-- ============================================================
-- Assets Management System 1.0 — Phase 1 seed
-- Seeds permissions + system roles only.
-- Organization + first administrator are created via the
-- installation setup wizard (public/setup.php), per section 124:
-- never ship a universal production password.
-- ============================================================

SET NAMES utf8mb4;

-- ------------------------------------------------------------
-- Permissions (spec section 8). Later phases can extend this
-- table freely — it is additive, not fixed.
-- ------------------------------------------------------------
INSERT INTO permissions (code, module, description) VALUES
('assets.view', 'assets', 'View asset register'),
('assets.create', 'assets', 'Register new assets'),
('assets.edit', 'assets', 'Edit asset records'),
('assets.delete', 'assets', 'Void/cancel asset records'),
('assets.approve', 'assets', 'Approve asset transactions'),
('assets.transfer', 'assets', 'Transfer assets'),
('assets.assign', 'assets', 'Assign assets to custodians'),
('assets.verify', 'assets', 'Perform physical verification'),
('assets.maintain', 'assets', 'Record maintenance'),
('assets.dispose', 'assets', 'Propose/process disposal'),
('assets.export', 'assets', 'Export asset data'),
('assets.print', 'assets', 'Print asset documents'),

('procurement.view', 'procurement', 'View procurement records'),
('procurement.create', 'procurement', 'Create procurement records'),
('procurement.approve', 'procurement', 'Approve procurement records'),

('inventory.receive', 'inventory', 'Receive stock'),
('inventory.issue', 'inventory', 'Issue stock'),
('inventory.return', 'inventory', 'Process stock returns'),
('inventory.adjust', 'inventory', 'Adjust stock balances'),

('verification.create', 'verification', 'Create physical verification'),
('verification.approve', 'verification', 'Approve physical verification'),

('auction.create', 'auction', 'Create auction records'),
('auction.approve', 'auction', 'Approve auction records'),
('auction.close', 'auction', 'Close/finalize auctions'),

('reports.view', 'reports', 'View reports'),
('reports.export', 'reports', 'Export reports'),

('users.manage', 'administration', 'Manage users'),
('roles.manage', 'administration', 'Manage roles and permissions'),
('settings.manage', 'administration', 'Manage system/organization settings'),
('fiscal_years.manage', 'administration', 'Manage fiscal years'),
('audit.view', 'administration', 'View audit trail');

-- ------------------------------------------------------------
-- System roles (spec section 7). is_system=1 protects against deletion.
-- ------------------------------------------------------------
INSERT INTO roles (code, name, name_np, description, is_system) VALUES
('super_admin', 'Super Administrator', 'सुपर एडमिन', 'Full system access', 1),
('institution_admin', 'Institution Administrator', 'संस्था प्रशासक', 'Manages organization, users, settings, master data', 1),
('asset_admin', 'Asset Administrator', 'सम्पत्ति प्रशासक', 'Manages asset records', 1),
('storekeeper', 'Storekeeper', 'स्टोरकिपर', 'Manages receipt, stock, issue, return', 1),
('procurement_officer', 'Procurement Officer', 'खरिद अधिकृत', 'Manages procurement/acquisition records', 1),
('inspection_officer', 'Inspection Officer', 'निरीक्षण अधिकृत', 'Verifies received goods', 1),
('section_head', 'Section Head', 'शाखा प्रमुख', 'Approves requests, verifies assigned assets', 1),
('asset_custodian', 'Asset Custodian', 'सम्पत्ति संरक्षक', 'Responsible for assigned assets', 1),
('finance_officer', 'Finance/Accounts Officer', 'लेखा अधिकृत', 'Manages valuation, depreciation, accounting references', 1),
('maintenance_officer', 'Maintenance Officer', 'मर्मत अधिकृत', 'Manages maintenance and repairs', 1),
('verification_committee', 'Verification Committee', 'निरीक्षण समिति', 'Performs physical verification', 1),
('disposal_committee', 'Disposal Committee', 'लिलाम समिति', 'Manages disposal/write-off', 1),
('auction_committee', 'Auction Committee', 'लिलाम समिति', 'Manages auction workflow', 1),
('auditor', 'Auditor', 'लेखा परीक्षक', 'Read-only access to reports and audit trails', 1),
('viewer', 'Viewer', 'हेर्ने प्रयोगकर्ता', 'Read-only access to permitted reports', 1);

