INSERT INTO iam.permissions (id, module_code, permission_code, permission_name, description)
SELECT gen_random_uuid(), seed.module_code, seed.permission_code, seed.permission_name, seed.description
FROM (
    VALUES
        ('qa', 'qa.view', 'View Quality Assurance', 'Allows viewing Quality Assurance inspection queues and history.'),
        ('qa', 'qa.inspections.manage', 'Manage QA Inspections', 'Allows recording QA decisions for inbound discrepancies and inspection cases.'),
        ('qa', 'qa.inventory_release.post', 'Post QA-Released Inventory', 'Allows posting QA-released inbound goods to available inventory.'),
        ('qa', 'qa.audit.view', 'View QA Audit Trail', 'Allows viewing Quality Assurance audit and release evidence.')
) AS seed(module_code, permission_code, permission_name, description)
WHERE NOT EXISTS (
    SELECT 1
    FROM iam.permissions permission
    WHERE permission.permission_code = seed.permission_code
);

INSERT INTO iam.role_permissions (id, role_id, permission_id, created_at)
SELECT gen_random_uuid(), role.id, permission.id, CURRENT_TIMESTAMP
FROM iam.roles role
CROSS JOIN iam.permissions permission
WHERE role.tenant_id IS NOT NULL
  AND role.is_active = TRUE
  AND (
      LOWER(role.code) IN ('tenant_owner', 'tenant-owner', 'owner', 'admin', 'administrator', 'super_admin', 'super-admin')
      OR LOWER(role.name) IN ('tenant owner', 'owner', 'administrator', 'admin', 'super admin')
  )
  AND permission.permission_code IN (
      'qa.view',
      'qa.inspections.manage',
      'qa.inventory_release.post',
      'qa.audit.view'
  )
  AND NOT EXISTS (
      SELECT 1
      FROM iam.role_permissions existing
      WHERE existing.role_id = role.id
        AND existing.permission_id = permission.id
  );