-- Migration: Add HR Role Access Permissions
-- This allows HR to assign roles to employees and ensures attendance permissions

-- Add USER_ROLE_ASSIGN permission if not exists
INSERT INTO `permissions` (`permission_code`, `permission_name`, `permission_module`, `permission_description`)
SELECT 'USER_ROLE_ASSIGN', 'Assign Roles to Users', 'user', 'Allow assigning roles to users/employees'
WHERE NOT EXISTS (
    SELECT 1 FROM `permissions` WHERE `permission_code` = 'USER_ROLE_ASSIGN'
);

-- Add ATTENDANCE_REPORT permission if not exists
INSERT INTO `permissions` (`permission_code`, `permission_name`, `permission_module`, `permission_description`)
SELECT 'ATTENDANCE_REPORT', 'Generate Attendance Reports', 'attendance', 'Allow generating attendance reports'
WHERE NOT EXISTS (
    SELECT 1 FROM `permissions` WHERE `permission_code` = 'ATTENDANCE_REPORT'
);

-- Get permission IDs
SET @user_role_assign_id = (SELECT permission_id FROM permissions WHERE permission_code = 'USER_ROLE_ASSIGN');
SET @attendance_report_id = (SELECT permission_id FROM permissions WHERE permission_code = 'ATTENDANCE_REPORT');
SET @attendance_create_id = (SELECT permission_id FROM permissions WHERE permission_code = 'ATTENDANCE_CREATE');
SET @attendance_view_id = (SELECT permission_id FROM permissions WHERE permission_code = 'ATTENDANCE_VIEW');

-- Assign USER_ROLE_ASSIGN to HR Admin (role_id = 2)
INSERT INTO `role_permissions` (`role_id`, `permission_id`)
SELECT 2, @user_role_assign_id
WHERE NOT EXISTS (
    SELECT 1 FROM `role_permissions` 
    WHERE `role_id` = 2 AND `permission_id` = @user_role_assign_id
);

-- Assign ATTENDANCE_REPORT to HR Admin
INSERT INTO `role_permissions` (`role_id`, `permission_id`)
SELECT 2, @attendance_report_id
WHERE NOT EXISTS (
    SELECT 1 FROM `role_permissions` 
    WHERE `role_id` = 2 AND `permission_id` = @attendance_report_id
);

-- Ensure HR Admin has ATTENDANCE_CREATE (should already exist, but adding if missing)
INSERT INTO `role_permissions` (`role_id`, `permission_id`)
SELECT 2, @attendance_create_id
WHERE NOT EXISTS (
    SELECT 1 FROM `role_permissions` 
    WHERE `role_id` = 2 AND `permission_id` = @attendance_create_id
);

-- Ensure HR Admin has ATTENDANCE_VIEW (should already exist, but adding if missing)
INSERT INTO `role_permissions` (`role_id`, `permission_id`)
SELECT 2, @attendance_view_id
WHERE NOT EXISTS (
    SELECT 1 FROM `role_permissions` 
    WHERE `role_id` = 2 AND `permission_id` = @attendance_view_id
);

-- Ensure HR Admin has ATTENDANCE_EDIT (for editing attendance)
SET @attendance_edit_id = (SELECT permission_id FROM permissions WHERE permission_code = 'ATTENDANCE_EDIT');
INSERT INTO `role_permissions` (`role_id`, `permission_id`)
SELECT 2, @attendance_edit_id
WHERE NOT EXISTS (
    SELECT 1 FROM `role_permissions` 
    WHERE `role_id` = 2 AND `permission_id` = @attendance_edit_id
);

-- Assign ATTENDANCE_CREATE to Employee role (role_id = 6) - so employees can mark their own attendance
INSERT INTO `role_permissions` (`role_id`, `permission_id`)
SELECT 6, @attendance_create_id
WHERE NOT EXISTS (
    SELECT 1 FROM `role_permissions` 
    WHERE `role_id` = 6 AND `permission_id` = @attendance_create_id
);

-- Assign ATTENDANCE_VIEW to Employee role - so employees can view their own attendance
INSERT INTO `role_permissions` (`role_id`, `permission_id`)
SELECT 6, @attendance_view_id
WHERE NOT EXISTS (
    SELECT 1 FROM `role_permissions` 
    WHERE `role_id` = 6 AND `permission_id` = @attendance_view_id
);

