-- ==========================================================
-- DMS v0.5.0
-- Database v5.1 - Seed users
-- Server: Container Station on QNAPQNAP TS-473A
-- Database service: MariaDB 10.11
-- database ui: phpmyadmin 5-apache
-- backend sevice: node.js
-- frontend sevice: next.js
-- reverse proxy: nginx 1.27-alpine
-- cron service: n8n
-- scripts: alpine:3.20
-- Notes:
-- ==========================================================

SET NAMES utf8mb4;
SET time_zone = '+07:00';
SET FOREIGN_KEY_CHECKS=0;
-- ----------------------------------------------------------
-- 3) Seed Data for RBAC (Roles, Permissions, Users)
-- ----------------------------------------------------------

-- 3.1 Roles
INSERT INTO roles (role_code, role_name, description, is_system) VALUES
  ('SUPER_ADMIN','Super Administrator', 'Full access to entire system, cross-organization' ,1),
  ('ADMIN',      'Administrator',       'Full access but limited to their own organization',1),
  ('EDITOR',     'Editor',              'Can create/edit RFA/Drawings/Docs/Transmittals'   ,1),
  ('PM',         'Project Manager',     'Manage within project'                             ,0),
  ('ENGINEER',   'Engineer',            'Engineer operations'                               ,0),
  ('QS',         'Quantity Surveyor',   'QS operations'                                     ,0),
  ('VIEWER',     'Viewer',              'Read-only access'                                  ,0),
  ('GUEST',      'Guest',               'Limited read-only access'                          ,0)
ON DUPLICATE KEY UPDATE
  role_name=VALUES(role_name),
  description=VALUES(description),
  is_system=VALUES(is_system);
-- 3.2 Permissions (core)
INSERT INTO permissions (perm_code, perm_name, module, scope_level) VALUES
 -- System
 ('superadmin.access','Access Everything (All Orgs)','admin','GLOBAL'),
 ('admin.access','Access Admin Panel (scoped)','admin','ORG'),
 ('settings.manage','Manage Settings','admin','GLOBAL'),
 -- Projects & Parties
 ('projects.view','View Projects','projects','ORG'),
 ('projects.manage','Create/Edit/Delete Projects','projects','ORG'),
 ('project_parties.manage','Manage Project Parties','projects','ORG'),
 -- Organizations
 ('organizations.view','View Organizations','organizations','GLOBAL'),
 ('organizations.manage','Manage Organizations','organizations','GLOBAL'),
 -- Drawings
 ('drawings.view','View Drawings','drawings','PROJECT'),
 ('drawings.upload','Upload Drawing Revisions','drawings','PROJECT'),
 ('drawings.delete','Delete Drawings/Revisions','drawings','PROJECT'),
 -- Documents/Materials/MS
 ('documents.view','View Documents','documents','PROJECT'),
 ('documents.manage','Manage Documents/Revisions','documents','PROJECT'),
 ('materials.view','View Materials','materials','PROJECT'),
 ('materials.manage','Manage Materials/Revisions','materials','PROJECT'),
 ('ms.view','View Method Statements','ms','PROJECT'),
 ('ms.manage','Manage Method Statements/Revisions','ms','PROJECT'),
 -- RFAs
 ('rfas.view','View RFAs','rfas','PROJECT'),
 ('rfas.create','Create RFA','rfas','PROJECT'),
 ('rfas.respond','Respond / Update RFA','rfas','PROJECT'),
 ('rfas.delete','Delete RFA','rfas','PROJECT'),
 -- Correspondence & Transmittal & Circulation
 ('corr.view','View Correspondences','correspondence','PROJECT'),
 ('corr.manage','Manage Correspondences','correspondence','PROJECT'),
 ('transmittals.manage','Manage Transmittals','transmittal','PROJECT'),
 ('cirs.manage','Manage Circulations','circulation','ORG'),
 -- Reports
 ('reports.view','View Reports','reports','GLOBAL')
ON DUPLICATE KEY UPDATE
  perm_name=VALUES(perm_name),
  module=VALUES(module),
  scope_level=VALUES(scope_level),
  is_active=1;

-- 3.3 Role ↔ Permission
-- SUPER_ADMIN: all permissions (disambiguated columns with aliases)
INSERT IGNORE INTO role_permissions (role_id, permission_id)
SELECT r.role_id, p.permission_id
FROM roles AS r
CROSS JOIN permissions AS p
WHERE r.role_code='SUPER_ADMIN';

