-- ============================================================
-- Phase 2 permission additions.
-- Run AFTER database/migrations/002_phase2_assets.sql
-- Additive only — does not touch Phase 1 rows.
-- ============================================================

INSERT INTO permissions (code, module, description) VALUES
('categories.manage', 'assets', 'Manage asset categories'),
('locations.manage', 'assets', 'Manage locations/offices/departments/stores'),
('employees.manage', 'assets', 'Manage employee/custodian directory');

-- Grant to roles that should already have this per Phase 1 intent.
INSERT INTO role_permissions (role_id, permission_id)
SELECT r.id, p.id FROM roles r, permissions p
WHERE r.code IN ('super_admin') AND p.code IN ('categories.manage','locations.manage','employees.manage')
AND NOT EXISTS (
    SELECT 1 FROM role_permissions rp WHERE rp.role_id = r.id AND rp.permission_id = p.id
);

INSERT INTO role_permissions (role_id, permission_id)
SELECT r.id, p.id FROM roles r, permissions p
WHERE r.code IN ('institution_admin','asset_admin') AND p.code IN ('categories.manage','locations.manage','employees.manage')
AND NOT EXISTS (
    SELECT 1 FROM role_permissions rp WHERE rp.role_id = r.id AND rp.permission_id = p.id
);