-- ECR-013A Admin RBAC

CREATE TABLE IF NOT EXISTS admin_roles (
  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
  name varchar(64) NOT NULL UNIQUE,
  system boolean NOT NULL DEFAULT false,
  created_at timestamptz NOT NULL DEFAULT now()
);

CREATE TABLE IF NOT EXISTS admin_role_permissions (
  role_id uuid NOT NULL REFERENCES admin_roles(id) ON DELETE CASCADE,
  code varchar(64) NOT NULL,
  PRIMARY KEY (role_id, code)
);

ALTER TABLE admin_accounts
  ADD COLUMN IF NOT EXISTS role_id uuid REFERENCES admin_roles(id);

INSERT INTO admin_roles(id, name, system)
VALUES ('00000000-0000-4000-8000-000000000001', 'super_admin', true)
ON CONFLICT (name) DO NOTHING;

INSERT INTO admin_role_permissions(role_id, code)
SELECT r.id, p.code
FROM admin_roles r
CROSS JOIN (VALUES
  ('admin.users.read'),
  ('admin.users.membership.grant'),
  ('admin.users.ask_quota.grant'),
  ('admin.orders.read'),
  ('admin.audit.read'),
  ('admin.analytics.read'),
  ('admin.content.write'),
  ('admin.roles.read'),
  ('admin.roles.write')
) AS p(code)
WHERE r.name = 'super_admin'
ON CONFLICT DO NOTHING;

UPDATE admin_accounts
SET role_id = (SELECT id FROM admin_roles WHERE name = 'super_admin')
WHERE role_id IS NULL AND deleted_at IS NULL;