-- ADMIN: all except superadmin.access (scope enforced app-side)
INSERT IGNORE INTO role_permissions (role_id, permission_id)
SELECT r.role_id, p.permission_id
FROM roles AS r
JOIN permissions AS p ON p.perm_code <> 'superadmin.access'
WHERE r.role_code='ADMIN';

-- EDITOR: operational set
INSERT IGNORE INTO role_permissions (role_id, permission_id)
SELECT r.role_id, p.permission_id
FROM roles AS r
JOIN permissions AS p ON p.perm_code IN (
  'projects.view','project_parties.manage',
  'drawings.view','drawings.upload',
  'documents.view','documents.manage',
  'materials.view','materials.manage',
  'ms.view','ms.manage',
  'rfas.view','rfas.create','rfas.respond',
  'corr.view','corr.manage',
  'transmittals.manage','reports.view'
)
WHERE r.role_code='EDITOR';

-- VIEWER: read-only set
INSERT IGNORE INTO role_permissions (role_id, permission_id)
SELECT r.role_id, p.permission_id
FROM roles AS r
JOIN permissions AS p ON p.perm_code IN (
  'projects.view','organizations.view','drawings.view','documents.view','materials.view','ms.view','rfas.view','corr.view','reports.view'
)
WHERE r.role_code='VIEWER';

-- 3.4 Initial SUPER_ADMIN user (set real password on first login)
INSERT INTO users (username, password_hash, email, is_active)
VALUES ('superadmin', '$2y$10$0kjBMxWq7E4G7P.dc8r5i.cjiPBiup553AsFpDfxUt31gKg9h/udq', 'superadmin@example.com', 1)
ON DUPLICATE KEY UPDATE email=VALUES(email), is_active=VALUES(is_active);

INSERT IGNORE INTO user_roles (user_id, role_id)
SELECT u.user_id, r.role_id
FROM users AS u
JOIN roles AS r ON r.role_code='SUPER_ADMIN'
WHERE u.username='superadmin';

-- 3.5 Sample seed for user_project_roles (assign superadmin as EDITOR in project LCBP3C1)
INSERT IGNORE INTO user_project_roles (user_id, project_id, role_id)
SELECT u.user_id, p.project_id, r.role_id
FROM users u
JOIN projects p ON p.project_code='LCBP3C1'
JOIN roles r ON r.role_code='EDITOR'
WHERE u.username='superadmin';

-- 3.6 Sample seed for user_project_roles (assign superadmin as VIEWER in project LCBP3C2)
INSERT IGNORE INTO user_project_roles (user_id, project_id, role_id)
SELECT u.user_id, p.project_id, r.role_id
FROM users u
JOIN projects p ON p.project_code='LCBP3C2'
JOIN roles r ON r.role_code='VIEWER'
WHERE u.username='superadmin';


-- 3.7 Sample additional test users and project role assignments

-- Create editor01 user (password hash placeholder, must change later)
INSERT IGNORE INTO users (username, password_hash, email, is_active)
VALUES ('editor01', '$2y$10$0kjBMxWq7E4G7P.dc8r5i.cjiPBiup553AsFpDfxUt31gKg9h/udq', 'editor01@example.com', 1);

-- Assign editor01 as EDITOR in project LCBP3C1
INSERT IGNORE INTO user_project_roles (user_id, project_id, role_id)
SELECT u.user_id, p.project_id, r.role_id
FROM users u
JOIN projects p ON p.project_code='LCBP3C1'
JOIN roles r ON r.role_code='EDITOR'
WHERE u.username='editor01';

-- Create viewer01 user (password hash placeholder, must change later)
INSERT IGNORE INTO users (username, password_hash, email, is_active)
VALUES ('viewer01', '$2y$10$0kjBMxWq7E4G7P.dc8r5i.cjiPBiup553AsFpDfxUt31gKg9h/udq', 'viewer01@example.com', 1);

-- Assign viewer01 as VIEWER in project LCBP3C2
INSERT IGNORE INTO user_project_roles (user_id, project_id, role_id)
SELECT u.user_id, p.project_id, r.role_id
FROM users u
JOIN projects p ON p.project_code='LCBP3C2'
JOIN roles r ON r.role_code='VIEWER'
WHERE u.username='viewer01';

SET FOREIGN_KEY_CHECKS=1;