#!/bin/bash
# Story: #730 (Admin can manage Permission Sets and User assignments)
# AC2:   Changing a Permission Set permission flag propagates to all dependent
#        record-level access flags defined by the schema (canonical generic contract)
#
# Test scenario: setting ModifyAllRecords=true SHOULD cascade to
#   ViewAllRecords / Edit / Delete (the dependency table per ObjectPermissions schema)
#
# PASS:    after POST OP with PermissionsModifyAllRecords=true and other deps=false,
#          read-back shows VAR/E/D auto-set to true
# FAIL:    deps stayed false (no cascade)
# BLOCKED: PS create failed

# Related issue: pack#1061

. "$(dirname "$0")/../common/lib.sh"

TOK=$(get_admin_token) || {
  emit_verdict "#730" "AC2" "BLOCKED" "admin token unavailable"
  exit 0
}

TS=$(date +%s)
PS_RESP=$(api_post "$TOK" "/sobjects/PermissionSet" "{\"Name\":\"qa_r6_cascade_${TS}\",\"Label\":\"QA R6 Cascade ${TS}\"}")
PS_ID=$(echo "$PS_RESP" | python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" 2>/dev/null)
if [ -z "$PS_ID" ]; then
  emit_verdict "#730" "AC2" "BLOCKED" "PS create failed: $PS_RESP"
  exit 0
fi

OP_RESP=$(api_post "$TOK" "/sobjects/ObjectPermissions" "{
  \"ParentId\":\"$PS_ID\",
  \"SobjectType\":\"Account\",
  \"PermissionsRead\":true,
  \"PermissionsCreate\":false,
  \"PermissionsEdit\":false,
  \"PermissionsDelete\":false,
  \"PermissionsViewAllRecords\":false,
  \"PermissionsModifyAllRecords\":true
}")
OP_ID=$(echo "$OP_RESP" | python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" 2>/dev/null)
if [ -z "$OP_ID" ]; then
  api_status "$TOK" DELETE "/sobjects/PermissionSet/$PS_ID" > /dev/null
  emit_verdict "#730" "AC2" "BLOCKED" "OP create failed: $OP_RESP"
  exit 0
fi

READ_BACK=$(api_query "$TOK" "SELECT PermissionsModifyAllRecords,PermissionsViewAllRecords,PermissionsEdit,PermissionsDelete FROM ObjectPermissions WHERE Id='$OP_ID'")
MAR=$(echo "$READ_BACK" | python3 -c "import json,sys; r=json.load(sys.stdin)['records'][0]; print(r['PermissionsModifyAllRecords'])")
VAR=$(echo "$READ_BACK" | python3 -c "import json,sys; r=json.load(sys.stdin)['records'][0]; print(r['PermissionsViewAllRecords'])")
EDIT=$(echo "$READ_BACK" | python3 -c "import json,sys; r=json.load(sys.stdin)['records'][0]; print(r['PermissionsEdit'])")
DEL=$(echo "$READ_BACK" | python3 -c "import json,sys; r=json.load(sys.stdin)['records'][0]; print(r['PermissionsDelete'])")

EV="MAR=$MAR VAR=$VAR Edit=$EDIT Delete=$DEL (PASS requires VAR/Edit/Delete all True when MAR=True)"

# Cleanup
api_status "$TOK" DELETE "/sobjects/ObjectPermissions/$OP_ID" > /dev/null
api_status "$TOK" DELETE "/sobjects/PermissionSet/$PS_ID" > /dev/null

if [ "$MAR" = "True" ] && [ "$VAR" = "True" ] && [ "$EDIT" = "True" ] && [ "$DEL" = "True" ]; then
  emit_verdict "#730" "AC2" "PASS" "$EV"
else
  emit_verdict "#730" "AC2" "FAIL" "$EV"
fi