-- v4.10: add fleet RBAC permissions for existing employees.
-- Owner and admin get full fleet access; accountant and workshop get read access.

INSERT INTO employee_permissions (employee_id, permission)
SELECT e.id, p.perm
FROM employees e
CROSS JOIN (VALUES
    ('fleet.view'),
    ('fleet.create'),
    ('fleet.edit'),
    ('fleet.delete')
) AS p(perm)
WHERE e.role IN ('owner', 'admin')
ON CONFLICT (employee_id, permission) DO NOTHING;

INSERT INTO employee_permissions (employee_id, permission)
SELECT e.id, 'fleet.view'
FROM employees e
WHERE e.role IN ('accountant', 'workshop')
ON CONFLICT (employee_id, permission) DO NOTHING;