-- seed:up

INSERT IGNORE INTO admin_roles (public_id, code, name, description, is_system) VALUES
  ('01J00000000000000000000001', 'super_admin', 'Super Admin', 'Full system authority with separation-of-duty checks.', 1),
  ('01J00000000000000000000002', 'operations_manager', 'Operations Manager', 'User, task, referral, reward-content, and operations management.', 1),
  ('01J00000000000000000000003', 'finance_manager', 'Finance Manager', 'Wallet, withdrawal, payout, and finance reporting.', 1),
  ('01J00000000000000000000004', 'content_manager', 'Content Manager', 'Content, message template, reminder, and theme management.', 1),
  ('01J00000000000000000000005', 'security_analyst', 'Security Analyst', 'Fraud, sessions, bans, and security-event review.', 1),
  ('01J00000000000000000000006', 'auditor', 'Auditor', 'Read-only access to financial, security, and audit evidence.', 1);

INSERT IGNORE INTO permissions (code, permission_group, description) VALUES
  ('dashboard.view', 'dashboard', 'View operational dashboard.'),
  ('users.view', 'users', 'View users.'),
  ('users.update', 'users', 'Update allowed user fields.'),
  ('users.ban', 'users', 'Ban or limit users.'),
  ('users.unban', 'users', 'Revoke user restrictions.'),
  ('users.sessions.revoke', 'users', 'Revoke user sessions.'),
  ('users.export', 'users', 'Export authorized user data.'),
  ('tasks.view', 'tasks', 'View tasks and attempts.'),
  ('tasks.create', 'tasks', 'Create draft tasks.'),
  ('tasks.update', 'tasks', 'Update tasks.'),
  ('tasks.publish', 'tasks', 'Publish tasks.'),
  ('tasks.archive', 'tasks', 'Archive tasks.'),
  ('task_attempts.view', 'tasks', 'View task attempts.'),
  ('task_attempts.review', 'tasks', 'Review manual task verification.'),
  ('referrals.view', 'referrals', 'View referrals.'),
  ('referrals.review', 'referrals', 'Review suspicious referrals.'),
  ('wallet.view', 'wallet', 'View wallet projections.'),
  ('wallet.adjust', 'wallet', 'Prepare controlled wallet adjustments.'),
  ('ledger.view', 'wallet', 'View immutable ledger records.'),
  ('withdrawals.view', 'withdrawals', 'View withdrawal requests.'),
  ('withdrawals.hold', 'withdrawals', 'Place withdrawals on hold.'),
  ('withdrawals.approve', 'withdrawals', 'Approve eligible withdrawals.'),
  ('withdrawals.reject', 'withdrawals', 'Reject and refund withdrawals.'),
  ('withdrawal_methods.manage', 'withdrawals', 'Manage withdrawal methods.'),
  ('mystery_box.view', 'mystery_box', 'View free Mystery Box configuration and claims.'),
  ('mystery_box.manage', 'mystery_box', 'Manage free-only Mystery Box rewards.'),
  ('banners.manage', 'content', 'Manage banners.'),
  ('announcements.manage', 'content', 'Manage announcements.'),
  ('tutorials.manage', 'content', 'Manage tutorials.'),
  ('media.manage', 'content', 'Manage verified media.'),
  ('notifications.view', 'notifications', 'View notification status.'),
  ('notifications.send', 'notifications', 'Send approved notifications.'),
  ('reminders.manage', 'notifications', 'Manage reminder schedules.'),
  ('broadcasts.create', 'notifications', 'Create broadcast drafts.'),
  ('broadcasts.approve', 'notifications', 'Approve broadcasts created by another admin.'),
  ('bot_templates.manage', 'notifications', 'Manage bot templates.'),
  ('themes.manage', 'settings', 'Manage themes.'),
  ('currencies.manage', 'settings', 'Manage currency display metadata.'),
  ('settings.view', 'settings', 'View settings.'),
  ('settings.update', 'settings', 'Update business settings.'),
  ('settings.security.update', 'settings', 'Update security-display settings within hard limits.'),
  ('maintenance.manage', 'settings', 'Manage maintenance windows.'),
  ('administrators.view', 'administration', 'View administrators and roles.'),
  ('administrators.manage', 'administration', 'Manage administrators.'),
  ('roles.manage', 'administration', 'Manage role permission mappings.'),
  ('fraud.view', 'security', 'View fraud flags.'),
  ('fraud.review', 'security', 'Review fraud evidence and outcomes.'),
  ('security_events.view', 'security', 'View security events.'),
  ('audit_logs.view', 'security', 'View immutable admin audit logs.'),
  ('system_health.view', 'system', 'View system health.'),
  ('system_jobs.manage', 'system', 'Manage failed jobs and retries.'),
  ('reports.view', 'reports', 'View reports.'),
  ('reports.export', 'reports', 'Export authorized reports.');

