-- Gives the MAINTENANCE role a read-only Admin view of its assigned projects.
-- Adds three permissions to the role: dashboard.admin, pages.read, media.read. Nothing is removed. Safe to re-run.
-- (Running `pnpm db:seed` does the same thing; use this file if you do not want to re-seed.)

INSERT IGNORE INTO `Permission` (`id`, `key`, `description`)
SELECT UUID(), k.`key`, k.`description` FROM (
  SELECT 'dashboard.admin' AS `key`, 'Access the Admin dashboard' AS `description`
  UNION ALL SELECT 'pages.read', 'View pages'
  UNION ALL SELECT 'media.read', 'View the media library'
) k;

INSERT IGNORE INTO `RolePermission` (`roleId`, `permissionId`)
SELECT r.`id`, p.`id` FROM `Role` r JOIN `Permission` p
  ON p.`key` IN ('dashboard.admin', 'pages.read', 'media.read')
WHERE r.`key` = 'MAINTENANCE';

UPDATE `Role` SET `description` = 'Handles tickets and diagnostics for assigned projects; opens a project in a read-only Admin view.'
WHERE `key` = 'MAINTENANCE';