-- v4.11_clean_workshop_mechanic_permissions.sql
-- Restringe los permisos de los empleados con rol 'workshop' y 'mechanic'
-- para que solo tengan acceso a la seccion de Taller y no vean precios.
-- Ejecutar en cada base de datos de tenant.

-- 1. Eliminar cualquier permiso que no sea de taller para estos roles
DELETE FROM employee_permissions
WHERE employee_id IN (
    SELECT id FROM employees WHERE role IN ('workshop', 'mechanic')
)
AND permission NOT IN ('workshop.view', 'workshop.edit', 'workshop.add_items');

-- 2. Asegurar que tengan los permisos base de taller
INSERT INTO employee_permissions (employee_id, permission)
SELECT e.id, p.permission
FROM employees e
CROSS JOIN (
    VALUES
        ('workshop.view'),
        ('workshop.edit'),
        ('workshop.add_items')
) AS p(permission)
WHERE e.role IN ('workshop', 'mechanic')
ON CONFLICT (employee_id, permission) DO NOTHING;
