CREATE TABLE `crm_biz_object_permission` (
    `id` BIGINT NOT NULL AUTO_INCREMENT COMMENT '主鍵',
    `biz_type` INT NOT NULL COMMENT '業務物件型別(1線索/2客戶/3聯絡人/4商機/5合同)',
    `biz_type_name` VARCHAR(50) NOT NULL COMMENT '業務物件名稱',
    `operation_type` VARCHAR(20) NOT NULL COMMENT '操作型別(CREATE/READ/UPDATE/DELETE/TRANSFER)',
    `operation_name` VARCHAR(50) NOT NULL COMMENT '操作名稱',
    `role_id` BIGINT DEFAULT NULL COMMENT '角色ID',
    `post_id` BIGINT DEFAULT NULL COMMENT '崗位ID',
    `dept_id` BIGINT DEFAULT NULL COMMENT '部門ID',
    `user_id` BIGINT DEFAULT NULL COMMENT '使用者ID',
    `status` TINYINT DEFAULT 1 COMMENT '狀態(0禁用/1啟用)',
    `creator` VARCHAR(64) DEFAULT '' COMMENT '建立者',
    `create_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '建立時間',
    `updater` VARCHAR(64) DEFAULT '' COMMENT '更新者',
    `update_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    `deleted` BIT DEFAULT 0 COMMENT '是否刪除',
    `tenant_id` BIGINT NOT NULL DEFAULT 0 COMMENT '租戶編號',
    PRIMARY KEY (`id`),
    KEY `idx_biz_type` (`biz_type`),
    KEY `idx_role_id` (`role_id`),
    KEY `idx_post_id` (`post_id`),
    KEY `idx_dept_id` (`dept_id`),
    KEY `idx_user_id` (`user_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='業務物件操作許可權表';

CREATE TABLE `crm_data_scope_permission` (
    `id` BIGINT NOT NULL AUTO_INCREMENT COMMENT '主鍵',
    `biz_type` INT NOT NULL COMMENT '業務物件型別',
    `scope_type` VARCHAR(20) NOT NULL COMMENT '資料範圍型別(ALL/SELF/DEPT/DEPT_AND_CHILD/CUSTOM)',
    `scope_value` TEXT COMMENT '自定義範圍值(JSON格式)',
    `max_customer_level` INT DEFAULT NULL COMMENT '最大客戶等級(NULL=不限制)',
    `role_id` BIGINT DEFAULT NULL COMMENT '角色ID',
    `post_id` BIGINT DEFAULT NULL COMMENT '崗位ID',
    `dept_id` BIGINT DEFAULT NULL COMMENT '部門ID',
    `user_id` BIGINT DEFAULT NULL COMMENT '使用者ID',
    `status` TINYINT DEFAULT 1 COMMENT '狀態(0禁用/1啟用)',
    `creator` VARCHAR(64) DEFAULT '' COMMENT '建立者',
    `create_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '建立時間',
    `updater` VARCHAR(64) DEFAULT '' COMMENT '更新者',
    `update_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    `deleted` BIT DEFAULT 0 COMMENT '是否刪除',
    `tenant_id` BIGINT NOT NULL DEFAULT 0 COMMENT '租戶編號',
    PRIMARY KEY (`id`),
    KEY `idx_biz_type` (`biz_type`),
    KEY `idx_role_id` (`role_id`),
    KEY `idx_post_id` (`post_id`),
    KEY `idx_dept_id` (`dept_id`),
    KEY `idx_user_id` (`user_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='資料許可權範圍表';

@Service
public class CrmPermissionEngineServiceImpl implements CrmPermissionEngineService {

    @Override
    public boolean hasBizOperationPermission(Long userId, Integer bizType, String operationType) {
        // 按優先順序從高到低檢查：使用者 → 角色 → 崗位 → 部門
        if (hasUserPermission(userId, bizType, operationType)) return true;
        if (hasRolePermission(userId, bizType, operationType)) return true;
        if (hasPostPermission(userId, bizType, operationType)) return true;
        if (hasDeptPermission(userId, bizType, operationType)) return true;
        return false;
    }

    @Override
    public String buildDataScopeSql(Long userId, Integer bizType) {
        DataScopePermissionDO scope = getDataScope(userId, bizType);
        if (scope == null) return "1=0";

        StringBuilder sqlBuilder = new StringBuilder();

        // 資料範圍過濾
        switch (scope.getScopeType()) {
            case "ALL": break;
            case "SELF": sqlBuilder.append("owner_user_id = ").append(userId); break;
            case "DEPT": sqlBuilder.append("dept_id = ").append(getUserDeptId(userId)); break;
            case "DEPT_AND_CHILD": sqlBuilder.append("dept_id IN (").append(getUserDeptAndChildIds(userId)).append(")"); break;
            case "CUSTOM": sqlBuilder.append(scope.getScopeValue()); break;
            default: return "1=0";
        }

        // 客戶等級過濾（AND 疊加）
        Integer maxLevel = scope.getMaxCustomerLevel();
        if (maxLevel != null) {
            if (sqlBuilder.length() > 0) sqlBuilder.append(" AND ");
            sqlBuilder.append("level <= ").append(maxLevel);
        }

        return sqlBuilder.toString();
    }
}

@Component
@Intercepts({@Signature(type = Executor.class, method = "query",
        args = {MappedStatement.class, Object.class, RowBounds.class, ResultHandler.class})})
public class CrmDataPermissionInterceptor implements Interceptor {

    // 需要透過 customer_id 關聯客戶表進行等級級聯過濾的表
    private static final Set<String> CASCADE_CUSTOMER_LEVEL_TABLES = Set.of(
        "crm_business", "crm_contract", "crm_contact",
        "crm_receivable", "crm_receivable_plan"
    );

    @Override
    public Object intercept(Invocation invocation) throws Throwable {
        // 1. 判斷是否需要資料許可權過濾
        // 2. 獲取當前使用者ID
        // 3. 解析業務型別
        // 4. 構建資料許可權過濾條件
        // 5. 修改 SQL，新增 WHERE 過濾條件
        // 6. 執行查詢
    }
}