-- Grant own-punch attendance to the default Employee role and any staff role
-- that already has dashboard/profile access (self-service clock in/out).

INSERT IGNORE INTO role_permissions (role_id, module_key, action_key, allowed)
SELECT wr.id, 'hr_attendance', a.action_key, 1
FROM workspace_roles wr
CROSS JOIN (
  SELECT 'punch_own' AS action_key
  UNION ALL SELECT 'ignore_prompt'
) a
WHERE wr.slug = 'employee'
  AND wr.deleted_at IS NULL;

-- Staff roles with dashboard or profile read can punch their own day.
INSERT IGNORE INTO role_permissions (role_id, module_key, action_key, allowed)
SELECT DISTINCT rp.role_id, 'hr_attendance', 'punch_own', 1
FROM role_permissions rp
WHERE rp.module_key IN ('dashboard', 'profile')
  AND rp.action_key = 'read'
  AND rp.allowed = 1;

INSERT IGNORE INTO role_permissions (role_id, module_key, action_key, allowed)
SELECT DISTINCT rp.role_id, 'hr_attendance', 'ignore_prompt', 1
FROM role_permissions rp
WHERE rp.module_key = 'hr_attendance'
  AND rp.action_key = 'punch_own'
  AND rp.allowed = 1;