init push

migrations/20260502_duty_roster_permissions_unification.sql

@@ -0,0 +1,36 @@
+-- Add canonical duty_roster permissions and map existing role grants from legacy hems_duty_roster keys.
+
+INSERT INTO permissions (id, name, `key`, description, requires_pin, created_at, updated_at)
+SELECT UUID_TO_BIN(UUID(), true), 'Create Duty Roster', 'duty_roster.create', 'Create duty roster', 0, UTC_TIMESTAMP(), UTC_TIMESTAMP()
+WHERE NOT EXISTS (SELECT 1 FROM permissions WHERE `key` = 'duty_roster.create');
+
+INSERT INTO permissions (id, name, `key`, description, requires_pin, created_at, updated_at)
+SELECT UUID_TO_BIN(UUID(), true), 'Read Duty Roster', 'duty_roster.read', 'Read duty roster', 0, UTC_TIMESTAMP(), UTC_TIMESTAMP()
+WHERE NOT EXISTS (SELECT 1 FROM permissions WHERE `key` = 'duty_roster.read');
+
+INSERT INTO permissions (id, name, `key`, description, requires_pin, created_at, updated_at)
+SELECT UUID_TO_BIN(UUID(), true), 'Update Duty Roster', 'duty_roster.update', 'Update duty roster', 0, UTC_TIMESTAMP(), UTC_TIMESTAMP()
+WHERE NOT EXISTS (SELECT 1 FROM permissions WHERE `key` = 'duty_roster.update');
+
+INSERT INTO permissions (id, name, `key`, description, requires_pin, created_at, updated_at)
+SELECT UUID_TO_BIN(UUID(), true), 'Delete Duty Roster', 'duty_roster.delete', 'Delete duty roster', 0, UTC_TIMESTAMP(), UTC_TIMESTAMP()
+WHERE NOT EXISTS (SELECT 1 FROM permissions WHERE `key` = 'duty_roster.delete');
+
+INSERT INTO role_permissions (id, role_id, permission_id, created_at, updated_at)
+SELECT
+  UUID_TO_BIN(UUID(), true),
+  rp.role_id,
+  p_new.id,
+  UTC_TIMESTAMP(),
+  UTC_TIMESTAMP()
+FROM role_permissions rp
+JOIN permissions p_old ON p_old.id = rp.permission_id
+JOIN permissions p_new ON p_new.`key` = CONCAT('duty_roster.', SUBSTRING_INDEX(p_old.`key`, '.', -1))
+LEFT JOIN role_permissions rp_existing ON rp_existing.role_id = rp.role_id AND rp_existing.permission_id = p_new.id
+WHERE p_old.`key` IN (
+  'hems_duty_roster.create',
+  'hems_duty_roster.read',
+  'hems_duty_roster.update',
+  'hems_duty_roster.delete'
+)
+AND rp_existing.id IS NULL;