-- ============================================================
-- Phase 4 permission additions.
-- Run AFTER database/migrations/004_phase4_operations.sql
-- Additive only. assets.assign, assets.transfer, and assets.maintain
-- already exist from the Phase 1 seed and are reused here; this file
-- only adds the one permission that Phase 1 didn't anticipate needing
-- as its own action: processing a return.
-- ============================================================

INSERT INTO permissions (code, module, description) VALUES
('assets.return', 'assets', 'Process asset returns from custodians');

INSERT INTO role_permissions (role_id, permission_id)
SELECT r.id, p.id FROM roles r, permissions p
WHERE r.code = 'super_admin' AND p.code = 'assets.return'
AND NOT EXISTS (SELECT 1 FROM role_permissions rp WHERE rp.role_id = r.id AND rp.permission_id = p.id);

-- Grant assets.return to every role that already has assets.assign,
-- since returns are the natural counterpart of an assignment.
INSERT INTO role_permissions (role_id, permission_id)
SELECT rp.role_id, p.id
FROM role_permissions rp
JOIN permissions existing ON existing.id = rp.permission_id AND existing.code = 'assets.assign'
JOIN permissions p ON p.code = 'assets.return'
WHERE NOT EXISTS (
    SELECT 1 FROM role_permissions rp2 WHERE rp2.role_id = rp.role_id AND rp2.permission_id = p.id
);