '广州万孚生物技术股份有限公司']

results = {}
for tag, q in IDENTITIES:
    url = BASE + ('?' + '&'.join('%s=%s' % (k, v) for k, v in q.items()) if q else '')
    from urllib.parse import quote
    if q:
        url = BASE + '?' + '&'.join('%s=%s' % (k, quote(v)) for k, v in q.items())
    shot = os.path.join(SHOTS, 'authrow_%s.png' % tag)
    html, err, rc = dump(url, tag, screenshot=shot)
    if not html:
        # screenshot mode returns no stdout; read the shot exists
        pass
    # second call for DOM
    dom, err2, rc2 = dump(url, tag + '_dom')
    io.open(os.path.join(SCR, 'dom_%s.html' % tag), 'w', encoding='utf-8').write(dom)
    txt = clean(dom)
    ab = parse_authbar(dom)
    seg, rows, tot = parse_drill(dom)
    leak = {n: (n in txt) for n in OTHER_NAMES}
    results[tag] = {'authbar': ab, 'n_rows': len(rows), 'sum': round(tot, 1),
                    'top3': [r[0] for r in rows[:3]], 'leak': leak,
                    'secret_leak': ('保密客户' in txt), 'shot': shot,
                    'dom_len': len(dom)}
    print('=' * 70)
    print('[%s] url=%s' % (tag, url))
    print('  authbar : %s' % ab)
    print('  drill   : rows=%d sum=%.1f' % (len(rows), tot))
    print('  top3    : %s' % ' | '.join(r[0] for r in rows[:3]))
    print('  leak    : %s' % leak)
    print('  保密客户 in DOM: %s' % ('保密客户' in txt))
    print('  shot    : %s' % shot)

io.open(os.path.join(SCR, 'results.json'), 'w', encoding='utf-8').write(
    json.dumps(results, ensure_ascii=False, indent=1))
print('\nsaved', os.path.join(SCR, 'results.json'))