-- Dynamic RBAC: roles become DATA. Replaces the hardcoded users.role enum with a
-- role_id FK into a composable `roles` table + a `role_permissions` grid.
-- See wiki/entities/local-jwt-auth.md and @parking/shared PERMISSIONS.

-- 1. Roles + the role→permission grid.
CREATE TABLE `roles` (
	`id` text PRIMARY KEY NOT NULL,
	`name` text NOT NULL,
	`builtin` integer DEFAULT 0 NOT NULL,
	`created_at` text DEFAULT (current_timestamp) NOT NULL
);
--> statement-breakpoint
CREATE UNIQUE INDEX `roles_name_unique` ON `roles` (`name`);
--> statement-breakpoint
CREATE TABLE `role_permissions` (
	`role_id` text NOT NULL,
	`permission` text NOT NULL,
	FOREIGN KEY (`role_id`) REFERENCES `roles`(`id`) ON UPDATE no action ON DELETE no action
);
--> statement-breakpoint
CREATE UNIQUE INDEX `role_permissions_role_id_permission_unique` ON `role_permissions` (`role_id`,`permission`);
--> statement-breakpoint

-- 2. Seed the protected built-in `admin` role. Its permission set is enforced in
--    code (always ALL), but we materialise the rows too so the grid is complete.
INSERT INTO `roles` (`id`, `name`, `builtin`) VALUES ('admin', 'Admin', 1);
--> statement-breakpoint
INSERT INTO `role_permissions` (`role_id`, `permission`) VALUES
	('admin','user:create'),('admin','user:read'),('admin','user:update'),('admin','user:delete'),
	('admin','role:create'),('admin','role:read'),('admin','role:update'),('admin','role:delete'),
	('admin','tariff:read'),('admin','tariff:update'),
	('admin','subscription:read'),('admin','subscription:create'),('admin','subscription:update'),('admin','subscription:delete'),
	('admin','site:read'),('admin','site:update'),
	('admin','device:read'),
	('admin','shift:read'),('admin','shift:create'),('admin','shift:cash'),
	('admin','payment:read'),('admin','payment:create'),
	('admin','session:read'),
	('admin','event:read'),('admin','event:void'),
	('admin','report:read');
--> statement-breakpoint

-- 3. Seed composable roles matching the OLD enum's intended behaviour, so any
--    existing operator/cashier/readonly user keeps working. These are ordinary
--    (non-builtin) rows an admin may later edit or delete.
INSERT INTO `roles` (`id`, `name`, `builtin`) VALUES ('operator', 'Operator', 0);
--> statement-breakpoint
INSERT INTO `role_permissions` (`role_id`, `permission`) VALUES
	('operator','payment:read'),('operator','payment:create'),
	('operator','session:read'),
	('operator','shift:read'),('operator','shift:create'),
	('operator','subscription:read'),
	('operator','tariff:read'),
	('operator','site:read'),
	('operator','device:read'),
	('operator','event:read'),
	('operator','report:read');
--> statement-breakpoint
INSERT INTO `roles` (`id`, `name`, `builtin`) VALUES ('cashier', 'Cashier', 0);
--> statement-breakpoint
INSERT INTO `role_permissions` (`role_id`, `permission`) VALUES
	('cashier','payment:read'),('cashier','payment:create'),
	('cashier','session:read'),
	('cashier','shift:read'),('cashier','shift:create'),
	('cashier','subscription:read'),
	('cashier','tariff:read'),
	('cashier','site:read'),
	('cashier','device:read'),
	('cashier','event:read'),
	('cashier','report:read');
--> statement-breakpoint
INSERT INTO `roles` (`id`, `name`, `builtin`) VALUES ('readonly', 'Read-only', 0);
--> statement-breakpoint
INSERT INTO `role_permissions` (`role_id`, `permission`) VALUES
	('readonly','session:read'),
	('readonly','subscription:read'),
	('readonly','tariff:read'),
	('readonly','site:read'),
	('readonly','device:read'),
	('readonly','event:read'),
	('readonly','report:read');
--> statement-breakpoint

-- 4. Rebuild `users` to swap the `role` enum column for a `role_id` FK. SQLite
--    can't DROP a column cleanly, so: create the new shape, copy rows mapping the
--    old role string -> role id (identical strings), drop, rename.
CREATE TABLE `users_new` (
	`id` text PRIMARY KEY NOT NULL,
	`username` text NOT NULL,
	`password_hash` text NOT NULL,
	`role_id` text NOT NULL,
	`language` text DEFAULT 'sq' NOT NULL,
	`created_at` text DEFAULT (current_timestamp) NOT NULL,
	FOREIGN KEY (`role_id`) REFERENCES `roles`(`id`) ON UPDATE no action ON DELETE no action
);
--> statement-breakpoint
INSERT INTO `users_new` (`id`, `username`, `password_hash`, `role_id`, `language`, `created_at`)
	SELECT `id`, `username`, `password_hash`, `role`, `language`, `created_at` FROM `users`;
--> statement-breakpoint
DROP TABLE `users`;
--> statement-breakpoint
ALTER TABLE `users_new` RENAME TO `users`;
--> statement-breakpoint
CREATE UNIQUE INDEX `users_username_unique` ON `users` (`username`);