#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""admin.html 迁移：用户管理改走服务端 API（不再直连 CloudBase user_roles，以便锁库）"""
import re
import sys

NEW_JS = r'''<script>
/* 用户管理 · 服务端版（USERMGMT_SERVER_V1）
   原实现直连 CloudBase user_roles（集合 read:true → 任何登录用户可读全部明文密码）
   现改为：登录走 /api/auth/token，读写在 /api/users/*，仅 admin/gm 可用。 */
var API_FALLBACK = ['https://api.biorisales.site:8443', 'https://api.biorisales.site', 'http://127.0.0.1:8765'];
var TOKEN_KEY = 'biori_admin_token';
var TOKEN = localStorage.getItem(TOKEN_KEY) || '';
var USERS = [], currentUser = null, editingId = null, API_BASE = API_FALLBACK[0];

function toast(msg) {
  var t = document.createElement('div'); t.className = 'toast'; t.textContent = msg;
  document.body.appendChild(t); setTimeout(function() { t.remove(); }, 2200);
}

function api(path, opts) {
  opts = opts || {};
  opts.headers = opts.headers || {};
  if (TOKEN) opts.headers['Authorization'] = 'Bearer ' + TOKEN;
  var idx = 0;
  function tryNext() {
    if (idx >= API_FALLBACK.length) return Promise.reject(new Error('服务不可达'));
    var base = API_FALLBACK[idx++];
    return fetch(base + path, opts).then(function(r) {
      if (r.status === 401) { throw new Error('AUTH'); }
      API_BASE = base;
      return r.json();
    }).catch(function(e) {
      if (e && e.message === 'AUTH') throw e;
      return tryNext();
    });
  }
  return tryNext();
}

function adminLogin() {
  var email = document.getElementById('loginEmail').value.trim();
  var pwd = document.getElementById('loginPwd').value;
  var errEl = document.getElementById('loginErr');
  errEl.style.display = 'none';
  if (!email || !pwd) { errEl.textContent = '请输入邮箱和密码'; errEl.style.display = 'block'; return; }
  api('/api/auth/token', { method: 'POST', headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ email: email, password: pwd }) })
    .then(function(d) {
      if (!d.ok) { errEl.textContent = d.error || '登录失败'; errEl.style.display = 'block'; return; }
      currentUser = d.user || {};
      if (currentUser.role !== 'admin' && currentUser.role !== 'gm') {
        errEl.textContent = '仅管理员可访问'; errEl.style.display = 'block'; return;
      }
      TOKEN = d.token; localStorage.setItem(TOKEN_KEY, TOKEN);
      enterAdmin();
    })
    .catch(function(e) {
      errEl.textContent = (e.message === 'AUTH') ? '登录已过期' : '服务连接失败，请检查网络';
      errEl.style.display = 'block';
    });
}

function enterAdmin() {
  document.getElementById('adminName').textContent = '👑 ' + (currentUser.name || '');
  document.getElementById('loginPage').style.display = 'none';
  document.getElementById('mainPage').style.display = 'block';
  loadUsers();
}

function loadUsers() {
  api('/api/users/list').then(function(d) {
    if (!d.ok) { toast('❌ ' + (d.error || '读取失败')); return; }
    USERS = (d.users || []).sort(function(a, b) { return (a.name || '').localeCompare(b.name || '', 'zh'); });
    document.getElementById('userCount').textContent = USERS.length;
    var tbody = document.getElementById('userTableBody');
    if (!USERS.length) {
      document.getElementById('emptyHint').style.display = 'block'; tbody.innerHTML = ''; return;
    }
    document.getElementById('emptyHint').style.display = 'none';
    var roleTag = { admin: '<span class="tag tag-admin">👑 管理员</span>',
                    gm: '<span class="tag tag-admin">🏢 总经理</span>',
                    manager: '<span class="tag tag-manager">📊 经理</span>',
                    sales: '<span class="tag tag-sales">💼 销售员</span>' };
    tbody.innerHTML = USERS.map(function(u) {
      var uid = u._id || u.email;
      return '<tr>' +
        '<td><b>' + esc(u.name) + '</b></td>' +
        '<td style="font-size:12px">' + esc(u.email || '—') + '</td>' +
        '<td style="font-size:12px">' + esc(u.dept || '—') + '</td>' +
        '<td>' + (roleTag[u.role] || esc(u.role)) + '</td>' +
        '<td>' + (u.status === '在职' ? '🟢 在职' : '🔴 ' + esc(u.status || '禁用')) + '</td>' +
        '<td>' +
          '<button class="btn-sm btn-primary" onclick="editUser(\'' + uid + '\')">编辑</button> ' +
          '<button class="btn-sm" style="background:#f1f3f4" onclick="resetPwd(\'' + uid + '\',\'' + esc(u.name) + '\')">重置密码</button>' +
        '</td></tr>';
    }).join('');
  }).catch(function(e) {
    if (e.message === 'AUTH') { doLogout(); toast('登录已过期，请重新登录'); }
    else toast('❌ 读取失败：' + e.message);
  });
}

