BEGIN;

INSERT INTO iam.permissions (module_code, permission_code, permission_name, description)
SELECT
    'hr-payroll',
    'hr.onboarding.settings.manage',
    'Manage Onboarding Probation Settings',
    'Allows controlled creation and maintenance of tenant probation policy settings.'
WHERE NOT EXISTS (
    SELECT 1 FROM iam.permissions WHERE permission_code = 'hr.onboarding.settings.manage'
);

WITH eligible_roles AS (
    SELECT id
    FROM iam.roles
    WHERE COALESCE(is_active, TRUE) = TRUE
      AND LOWER(REPLACE(COALESCE(code, name, ''), ' ', '_')) IN (
          'hr_approver', 'tenant_owner', 'tenant-owner', 'owner', 'admin',
          'administrator', 'hr_admin', 'hr-admin', 'hr_manager', 'human_resources_manager'
      )
), permission_record AS (
    SELECT id FROM iam.permissions WHERE permission_code = 'hr.onboarding.settings.manage'
)
INSERT INTO iam.role_permissions (role_id, permission_id)
SELECT role.id, permission.id
FROM eligible_roles role
CROSS JOIN permission_record permission
WHERE NOT EXISTS (
    SELECT 1
    FROM iam.role_permissions existing
    WHERE existing.role_id = role.id AND existing.permission_id = permission.id
);

COMMIT;