-- OMEGA admin access bootstrap: safe to run after schema.sql on PostgreSQL 16.
-- No default plaintext passwords are inserted. Create the first Owner through /api/v1/auth/bootstrap-owner,
-- then create staff from the Owner-only dashboard/API. Passwords are stored as Argon2 hashes by the API.
INSERT INTO roles(name,permissions_json) VALUES
 ('OWNER','["*"]'::jsonb),
 ('SUPERVISOR','["users.view","tickets.view","tickets.reply","tickets.assign","applications.view","audit.view","analytics.view","shifts.view"]'::jsonb),
 ('MANAGER','["tickets.view","tickets.reply","tickets.assign","shifts.view"]'::jsonb),
 ('AUDITOR','["users.view","tickets.view","audit.view","analytics.view","applications.view"]'::jsonb),
 ('AI_AGENT','["tickets.view"]'::jsonb),
 ('PARTNER','["tickets.view"]'::jsonb),
 ('USER','["tickets.create","tickets.view","tickets.reply"]'::jsonb)
ON CONFLICT(name) DO UPDATE SET permissions_json = EXCLUDED.permissions_json;

CREATE TABLE IF NOT EXISTS user_permission_overrides (
 id bigserial PRIMARY KEY,
 user_id varchar(36) NOT NULL REFERENCES users(id) ON DELETE CASCADE,
 permission varchar(100) NOT NULL,
 allowed boolean NOT NULL,
 changed_by varchar(36) REFERENCES users(id),
 changed_at timestamptz NOT NULL DEFAULT now(),
 CONSTRAINT uq_user_permission_override UNIQUE(user_id, permission)
);
CREATE INDEX IF NOT EXISTS ix_user_permission_overrides_user_id ON user_permission_overrides(user_id);

ALTER TABLE users ADD COLUMN IF NOT EXISTS token_version integer NOT NULL DEFAULT 0;