-- Granular own/all permissions for CRM & email modules + sale_leads module + web settings page ACL

INSERT IGNORE INTO permission_actions (action_key, label, sort_order) VALUES
  ('read_own', 'Read own', 11),
  ('read_all', 'Read all', 12),
  ('update_own', 'Update own', 13),
  ('update_all', 'Update all', 14),
  ('delete_own', 'Delete own', 15),
  ('delete_all', 'Delete all', 16);

INSERT IGNORE INTO permission_modules (module_key, label, module_group, sort_order) VALUES
  ('sale_leads', 'Sales Leads', 'Email', 95);

-- Web settings page-level actions
INSERT IGNORE INTO permission_actions (action_key, label, sort_order) VALUES
  ('page_branding_read', 'Branding — Read', 200),
  ('page_branding_update', 'Branding — Update', 201),
  ('page_smtp_read', 'SMTP — Read', 202),
  ('page_smtp_update', 'SMTP — Update', 203),
  ('page_sending_limits_read', 'Sending Limits — Read', 204),
  ('page_sending_limits_update', 'Sending Limits — Update', 205),
  ('page_warmup_mails_read', 'Warmup Mails — Read', 206),
  ('page_warmup_mails_update', 'Warmup Mails — Update', 207),
  ('page_system_read', 'System — Read', 208),
  ('page_system_update', 'System — Update', 209),
  ('page_security_read', 'Security — Read', 210),
  ('page_security_update', 'Security — Update', 211),
  ('page_storage_read', 'Storage — Read', 212),
  ('page_storage_update', 'Storage — Update', 213),
  ('page_notifications_read', 'Notifications — Read', 214),
  ('page_notifications_update', 'Notifications — Update', 215),
  ('page_maintenance_read', 'Maintenance — Read', 216),
  ('page_maintenance_update', 'Maintenance — Update', 217),
  ('page_compliance_read', 'Compliance — Read', 218),
  ('page_compliance_update', 'Compliance — Update', 219),
  ('page_project_types_read', 'Project Types — Read', 220),
  ('page_project_types_update', 'Project Types — Update', 221),
  ('page_marketing_packages_read', 'Marketing Packages — Read', 222),
  ('page_marketing_packages_update', 'Marketing Packages — Update', 223),
  ('page_roles_read', 'Roles — Read', 224),
  ('page_roles_update', 'Roles — Update', 225);

INSERT INTO role_permissions (role_id, module_key, action_key, allowed)
SELECT rp.role_id, rp.module_key, 'read_all', 1
FROM role_permissions rp
WHERE rp.module_key IN ('contacts', 'contact_groups', 'email_campaigns', 'email_templates')
  AND rp.action_key = 'read' AND rp.allowed = 1
ON DUPLICATE KEY UPDATE allowed = GREATEST(role_permissions.allowed, VALUES(allowed));

INSERT INTO role_permissions (role_id, module_key, action_key, allowed)
SELECT rp.role_id, rp.module_key, 'update_all', 1
FROM role_permissions rp
WHERE rp.module_key IN ('contacts', 'contact_groups', 'email_campaigns', 'email_templates')
  AND rp.action_key = 'update' AND rp.allowed = 1
ON DUPLICATE KEY UPDATE allowed = GREATEST(role_permissions.allowed, VALUES(allowed));

INSERT INTO role_permissions (role_id, module_key, action_key, allowed)
SELECT rp.role_id, rp.module_key, 'delete_all', 1
FROM role_permissions rp
WHERE rp.module_key IN ('contacts', 'contact_groups', 'email_campaigns', 'email_templates')
  AND rp.action_key = 'delete' AND rp.allowed = 1
ON DUPLICATE KEY UPDATE allowed = GREATEST(role_permissions.allowed, VALUES(allowed));

-- sale_leads: mirror email_campaigns permissions for existing roles
INSERT INTO role_permissions (role_id, module_key, action_key, allowed)
SELECT rp.role_id, 'sale_leads', rp.action_key, rp.allowed
FROM role_permissions rp
WHERE rp.module_key = 'email_campaigns'
ON DUPLICATE KEY UPDATE allowed = GREATEST(role_permissions.allowed, VALUES(allowed));

-- Web settings: roles with web_settings.read get all page read+update
INSERT INTO role_permissions (role_id, module_key, action_key, allowed)
SELECT DISTINCT rp.role_id, 'web_settings', pa.action_key, 1
FROM role_permissions rp
CROSS JOIN permission_actions pa
WHERE rp.module_key = 'web_settings' AND rp.action_key = 'read' AND rp.allowed = 1
  AND pa.action_key LIKE 'page_%'
ON DUPLICATE KEY UPDATE allowed = GREATEST(role_permissions.allowed, VALUES(allowed));