function editUser(id) {
  var u = null;
  for (var i = 0; i < USERS.length; i++) { if ((USERS[i]._id || USERS[i].email) === id) { u = USERS[i]; break; } }
  if (!u) { toast('❌ 未找到该用户'); return; }
  editingId = id;
  document.getElementById('modalTitle').textContent = '编辑 ' + u.name;
  document.getElementById('editName').value = u.name || '';
  document.getElementById('editEmail').value = u.email || '';
  document.getElementById('editDept').value = u.dept || '';
  document.getElementById('editRole').value = u.role || 'sales';
  document.getElementById('editPwd').value = '';
  document.getElementById('editStatus').value = u.status || '在职';
  document.getElementById('editModal').style.display = 'flex';
}

function saveUser() {
  var data = {
    name: document.getElementById('editName').value.trim(),
    email: document.getElementById('editEmail').value.trim(),
    dept: document.getElementById('editDept').value.trim(),
    role: document.getElementById('editRole').value,
    status: document.getElementById('editStatus').value
  };
  var pwd = document.getElementById('editPwd').value.trim();
  if (pwd) data.pwd = pwd;
  if (!data.name || !data.email) { toast('⚠️ 姓名和邮箱必填'); return; }
  if (editingId && editingId !== data.email) {
    for (var i = 0; i < USERS.length; i++) {
      if ((USERS[i]._id || USERS[i].email) === editingId && USERS[i]._id) data._id = USERS[i]._id;
    }
  }
  api('/api/users/save', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(data) })
    .then(function(d) {
      if (!d.ok) { toast('❌ ' + (d.error || '保存失败')); return; }
      toast('✅ 已保存'); closeEditModal(); loadUsers();
    })
    .catch(function(e) { toast('❌ ' + (e.message === 'AUTH' ? '登录已过期' : e.message)); });
}

function showAddUser() {
  editingId = null;
  document.getElementById('modalTitle').textContent = '新增用户';
  document.getElementById('editName').value = '';
  document.getElementById('editEmail').value = '';
  document.getElementById('editDept').value = '';
  document.getElementById('editRole').value = 'sales';
  document.getElementById('editPwd').value = 'biori2026';
  document.getElementById('editStatus').value = '在职';
  document.getElementById('editModal').style.display = 'flex';
}

function resetPwd(id, name) {
  var u = null;
  for (var i = 0; i < USERS.length; i++) { if ((USERS[i]._id || USERS[i].email) === id) { u = USERS[i]; break; } }
  if (!u) return;
  if (!confirm('确定把 ' + name + ' 的密码重置为 biori2026？')) return;
  api('/api/users/reset_pwd', { method: 'POST', headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ email: u.email }) })
    .then(function(d) {
      toast(d.ok ? '✅ ' + name + ' 密码已重置为 biori2026' : '❌ ' + (d.error || '重置失败'));
    })
    .catch(function(e) { toast('❌ ' + e.message); });
}

function initDefaultUsers() {
  if (!confirm('将按默认名单补齐缺失用户（密码 biori2026），已有用户不覆盖。继续？')) return;
  var exist = {};
  USERS.forEach(function(u) { exist[(u.email || '').toLowerCase()] = 1; });
  var todo = DEFAULT_USERS.filter(function(u) { return !exist[(u.email || '').toLowerCase()]; });
  if (!todo.length) { toast('✅ 名单已齐，无需导入'); return; }
  var done = 0;
  todo.forEach(function(u) {
    api('/api/users/save', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(u) })
      .then(function() { done++; if (done === todo.length) { toast('✅ 已导入 ' + done + ' 人'); loadUsers(); } })
      .catch(function() { done++; });
  });
}

function closeEditModal() { document.getElementById('editModal').style.display = 'none'; }
function doLogout() {
  currentUser = null; TOKEN = ''; localStorage.removeItem(TOKEN_KEY);
  document.getElementById('loginPage').style.display = 'block';
  document.getElementById('mainPage').style.display = 'none';
}
function esc(s) { return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;'); }

var DEFAULT_USERS = __DEFAULT_USERS__;

/* 启动：有 token 直接尝试进入；否则登录页 */
(function boot() {
  if (TOKEN) {
    api('/api/users/list').then(function(d) {
      if (d && d.ok) {
        currentUser = JSON.parse(localStorage.getItem('biori_admin_user') || '{}');
        enterAdmin();
      } else { document.getElementById('loginPage').style.display = 'block'; }
    }).catch(function() { document.getElementById('loginPage').style.display = 'block'; });
  } else {
    document.getElementById('loginPage').style.display = 'block';
  }
})();
</script>'''


def patch(path):
    s = open(path, encoding='utf-8').read()
    if 'USERMGMT_SERVER_V1' in s:
        return '⏭ 已迁移过：%s' % path
    # 抽取原 DEFAULT_USERS 数组
    m = re.search(r'var DEFAULT_USERS = (\[.*?\]);', s, re.S)
    assert m, '未找到 DEFAULT_USERS'
    seed = m.group(1)
    # 替换整个 <script>…</script> 块（保留 DEFAULT_USERS 数据）
    start = s.index('<script>')
    end = s.index('</script>', start) + len('</script>')
    new = NEW_JS.replace('__DEFAULT_USERS__', seed)
    s = s[:start] + new + s[end:]
    open(path, 'w', encoding='utf-8').write(s)
    return '✅ 已迁移：%s（%d 字节）' % (path, len(s.encode()))


if __name__ == '__main__':
    for p in sys.argv[1:]:
        print(patch(p))