INSERT INTO iam.permissions (id, module_code, permission_code, permission_name, description)
SELECT gen_random_uuid(), seed.module_code, seed.permission_code, seed.permission_name, seed.description
FROM (
    VALUES
        ('crm', 'crm.leads.view', 'View CRM Leads', 'Allows viewing CRM leads.'),
        ('crm', 'crm.leads.create', 'Create CRM Leads', 'Allows creating CRM leads.'),
        ('crm', 'crm.leads.update', 'Update CRM Leads', 'Allows updating CRM leads.'),
        ('crm', 'crm.leads.delete', 'Delete CRM Leads', 'Allows deleting CRM leads.'),
        ('crm', 'crm.leads.assign', 'Assign CRM Leads', 'Allows assigning CRM leads to users.'),
        ('crm', 'crm.leads.stage', 'Move CRM Lead Stage', 'Allows moving CRM leads through pipeline stages.'),
        ('crm', 'crm.leads.score', 'Score CRM Leads', 'Allows updating CRM lead scores.'),
        ('crm', 'crm.leads.convert', 'Convert CRM Leads', 'Allows converting qualified leads into customers, contacts, or opportunities.'),
        ('crm', 'crm.customers.view', 'View CRM Customers', 'Allows viewing CRM customers.'),
        ('crm', 'crm.customers.create', 'Create CRM Customers', 'Allows creating CRM customers.'),
        ('crm', 'crm.customers.update', 'Update CRM Customers', 'Allows updating CRM customers.'),
        ('crm', 'crm.customers.delete', 'Delete CRM Customers', 'Allows deleting CRM customers.'),
        ('crm', 'crm.customers.status', 'Manage CRM Customer Status', 'Allows changing CRM customer status.'),
        ('crm', 'crm.customers.credit', 'Manage CRM Customer Credit', 'Allows updating CRM customer credit settings.'),
        ('crm', 'crm.opportunities.view', 'View CRM Opportunities', 'Allows viewing CRM opportunities.'),
        ('crm', 'crm.opportunities.create', 'Create CRM Opportunities', 'Allows creating CRM opportunities.'),
        ('crm', 'crm.opportunities.update', 'Update CRM Opportunities', 'Allows updating CRM opportunities.'),
        ('crm', 'crm.opportunities.delete', 'Delete CRM Opportunities', 'Allows deleting CRM opportunities.'),
        ('crm', 'crm.opportunities.status', 'Manage CRM Opportunity Status', 'Allows changing CRM opportunity status and stage.'),
        ('crm', 'crm.activities.view', 'View CRM Activities', 'Allows viewing CRM activities.'),
        ('crm', 'crm.activities.create', 'Create CRM Activities', 'Allows creating CRM activities.'),
        ('crm', 'crm.activities.update', 'Update CRM Activities', 'Allows updating CRM activities.'),
        ('crm', 'crm.activities.delete', 'Delete CRM Activities', 'Allows deleting CRM activities.'),
        ('crm', 'crm.config.view', 'View CRM Configuration', 'Allows viewing CRM lead sources, stages, pipelines, and assignment rules.'),
        ('crm', 'crm.config.create', 'Create CRM Configuration', 'Allows creating CRM lead sources, stages, pipelines, and assignment rules.'),
        ('crm', 'crm.config.update', 'Update CRM Configuration', 'Allows updating CRM lead sources, stages, pipelines, and assignment rules.'),
        ('crm', 'crm.config.delete', 'Delete CRM Configuration', 'Allows deleting CRM lead sources, stages, pipelines, and assignment rules.')
) AS seed(module_code, permission_code, permission_name, description)
WHERE NOT EXISTS (
    SELECT 1 FROM iam.permissions permission
    WHERE permission.permission_code = seed.permission_code
);

INSERT INTO iam.role_permissions (id, role_id, permission_id, created_at)
SELECT gen_random_uuid(), role.id, permission.id, CURRENT_TIMESTAMP
FROM iam.roles role
CROSS JOIN iam.permissions permission
WHERE role.tenant_id IS NOT NULL
  AND role.is_active = TRUE
  AND (
      LOWER(role.code) IN ('tenant_owner', 'owner', 'admin', 'administrator')
      OR LOWER(role.name) IN ('tenant owner', 'owner', 'administrator', 'admin')
  )
  AND permission.permission_code IN (
      'crm.leads.view',
      'crm.leads.create',
      'crm.leads.update',
      'crm.leads.delete',
      'crm.leads.assign',
      'crm.leads.stage',
      'crm.leads.score',
      'crm.leads.convert',
      'crm.customers.view',
      'crm.customers.create',
      'crm.customers.update',
      'crm.customers.delete',
      'crm.customers.status',
      'crm.customers.credit',
      'crm.opportunities.view',
      'crm.opportunities.create',
      'crm.opportunities.update',
      'crm.opportunities.delete',
      'crm.opportunities.status',
      'crm.activities.view',
      'crm.activities.create',
      'crm.activities.update',
      'crm.activities.delete',
      'crm.config.view',
      'crm.config.create',
      'crm.config.update',
      'crm.config.delete'
  )
  AND NOT EXISTS (
      SELECT 1
      FROM iam.role_permissions existing
      WHERE existing.role_id = role.id
        AND existing.permission_id = permission.id
  );