INSERT IGNORE INTO admin_role_permissions (role_id, permission_id)
SELECT role.id, permission.id
FROM admin_roles AS role
CROSS JOIN permissions AS permission
WHERE role.code = 'super_admin';

INSERT IGNORE INTO admin_role_permissions (role_id, permission_id)
SELECT role.id, permission.id
FROM admin_roles AS role
JOIN permissions AS permission ON permission.code IN (
  'dashboard.view', 'users.view', 'users.update', 'users.ban', 'users.unban',
  'users.sessions.revoke', 'tasks.view', 'tasks.create', 'tasks.update', 'tasks.publish',
  'tasks.archive', 'task_attempts.view', 'task_attempts.review', 'referrals.view',
  'referrals.review', 'mystery_box.view', 'mystery_box.manage', 'banners.manage',
  'announcements.manage', 'tutorials.manage', 'media.manage', 'notifications.view',
  'notifications.send', 'reminders.manage', 'system_health.view'
)
WHERE role.code = 'operations_manager';

INSERT IGNORE INTO admin_role_permissions (role_id, permission_id)
SELECT role.id, permission.id
FROM admin_roles AS role
JOIN permissions AS permission ON permission.code IN (
  'dashboard.view', 'users.view', 'wallet.view', 'wallet.adjust', 'ledger.view',
  'withdrawals.view', 'withdrawals.hold', 'withdrawals.approve', 'withdrawals.reject',
  'withdrawal_methods.manage', 'reports.view', 'reports.export'
)
WHERE role.code = 'finance_manager';

INSERT IGNORE INTO admin_role_permissions (role_id, permission_id)
SELECT role.id, permission.id
FROM admin_roles AS role
JOIN permissions AS permission ON permission.code IN (
  'dashboard.view', 'banners.manage', 'announcements.manage', 'tutorials.manage',
  'media.manage', 'notifications.view', 'notifications.send', 'reminders.manage',
  'broadcasts.create', 'bot_templates.manage', 'themes.manage', 'settings.view'
)
WHERE role.code = 'content_manager';

INSERT IGNORE INTO admin_role_permissions (role_id, permission_id)
SELECT role.id, permission.id
FROM admin_roles AS role
JOIN permissions AS permission ON permission.code IN (
  'dashboard.view', 'users.view', 'users.ban', 'users.unban', 'users.sessions.revoke',
  'fraud.view', 'fraud.review', 'security_events.view', 'audit_logs.view',
  'system_health.view'
)
WHERE role.code = 'security_analyst';

INSERT IGNORE INTO admin_role_permissions (role_id, permission_id)
SELECT role.id, permission.id
FROM admin_roles AS role
JOIN permissions AS permission ON permission.code IN (
  'dashboard.view', 'users.view', 'tasks.view', 'task_attempts.view', 'referrals.view',
  'wallet.view', 'ledger.view', 'withdrawals.view', 'mystery_box.view',
  'notifications.view', 'settings.view', 'administrators.view', 'fraud.view',
  'security_events.view', 'audit_logs.view', 'system_health.view', 'reports.view'
)
WHERE role.code = 'auditor';