-- Permission catalog + role→permission mapping.
--
-- database/schema.sql seeds the 8 roles but deliberately leaves
-- `permissions` and `role_permissions` empty — the permission keys weren't
-- decided yet at Phase 2. This is that decision, kept as a separate seed
-- file (applied AFTER schema.sql) rather than edited into it, so the
-- approved Phase 2 deliverable stays untouched.
--
-- Run after schema.sql:
--   mysql -u <user> -p <database> < database/seeds/permissions.sql

INSERT INTO permissions (permission_key, description) VALUES
  ('cases.view',    'View case list, case detail, and decrypted case content'),
  ('cases.triage',  'Convert an anonymous report or intake into a managed case; change case status'),
  ('cases.assign',  'Assign or reassign a case to an officer'),
  ('cases.notes',   'Add case notes'),
  ('cases.view_identity', 'See a confidential reporter''s name and contact details (need-to-know)'),
  ('cases.refer',   'Refer a case to an external authority (police, social welfare, ICC, regulatory)'),
  ('users.manage',  'Create staff accounts, assign roles, and enable/disable accounts'),
  ('audit.view',    'View the audit log');

-- Super Administrator: everything.
INSERT INTO role_permissions (role_id, permission_id)
SELECT r.id, p.id FROM roles r CROSS JOIN permissions p
WHERE r.name = 'Super Administrator';

-- Safeguarding Officer: full case handling.
INSERT INTO role_permissions (role_id, permission_id)
SELECT r.id, p.id FROM roles r CROSS JOIN permissions p
WHERE r.name = 'Safeguarding Officer'
  AND p.permission_key IN ('cases.view', 'cases.triage', 'cases.assign', 'cases.notes', 'cases.view_identity', 'cases.refer');

-- Case Manager: works cases assigned to them, but doesn't triage/assign.
INSERT INTO role_permissions (role_id, permission_id)
SELECT r.id, p.id FROM roles r CROSS JOIN permissions p
WHERE r.name = 'Case Manager'
  AND p.permission_key IN ('cases.view', 'cases.notes', 'cases.view_identity');

-- Safeguarding Reviewer, Executive Leadership: read-only case visibility.
INSERT INTO role_permissions (role_id, permission_id)
SELECT r.id, p.id FROM roles r CROSS JOIN permissions p
WHERE r.name IN ('Safeguarding Reviewer', 'Executive Leadership')
  AND p.permission_key = 'cases.view';

-- Auditor: read-only, plus the audit log specifically.
INSERT INTO role_permissions (role_id, permission_id)
SELECT r.id, p.id FROM roles r CROSS JOIN permissions p
WHERE r.name = 'Auditor'
  AND p.permission_key IN ('cases.view', 'audit.view');

-- Content Administrator, Analytics Administrator: no case-data access —
-- their remit (site content, visitor analytics) doesn't exist as an admin
-- feature yet, so intentionally no permissions granted here either.