-- ------------------------------------------------------------
-- Role-permission mapping
-- ------------------------------------------------------------

-- super_admin: everything
INSERT INTO role_permissions (role_id, permission_id)
SELECT (SELECT id FROM roles WHERE code = 'super_admin'), id FROM permissions;

-- institution_admin: everything except nothing withheld at Phase 1
-- (Phase 1 has no asset-transaction permissions to restrict yet)
INSERT INTO role_permissions (role_id, permission_id)
SELECT (SELECT id FROM roles WHERE code = 'institution_admin'), id FROM permissions
WHERE code IN ('users.manage','roles.manage','settings.manage','fiscal_years.manage',
               'audit.view','reports.view','reports.export',
               'assets.view','procurement.view','inventory.receive','inventory.issue');

INSERT INTO role_permissions (role_id, permission_id)
SELECT (SELECT id FROM roles WHERE code = 'asset_admin'), id FROM permissions
WHERE code IN ('assets.view','assets.create','assets.edit','assets.transfer','assets.assign',
               'assets.maintain','assets.print','assets.export','reports.view');

INSERT INTO role_permissions (role_id, permission_id)
SELECT (SELECT id FROM roles WHERE code = 'storekeeper'), id FROM permissions
WHERE code IN ('inventory.receive','inventory.issue','inventory.return','inventory.adjust',
               'assets.view','reports.view');

INSERT INTO role_permissions (role_id, permission_id)
SELECT (SELECT id FROM roles WHERE code = 'procurement_officer'), id FROM permissions
WHERE code IN ('procurement.view','procurement.create','assets.view','reports.view');

INSERT INTO role_permissions (role_id, permission_id)
SELECT (SELECT id FROM roles WHERE code = 'inspection_officer'), id FROM permissions
WHERE code IN ('procurement.view','assets.view','reports.view');

INSERT INTO role_permissions (role_id, permission_id)
SELECT (SELECT id FROM roles WHERE code = 'section_head'), id FROM permissions
WHERE code IN ('assets.view','assets.approve','assets.verify','reports.view');

INSERT INTO role_permissions (role_id, permission_id)
SELECT (SELECT id FROM roles WHERE code = 'asset_custodian'), id FROM permissions
WHERE code IN ('assets.view');

INSERT INTO role_permissions (role_id, permission_id)
SELECT (SELECT id FROM roles WHERE code = 'finance_officer'), id FROM permissions
WHERE code IN ('assets.view','reports.view','reports.export','audit.view');

INSERT INTO role_permissions (role_id, permission_id)
SELECT (SELECT id FROM roles WHERE code = 'maintenance_officer'), id FROM permissions
WHERE code IN ('assets.view','assets.maintain','reports.view');

INSERT INTO role_permissions (role_id, permission_id)
SELECT (SELECT id FROM roles WHERE code = 'verification_committee'), id FROM permissions
WHERE code IN ('assets.view','assets.verify','verification.create','verification.approve','reports.view');

INSERT INTO role_permissions (role_id, permission_id)
SELECT (SELECT id FROM roles WHERE code = 'disposal_committee'), id FROM permissions
WHERE code IN ('assets.view','assets.dispose','reports.view');

INSERT INTO role_permissions (role_id, permission_id)
SELECT (SELECT id FROM roles WHERE code = 'auction_committee'), id FROM permissions
WHERE code IN ('assets.view','auction.create','auction.approve','auction.close','reports.view');

INSERT INTO role_permissions (role_id, permission_id)
SELECT (SELECT id FROM roles WHERE code = 'auditor'), id FROM permissions
WHERE code IN ('assets.view','reports.view','reports.export','audit.view');

INSERT INTO role_permissions (role_id, permission_id)
SELECT (SELECT id FROM roles WHERE code = 'viewer'), id FROM permissions
WHERE code IN ('assets.view','reports.view');