-- Granular project/task permission actions (read/view alias + sub-capabilities)

INSERT IGNORE INTO permission_actions (action_key, label, sort_order) VALUES
  ('view', 'View', 1),
  ('file_view', 'View files', 10),
  ('file_create', 'Upload files', 11),
  ('file_update', 'Edit files', 12),
  ('file_delete', 'Delete files', 13),
  ('team_create', 'Add team', 14),
  ('team_update', 'Edit team', 15),
  ('team_delete', 'Remove team', 16),
  ('task_view', 'View tasks', 17),
  ('task_create', 'Create tasks', 18),
  ('task_update', 'Edit tasks', 19),
  ('task_delete', 'Delete tasks', 20),
  ('files', 'Task files', 21),
  ('assignee_update', 'Change assignee', 22);

-- Mirror projects.read -> projects.view and tasks.read -> tasks.view for all roles
INSERT INTO role_permissions (role_id, module_key, action_key, allowed)
SELECT rp.role_id, rp.module_key, 'view', rp.allowed
FROM role_permissions rp
WHERE rp.module_key IN ('projects', 'tasks') AND rp.action_key = 'read'
ON DUPLICATE KEY UPDATE allowed = GREATEST(role_permissions.allowed, VALUES(allowed));

-- Super Admin: all new granular actions on projects/tasks
INSERT INTO role_permissions (role_id, module_key, action_key, allowed)
SELECT 1, pm.module_key, pa.action_key, 1
FROM permission_modules pm
CROSS JOIN permission_actions pa
WHERE pm.module_key IN ('projects', 'tasks')
  AND pa.action_key IN (
    'view', 'file_view', 'file_create', 'file_update', 'file_delete',
    'team_create', 'team_update', 'team_delete',
    'task_view', 'task_create', 'task_update', 'task_delete',
    'files', 'assignee_update'
  )
ON DUPLICATE KEY UPDATE allowed = 1;

-- Employee default role: view-level project/task capabilities matching read/update seeds
INSERT INTO role_permissions (role_id, module_key, action_key, allowed)
SELECT 2, 'projects', pa.action_key,
  CASE pa.action_key
    WHEN 'view' THEN 1
    WHEN 'file_view' THEN 1
    WHEN 'task_view' THEN 1
    WHEN 'task_update' THEN 1
    ELSE 0
  END
FROM permission_actions pa
WHERE pa.action_key IN (
  'view', 'file_view', 'file_create', 'file_update', 'file_delete',
  'team_create', 'team_update', 'team_delete',
  'task_view', 'task_create', 'task_update', 'task_delete'
)
ON DUPLICATE KEY UPDATE allowed = GREATEST(role_permissions.allowed, VALUES(allowed));

INSERT INTO role_permissions (role_id, module_key, action_key, allowed)
SELECT 2, 'tasks', pa.action_key,
  CASE pa.action_key
    WHEN 'view' THEN 1
    WHEN 'files' THEN 1
    WHEN 'assignee_update' THEN 0
    ELSE 0
  END
FROM permission_actions pa
WHERE pa.action_key IN ('view', 'files', 'assignee_update')
ON DUPLICATE KEY UPDATE allowed = GREATEST(role_permissions.allowed, VALUES(allowed));