-- =====================================================================
-- RBAC seed: Super Admin (full access + backup) + module-based admin roles
-- =====================================================================

SET NAMES utf8mb4;

INSERT INTO roles (slug, name, is_super_admin, description) VALUES
('super_admin', 'Super Admin', 1, 'Full project access, all modules, can run/download complete project backups'),
('ops_admin', 'Operations Admin', 0, 'Orders, pharmacies, delivery day-to-day operations'),
('finance_admin', 'Finance Admin', 0, 'Commission, settlements, refunds, platform finance'),
('crm_admin', 'Sales / CRM Admin', 0, 'Leads, follow-ups, targets'),
('support_admin', 'Support Admin', 0, 'Support tickets, notifications, customer/order lookup (read-mostly)');

INSERT INTO modules (slug, name) VALUES
('dashboard', 'Dashboard'),
('customers', 'Customers'),
('pharmacies', 'Pharmacies'),
('products', 'Catalogue / Products'),
('prescriptions', 'Prescriptions'),
('orders', 'Orders'),
('delivery', 'Delivery & Tracking'),
('delivery_partners', 'Delivery Partners'),
('commission', 'Commission Engine'),
('finance', 'Finance & Settlement'),
('crm', 'Sales / CRM'),
('offers', 'Offers & Coupons'),
('notifications', 'Notifications'),
('reports', 'Reports'),
('support', 'Support Tickets'),
('settings', 'System Settings'),
('backup', 'Backup & Restore'),
('admin_users', 'Admin User Management');

-- Super Admin: full CRUD+export on every module (bypasses checks anyway, but kept explicit for audit clarity)
INSERT INTO role_module_permissions (role_id, module_id, can_view, can_create, can_edit, can_delete, can_export)
SELECT r.id, m.id, 1, 1, 1, 1, 1
FROM roles r CROSS JOIN modules m
WHERE r.slug = 'super_admin';

-- Ops Admin
INSERT INTO role_module_permissions (role_id, module_id, can_view, can_create, can_edit, can_delete, can_export)
SELECT r.id, m.id, 1, 1, 1, 0, 1 FROM roles r CROSS JOIN modules m
WHERE r.slug = 'ops_admin' AND m.slug IN ('dashboard','customers','pharmacies','products','prescriptions','orders','delivery','delivery_partners','reports','support');

-- Finance Admin
INSERT INTO role_module_permissions (role_id, module_id, can_view, can_create, can_edit, can_delete, can_export)
SELECT r.id, m.id, 1, 1, 1, 0, 1 FROM roles r CROSS JOIN modules m
WHERE r.slug = 'finance_admin' AND m.slug IN ('dashboard','commission','finance','orders','reports');

-- CRM Admin
INSERT INTO role_module_permissions (role_id, module_id, can_view, can_create, can_edit, can_delete, can_export)
SELECT r.id, m.id, 1, 1, 1, 0, 1 FROM roles r CROSS JOIN modules m
WHERE r.slug = 'crm_admin' AND m.slug IN ('dashboard','crm','reports');

-- Support Admin (mostly read + support actions)
INSERT INTO role_module_permissions (role_id, module_id, can_view, can_create, can_edit, can_delete, can_export)
SELECT r.id, m.id, 1, 0, 1, 0, 0 FROM roles r CROSS JOIN modules m
WHERE r.slug = 'support_admin' AND m.slug IN ('dashboard','customers','orders','notifications','support');