-- ============================================================================
-- RBAC Base Permissions - Sistema de Permisos Granulares
-- ============================================================================
-- Este script puebla la tabla rbac_permissions con permisos base del sistema.
-- Ejecutar después de crear las tablas con rbacEnsureTables()
-- 
-- Uso: mysql -u root -p chat < /home/www/admin/config/sql/rbac_permissions.sql
-- ============================================================================

USE chat;

-- Asegurar que las tablas existen
CREATE TABLE IF NOT EXISTS rbac_permissions (
    id INT AUTO_INCREMENT PRIMARY KEY,
    module VARCHAR(190) NOT NULL,
    action VARCHAR(60) NOT NULL,
    min_level INT NOT NULL DEFAULT 0,
    description VARCHAR(255) NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    UNIQUE KEY uniq_module_action (module, action),
    KEY idx_module (module),
    KEY idx_action (action)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

CREATE TABLE IF NOT EXISTS rbac_user_permissions (
    id INT AUTO_INCREMENT PRIMARY KEY,
    user_id INT NOT NULL,
    module VARCHAR(190) NOT NULL,
    action VARCHAR(60) NOT NULL,
    effect ENUM('allow','deny') NOT NULL DEFAULT 'allow',
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    UNIQUE KEY uniq_user_module_action (user_id, module, action),
    KEY idx_user (user_id),
    KEY idx_module (module)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

-- ============================================================================
-- PERMISOS POR MÓDULO
-- ============================================================================
-- Nivel 1 = Técnico, 2 = Operador, 3 = Supervisor, 4 = Ejecutivo, 5 = Admin

-- Limpiar permisos existentes
TRUNCATE TABLE rbac_permissions;

-- MÓDULO: Admin Principal
INSERT INTO rbac_permissions (module, action, min_level, description) VALUES
('/admin/', 'view', 3, 'Ver panel administrativo'),
('/admin/', 'edit', 4, 'Editar configuraciones'),
('/admin/config/', 'view', 5, 'Ver configuración del sistema'),
('/admin/config/', 'edit', 5, 'Editar configuración del sistema'),
('/admin/gastos3.php', 'view', 4, 'Ver gastos'),
('/admin/gastos3.php', 'edit', 5, 'Editar gastos'),
('/admin/reportes/', 'view', 4, 'Ver reportes'),
('/admin/reportes/', 'export', 5, 'Exportar reportes');

-- MÓDULO: Finance OS
INSERT INTO rbac_permissions (module, action, min_level, description) VALUES
('/finance-os/', 'view', 4, 'Ver FinanceOS'),
('/finance-os/', 'edit', 5, 'Editar en FinanceOS'),
('/finance-os/tesoreria/', 'view', 4, 'Ver tesorería'),
('/finance-os/tesoreria/', 'process', 5, 'Procesar pagos'),
('/finance-os/contabilidad/', 'view', 4, 'Ver contabilidad'),
('/finance-os/contabilidad/', 'edit', 5, 'Editar contabilidad');

-- MÓDULO: Soporte Técnico
INSERT INTO rbac_permissions (module, action, min_level, description) VALUES
('/soporte_tec/', 'view', 2, 'Ver tickets de soporte'),
('/soporte_tec/', 'create', 2, 'Crear tickets'),
('/soporte_tec/', 'edit', 3, 'Editar tickets'),
('/soporte_tec/', 'manage', 4, 'Gestionar tickets (asignar, cerrar)'),
('/soporte_tec/', 'delete', 5, 'Eliminar tickets');

-- MÓDULO: CTNet OSP
INSERT INTO rbac_permissions (module, action, min_level, description) VALUES
('/ctnetosp/', 'view', 1, 'Ver CTNet OSP'),
('/ctnetosp/modules/tecnicos/', 'view', 1, 'Ver portal de técnicos'),
('/ctnetosp/modules/tecnicos/', 'edit', 1, 'Editar tareas propias'),
('/ctnetosp/modules/tecnicos/dashboard_ejecutivo.php', 'view', 4, 'Ver dashboard ejecutivo'),
('/ctnetosp/modules/tasks/', 'view', 2, 'Ver tareas'),
('/ctnetosp/modules/tasks/', 'create', 3, 'Crear tareas'),
('/ctnetosp/modules/tasks/', 'assign', 3, 'Asignar tareas'),
('/ctnetosp/modules/tasks/map.php', 'view', 3, 'Ver mapa de técnicos');

-- MÓDULO: Chat Web
INSERT INTO rbac_permissions (module, action, min_level, description) VALUES
('/chatWEB/', 'view', 2, 'Ver chat'),
('/chatWEB/admin/', 'view', 4, 'Ver admin de chat'),
('/chatWEB/admin/', 'manage', 5, 'Gestionar bot de chat');

-- MÓDULO: RRHH
INSERT INTO rbac_permissions (module, action, min_level, description) VALUES
('/index/rrhh/', 'view', 3, 'Ver RRHH'),
('/index/rrhh/nominas/', 'view', 3, 'Ver nóminas'),
('/index/rrhh/nominas/', 'edit', 4, 'Editar nóminas'),
('/index/rrhh/nominas/', 'export', 4, 'Exportar nóminas');

-- MÓDULO: Tienda
INSERT INTO rbac_permissions (module, action, min_level, description) VALUES
('/tienda/', 'view', 3, 'Ver tienda'),
('/tienda/', 'sell', 3, 'Vender productos'),
('/tienda/', 'inventory', 4, 'Gestionar inventario'),
('/tienda/', 'admin', 5, 'Administrar tienda');

-- MÓDULO: Observer
INSERT INTO rbac_permissions (module, action, min_level, description) VALUES
('/modules/observer/', 'view', 4, 'Ver Observer'),
('/modules/observer/dashboard/', 'view', 4, 'Ver dashboard de Observer'),
('/modules/observer/api/', 'access', 4, 'Acceso a API de Observer');

-- MÓDULO: Contratos
INSERT INTO rbac_permissions (module, action, min_level, description) VALUES
('/contratos/', 'view', 3, 'Ver contratos'),
('/contratos/', 'create', 3, 'Crear contratos'),
('/contratos/', 'edit', 4, 'Editar contratos');

-- MÓDULO: Contabilidad
INSERT INTO rbac_permissions (module, action, min_level, description) VALUES
('/index/contabilidad/', 'view', 4, 'Ver contabilidad'),
('/index/contabilidad/', 'edit', 5, 'Editar contabilidad');

-- ============================================================================
-- VERIFICACIÓN
-- ============================================================================
SELECT 
    COUNT(*) as total_permisos,
    COUNT(DISTINCT module) as modulos,
    COUNT(DISTINCT action) as acciones
FROM rbac_permissions;

SELECT 'RBAC Permissions poblados exitosamente' as status;
