const permissionService = strapi.admin?.services?.permission;

if (permissionService?.actionProvider) {
  const aliasMappings = [
    {
      pluginAction: "plugin::api-permissions.roles.read",
      cmAction: "plugin::content-manager.explorer.read",
    },
    {
      pluginAction: "plugin::api-permissions.roles.create",
      cmAction: "plugin::content-manager.explorer.create",
    },
    {
      pluginAction: "plugin::api-permissions.roles.update",
      cmAction: "plugin::content-manager.explorer.update",
    },
    {
      pluginAction: "plugin::api-permissions.roles.delete",
      cmAction: "plugin::content-manager.explorer.delete",
    },
  ];

  for (const { pluginAction, cmAction } of aliasMappings) {
    const main = permissionService.actionProvider.get(cmAction);
    const alias = permissionService.actionProvider.get(pluginAction);

    if (main) {
      if (!main.subjects) main.subjects = [];

      if (!main.subjects.includes("plugin::api-permissions.role")) {
        main.subjects.push("plugin::api-permissions.role");
      }
    }

    if (alias) {
      if (!alias.aliases) alias.aliases = [];

      const exists = alias.aliases.some(({ actionId, subjects }) => {
        return actionId === cmAction && subjects?.includes("plugin::api-permissions.role");
      });

      if (!exists) {
        alias.aliases.push({ actionId: cmAction, subjects: ["plugin::api-permissions.role"] });
      }
    }
  }
}

try {
  const roleService = strapi.service("admin::role");
  await roleService?.resetSuperAdminPermissions?.();
} catch (err) {
  strapi.log.error("Failed to sync Super Admin permissions for API Roles:", err);
}