BEGIN;

INSERT INTO iam.permissions (id, module_code, permission_code, permission_name, description)
SELECT gen_random_uuid(), seed.module_code, seed.permission_code, seed.permission_name, seed.description
FROM (
    VALUES
        ('pos', 'pos.view', 'View POS', 'Allows access to point-of-sale workspaces.'),
        ('pos', 'pos.sales.view', 'View POS Sales', 'Allows viewing POS sales and receipt history.'),
        ('pos', 'pos.sales.create', 'Create POS Sales', 'Allows completing POS sales and consuming shop or van stock.')
) AS seed(module_code, permission_code, permission_name, description)
WHERE NOT EXISTS (
    SELECT 1 FROM iam.permissions permission WHERE permission.permission_code = seed.permission_code
);

INSERT INTO iam.role_permissions (id, role_id, permission_id, created_at)
SELECT gen_random_uuid(), role.id, permission.id, CURRENT_TIMESTAMP
FROM iam.roles role
CROSS JOIN iam.permissions permission
WHERE role.tenant_id IS NOT NULL
  AND role.is_active = TRUE
  AND permission.permission_code IN ('pos.view', 'pos.sales.view', 'pos.sales.create')
  AND (
      LOWER(role.code) IN (
          'tenant_owner', 'owner', 'admin', 'administrator', 'pos_user', 'pos', 'cashier',
          'store_manager', 'shop_manager', 'sales_manager'
      )
      OR LOWER(role.name) IN (
          'tenant owner', 'owner', 'admin', 'administrator', 'pos user', 'pos', 'cashier',
          'store manager', 'shop manager', 'sales manager'
      )
      OR EXISTS (
          SELECT 1
          FROM iam.role_permissions existing_role_permission
          INNER JOIN iam.permissions existing_permission
              ON existing_permission.id = existing_role_permission.permission_id
          WHERE existing_role_permission.role_id = role.id
            AND (
                existing_permission.permission_code = 'pos.view'
                OR existing_permission.permission_code LIKE 'pos.%'
            )
      )
  )
  AND NOT EXISTS (
      SELECT 1
      FROM iam.role_permissions existing
      WHERE existing.role_id = role.id
        AND existing.permission_id = permission.id
  );

COMMIT;