-- ============================================================================
-- EduAdvise CRM — Seed: roles + permission catalogue + default grants
-- Idempotent: safe to re-run.
-- ============================================================================

-- ---- Roles ---------------------------------------------------------------
insert into public.roles (name, slug, description, is_system) values
  ('Super Admin',      'super-admin',     'Full access across all branches', true),
  ('Branch Manager',   'branch-manager',  'Manages users and data for their branch(es)', true),
  ('Counselor',        'counselor',       'Handles assigned leads, follow-ups, applications', true),
  ('Accountant',       'accountant',      'Fees, finance reports, currency, banking, expenses', true),
  ('Visa Officer',     'visa-officer',    'Visa stage, status updates, embassy paperwork', true),
  ('Coaching Faculty', 'coaching-faculty','Coaching attendance and student progress', true),
  ('B2B Partner',      'b2b-partner',     'External partner: submit and track own leads', true),
  ('Marketing',        'marketing',       'Promotional materials, social posts, tutorials', true)
on conflict (slug) do nothing;

-- ---- Permission catalogue (resource.action) ------------------------------
insert into public.permissions (resource, action, label) values
  ('dashboard','read','View dashboard'),
  ('leads','read','View leads'),
  ('leads','create','Create leads'),
  ('leads','update','Edit leads'),
  ('leads','delete','Delete leads'),
  ('leads','assign','Assign leads'),
  ('followups','read','View follow-ups'),
  ('followups','update','Manage follow-ups'),
  ('applications','read','View applications'),
  ('applications','create','Create applications'),
  ('applications','update','Edit applications'),
  ('applications','delete','Delete applications'),
  ('coaching','read','View coaching'),
  ('coaching','update','Manage coaching'),
  ('loan','read','View education loan inquiries'),
  ('loan','update','Manage education loan inquiries'),
  ('visa','read','View visa tracking'),
  ('visa','update','Manage visa tracking'),
  ('course_finder','read','Use course finder'),
  ('course_finder','update','Manage courses'),
  ('reports','read','View reports'),
  ('reports.finance','read','View finance reports'),
  ('finance','read','View finance / fees'),
  ('finance','update','Manage fees and payments'),
  ('promotional','read','View promotional materials'),
  ('promotional','update','Manage promotional materials'),
  ('master','read','View master data'),
  ('master','update','Manage master data'),
  ('users','read','View users'),
  ('users','update','Manage users'),
  ('roles','read','View roles & permissions'),
  ('roles','update','Manage roles & permissions'),
  ('branches','read','View branches'),
  ('branches','update','Manage branches'),
  ('audit','read','View audit log')
on conflict (resource, action) do nothing;

-- ---- Default grants -------------------------------------------------------
-- Super Admin: everything (handled in code via is_super_admin(); also grant all here)
insert into public.role_permissions (role_id, permission_id)
select r.id, p.id from public.roles r cross join public.permissions p
where r.slug = 'super-admin'
on conflict do nothing;

-- Branch Manager: most operational + user mgmt within branch, no role editing
insert into public.role_permissions (role_id, permission_id)
select r.id, p.id from public.roles r join public.permissions p on true
where r.slug = 'branch-manager'
  and (p.resource, p.action) in (
    ('dashboard','read'),
    ('leads','read'),('leads','create'),('leads','update'),('leads','assign'),
    ('followups','read'),('followups','update'),
    ('applications','read'),('applications','create'),('applications','update'),
    ('coaching','read'),('coaching','update'),
    ('loan','read'),('loan','update'),
    ('visa','read'),('visa','update'),
    ('course_finder','read'),
    ('reports','read'),('reports.finance','read'),
    ('finance','read'),
    ('promotional','read'),
    ('master','read'),
    ('users','read'),('users','update'),
    ('branches','read'),
    ('audit','read')
  )
on conflict do nothing;

-- Counselor: leads, follow-ups, applications, course finder
insert into public.role_permissions (role_id, permission_id)
select r.id, p.id from public.roles r join public.permissions p on true
where r.slug = 'counselor'
  and (p.resource, p.action) in (
    ('dashboard','read'),
    ('leads','read'),('leads','create'),('leads','update'),
    ('followups','read'),('followups','update'),
    ('applications','read'),('applications','create'),('applications','update'),
    ('loan','read'),('loan','update'),
    ('course_finder','read'),
    ('promotional','read'),
    ('master','read')
  )
on conflict do nothing;

-- Accountant: finance focus
insert into public.role_permissions (role_id, permission_id)
select r.id, p.id from public.roles r join public.permissions p on true
where r.slug = 'accountant'
  and (p.resource, p.action) in (
    ('dashboard','read'),
    ('applications','read'),
    ('finance','read'),('finance','update'),
    ('reports','read'),('reports.finance','read'),
    ('master','read'),('master','update')
  )
on conflict do nothing;

-- Visa Officer
insert into public.role_permissions (role_id, permission_id)
select r.id, p.id from public.roles r join public.permissions p on true
where r.slug = 'visa-officer'
  and (p.resource, p.action) in (
    ('dashboard','read'),
    ('applications','read'),('applications','update'),
    ('visa','read'),('visa','update'),
    ('reports','read')
  )
on conflict do nothing;

-- Coaching Faculty
insert into public.role_permissions (role_id, permission_id)
select r.id, p.id from public.roles r join public.permissions p on true
where r.slug = 'coaching-faculty'
  and (p.resource, p.action) in (
    ('dashboard','read'),
    ('coaching','read'),('coaching','update')
  )
on conflict do nothing;

-- B2B Partner: own leads only
insert into public.role_permissions (role_id, permission_id)
select r.id, p.id from public.roles r join public.permissions p on true
where r.slug = 'b2b-partner'
  and (p.resource, p.action) in (
    ('leads','read'),('leads','create'),
    ('course_finder','read')
  )
on conflict do nothing;

-- Marketing
insert into public.role_permissions (role_id, permission_id)
select r.id, p.id from public.roles r join public.permissions p on true
where r.slug = 'marketing'
  and (p.resource, p.action) in (
    ('dashboard','read'),
    ('promotional','read'),('promotional','update')
  )
on conflict do nothing;