-- 0011_rbac_role_flags_and_seed.sql
-- RBAC: add is_system/is_enabled columns to roles table and seed role_permissions.

-- 1. Add is_system and is_enabled columns to roles table.
ALTER TABLE `roles`
  ADD COLUMN `is_system` boolean DEFAULT false NOT NULL,
  ADD COLUMN `is_enabled` boolean DEFAULT true NOT NULL;

-- 2. Mark the 6 builtin roles as system roles.
UPDATE `roles` SET `is_system` = true
  WHERE `name` IN ('admin', 'teacher', 'student', 'parent', 'grade_head', 'teaching_head');

-- 3. Seed role_permissions for builtin roles.
--    Uses INSERT IGNORE so re-running is safe (role_permissions has a composite PK).
--    Permissions are resolved from ROLE_PERMISSIONS_SEED in src/shared/lib/permissions.ts.

-- admin
INSERT IGNORE INTO `role_permissions` (`role_id`, `permission`)
  SELECT id, 'exam:create' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'exam:read' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'exam:update' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'exam:delete' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'exam:duplicate' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'exam:publish' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'exam:ai_generate' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'homework:create' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'homework:grade' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'question:create' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'question:read' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'question:update' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'question:delete' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'textbook:create' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'textbook:read' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'textbook:update' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'textbook:delete' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'class:create' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'class:read' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'class:update' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'class:delete' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'class:enroll' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'class:schedule' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'school:manage' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'grade:manage' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'user:manage' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'user:profile_update' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'ai:chat' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'ai:configure' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'settings:admin' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'audit_log:read' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'announcement:manage' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'announcement:read' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'grade_record:manage' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'grade_record:read' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'course_plan:manage' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'course_plan:read' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'attendance:manage' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'attendance:read' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'message:send' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'message:read' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'message:delete' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'schedule:auto' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'schedule:adjust' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'elective:manage' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'elective:read' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'exam:proctor' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'exam:proctor:read' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'diagnostic:manage' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'diagnostic:read' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'lesson_plan:create' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'lesson_plan:read' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'lesson_plan:update' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'lesson_plan:delete' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'lesson_plan:publish' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'file:upload' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'file:read' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'file:delete' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'dashboard:admin_read' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'error_book:analytics_read' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'adaptive_practice:read' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'role:create' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'role:read' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'role:update' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'role:delete' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'role:assign' FROM `roles` WHERE `name` = 'admin'
  UNION ALL SELECT id, 'permission:read' FROM `roles` WHERE `name` = 'admin';