From 09e5bffe54bb5975ad708d89ef983f8992f780f6 Mon Sep 17 00:00:00 2001
From: consultoria-as <ialcarazsalazar@consultoria-as.com>
Date: Tue, 30 Jun 2026 16:39:10 +0000
Subject: [PATCH] feat(migration): limpia permisos de usuarios
 workshop/mechanic en todos los tenants

- Agrega migracion v4.11_clean_workshop_mechanic_permissions.sql
- Aplica DELETE de permisos no relacionados con taller y reinserta los 3 permisos base
- Ejecutada en todas las bases de datos de tenant activas
---
 ...11_clean_workshop_mechanic_permissions.sql | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 pos/migrations/v4.11_clean_workshop_mechanic_permissions.sql

diff --git a/pos/migrations/v4.11_clean_workshop_mechanic_permissions.sql b/pos/migrations/v4.11_clean_workshop_mechanic_permissions.sql
new file mode 100644
index 0000000..0fb580f
--- /dev/null
+++ b/pos/migrations/v4.11_clean_workshop_mechanic_permissions.sql
@@ -0,0 +1,24 @@
+-- v4.11_clean_workshop_mechanic_permissions.sql
+-- Restringe los permisos de los empleados con rol 'workshop' y 'mechanic'
+-- para que solo tengan acceso a la seccion de Taller y no vean precios.
+-- Ejecutar en cada base de datos de tenant.
+
+-- 1. Eliminar cualquier permiso que no sea de taller para estos roles
+DELETE FROM employee_permissions
+WHERE employee_id IN (
+    SELECT id FROM employees WHERE role IN ('workshop', 'mechanic')
+)
+AND permission NOT IN ('workshop.view', 'workshop.edit', 'workshop.add_items');
+
+-- 2. Asegurar que tengan los permisos base de taller
+INSERT INTO employee_permissions (employee_id, permission)
+SELECT e.id, p.permission
+FROM employees e
+CROSS JOIN (
+    VALUES
+        ('workshop.view'),
+        ('workshop.edit'),
+        ('workshop.add_items')
+) AS p(permission)
+WHERE e.role IN ('workshop', 'mechanic')
+ON CONFLICT (employee_id, permission) DO NOTHING;