#!/bin/bash
# Fix 3: Lägg till RBAC på period-workflow endpoints

FILE="/opt/amos/services/aamos-ledger/period-workflow.mjs"
BAK="${FILE}.bak-rbac-$(date +%s)"

# Skapa backup
cp "$FILE" "$BAK"

# OBS: Detta kräver att auth.mjs exporterar ROLES och requireRole
# och att de importeras i period-workflow.mjs

# Lägg till import överst i filen (efter de andra imports)
sed -i '1a\
import { requireRole, ROLES } from '\''./auth.mjs'\'';' "$FILE"

# Lägg till requireRole(ROLES.ADMIN) på alla period-endpoints
sed -i "s/app.post('\''\/api\/ledger\/periods\/:period\/open'\''/app.post('\''\/api\/ledger\/periods\/:period\/open'\'', requireRole(ROLES.ADMIN)/" "$FILE"
sed -i "s/app.post('\''\/api\/ledger\/periods\/:period\/submit-review'\''/app.post('\''\/api\/ledger\/periods\/:period\/submit-review'\'', requireRole(ROLES.ADMIN)/" "$FILE"
sed -i "s/app.post('\''\/api\/ledger\/periods\/:period\/approve'\''/app.post('\''\/api\/ledger\/periods\/:period\/approve'\'', requireRole(ROLES.ADMIN)/" "$FILE"
sed -i "s/app.post('\''\/api\/ledger\/periods\/:period\/reject'\''/app.post('\''\/api\/ledger\/periods\/:period\/reject'\'', requireRole(ROLES.ADMIN)/" "$FILE"
sed -i "s/app.post('\''\/api\/ledger\/periods\/:period\/close'\''/app.post('\''\/api\/ledger\/periods\/:period\/close'\'', requireRole(ROLES.ADMIN)/" "$FILE"
sed -i "s/app.post('\''\/api\/ledger\/periods\/:period\/reopen'\''/app.post('\''\/api\/ledger\/periods\/:period\/reopen'\'', requireRole(ROLES.ADMIN)/" "$FILE"

echo "Backup: $BAK"
echo "RBAC fixar applicerade på period-workflow.mjs"