CREATE TABLE `crm_biz_object_permission` (
    `id` BIGINT NOT NULL AUTO_INCREMENT COMMENT 'Primary Key',
    `biz_type` INT NOT NULL COMMENT 'Business Object Type (1=Lead/2=Customer/3=Contact/4=Opportunity/5=Contract)',
    `biz_type_name` VARCHAR(50) NOT NULL COMMENT 'Business Object Name',
    `operation_type` VARCHAR(20) NOT NULL COMMENT 'Operation Type (CREATE/READ/UPDATE/DELETE/TRANSFER)',
    `operation_name` VARCHAR(50) NOT NULL COMMENT 'Operation Name',
    `role_id` BIGINT DEFAULT NULL COMMENT 'Role ID',
    `post_id` BIGINT DEFAULT NULL COMMENT 'Post ID',
    `dept_id` BIGINT DEFAULT NULL COMMENT 'Department ID',
    `user_id` BIGINT DEFAULT NULL COMMENT 'User ID',
    `status` TINYINT DEFAULT 1 COMMENT 'Status (0=Disabled/1=Enabled)',
    `creator` VARCHAR(64) DEFAULT '' COMMENT 'Creator',
    `create_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT 'Create Time',
    `updater` VARCHAR(64) DEFAULT '' COMMENT 'Updater',
    `update_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    `deleted` BIT DEFAULT 0 COMMENT 'Is Deleted',
    `tenant_id` BIGINT NOT NULL DEFAULT 0 COMMENT 'Tenant ID',
    PRIMARY KEY (`id`),
    KEY `idx_biz_type` (`biz_type`),
    KEY `idx_role_id` (`role_id`),
    KEY `idx_post_id` (`post_id`),
    KEY `idx_dept_id` (`dept_id`),
    KEY `idx_user_id` (`user_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='Business Object Operation Permission Table';

CREATE TABLE `crm_data_scope_permission` (
    `id` BIGINT NOT NULL AUTO_INCREMENT COMMENT 'Primary Key',
    `biz_type` INT NOT NULL COMMENT 'Business Object Type',
    `scope_type` VARCHAR(20) NOT NULL COMMENT 'Data Scope Type (ALL/SELF/DEPT/DEPT_AND_CHILD/CUSTOM)',
    `scope_value` TEXT COMMENT 'Custom Scope Value (JSON format)',
    `max_customer_level` INT DEFAULT NULL COMMENT 'Max Customer Level (NULL=No Limit)',
    `role_id` BIGINT DEFAULT NULL COMMENT 'Role ID',
    `post_id` BIGINT DEFAULT NULL COMMENT 'Post ID',
    `dept_id` BIGINT DEFAULT NULL COMMENT 'Department ID',
    `user_id` BIGINT DEFAULT NULL COMMENT 'User ID',
    `status` TINYINT DEFAULT 1 COMMENT 'Status (0=Disabled/1=Enabled)',
    `creator` VARCHAR(64) DEFAULT '' COMMENT 'Creator',
    `create_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT 'Create Time',
    `updater` VARCHAR(64) DEFAULT '' COMMENT 'Updater',
    `update_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    `deleted` BIT DEFAULT 0 COMMENT 'Is Deleted',
    `tenant_id` BIGINT NOT NULL DEFAULT 0 COMMENT 'Tenant ID',
    PRIMARY KEY (`id`),
    KEY `idx_biz_type` (`biz_type`),
    KEY `idx_role_id` (`role_id`),
    KEY `idx_post_id` (`post_id`),
    KEY `idx_dept_id` (`dept_id`),
    KEY `idx_user_id` (`user_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='Data Scope Permission Table';

@Service
public class CrmPermissionEngineServiceImpl implements CrmPermissionEngineService {

    @Override
    public boolean hasBizOperationPermission(Long userId, Integer bizType, String operationType) {
        // Check by priority high to low: User → Role → Post → Dept
        if (hasUserPermission(userId, bizType, operationType)) return true;
        if (hasRolePermission(userId, bizType, operationType)) return true;
        if (hasPostPermission(userId, bizType, operationType)) return true;
        if (hasDeptPermission(userId, bizType, operationType)) return true;
        return false;
    }

    @Override
    public String buildDataScopeSql(Long userId, Integer bizType) {
        DataScopePermissionDO scope = getDataScope(userId, bizType);
        if (scope == null) return "1=0";

        StringBuilder sqlBuilder = new StringBuilder();

        // Data scope filtering
        switch (scope.getScopeType()) {
            case "ALL": break;
            case "SELF": sqlBuilder.append("owner_user_id = ").append(userId); break;
            case "DEPT": sqlBuilder.append("dept_id = ").append(getUserDeptId(userId)); break;
            case "DEPT_AND_CHILD": sqlBuilder.append("dept_id IN (").append(getUserDeptAndChildIds(userId)).append(")"); break;
            case "CUSTOM": sqlBuilder.append(scope.getScopeValue()); break;
            default: return "1=0";
        }

        // Customer level filtering (AND stacking)
        Integer maxLevel = scope.getMaxCustomerLevel();
        if (maxLevel != null) {
            if (sqlBuilder.length() > 0) sqlBuilder.append(" AND ");
            sqlBuilder.append("level <= ").append(maxLevel);
        }

        return sqlBuilder.toString();
    }
}

@Component
@Intercepts({@Signature(type = Executor.class, method = "query",
        args = {MappedStatement.class, Object.class, RowBounds.class, ResultHandler.class})})
public class CrmDataPermissionInterceptor implements Interceptor {

    // Tables that need cascade customer level filtering via customer_id
    private static final Set<String> CASCADE_CUSTOMER_LEVEL_TABLES = Set.of(
        "crm_business", "crm_contract", "crm_contact",
        "crm_receivable", "crm_receivable_plan"
    );

    @Override
    public Object intercept(Invocation invocation) throws Throwable {
        // 1. Determine if data permission filtering is needed
        // 2. Get current user ID
        // 3. Parse business type
        // 4. Build data permission filter conditions
        // 5. Modify SQL, add WHERE filter conditions
        // 6. Execute query
    }
}