-- Drawer redesign (2026-07-01): operators RECORD cash movements freely; admins REVIEW them
-- after the fact (authorize/deny — a flag, not a reversal). New `drawer` resource with two
-- permissions in @parking/shared: drawer:create + drawer:review.
--
-- The built-in `admin` role gets ALL permissions in code (auth.ts ADMIN_PERMS = new
-- Set(PERMISSIONS)), so it needs NO seed row here. This grants the default `operator` role
-- the ability to record movements (drawer:create) — matching the prior behaviour where an
-- operator could raise a voucher. An admin can revoke it per-role in the Roles UI (it's just
-- data). drawer:review is admin-only, so it is NOT granted to operator.
--
-- Idempotent: role_permissions has a UNIQUE(role_id, permission) index, so re-running is a
-- no-op via OR IGNORE. See wiki/concepts/shift.md.
INSERT OR IGNORE INTO `role_permissions` (`role_id`, `permission`) VALUES
	('operator','drawer:create');