-- ============================================================
-- Schema Update v5
-- Run this AFTER schema_update_v4.sql.
-- Moves default permissions OUT of hardcoded PHP and into a proper table
-- that superadmin/admin manage from a "Role Permissions" screen. Only
-- 'admin' is seeded with full access below - every other role (manager,
-- accounts, gm, supervisor, staff, opm, hr, audit) starts with NONE of the
-- optional permissions until you explicitly switch them on for that role
-- (or for an individual person, via the existing Permissions screen).
-- superadmin is unaffected - it always has full access regardless of this table.
-- ============================================================

CREATE TABLE IF NOT EXISTS role_permissions (
  role ENUM('superadmin','admin','hr','audit','gm','accounts','manager','staff','supervisor','opm') NOT NULL,
  permission_code VARCHAR(60) NOT NULL,
  PRIMARY KEY (role, permission_code)
) ENGINE=InnoDB;

INSERT IGNORE INTO role_permissions (role, permission_code) VALUES
('admin','main_store.view'),
('admin','main_store.adjust'),
('admin','store_requisitions.issue'),
('admin','items.manage'),
('admin','suppliers.manage'),
('admin','outlets.manage'),
('admin','categories.manage'),
('admin','purchase_orders.manage'),
('admin','return_to_supplier.manage'),
('admin','goods_received.view'),
('admin','reports.view'),
('admin','requisitions.view_all');
