-- Migration: add role_page_permissions table
-- Run once on existing DB (MySQL)

CREATE TABLE IF NOT EXISTS role_page_permissions (
  id         INT          NOT NULL AUTO_INCREMENT PRIMARY KEY,
  role       VARCHAR(20)  NOT NULL,
  module     VARCHAR(50)  NOT NULL,
  can_access TINYINT(1)   NOT NULL DEFAULT 1,
  UNIQUE KEY uq_role_module (role, module)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

-- Seed: all modules enabled for both roles by default
INSERT IGNORE INTO role_page_permissions (role, module, can_access)
SELECT r.role, m.module, 1
FROM
  (SELECT 'OWNER'   AS role
   UNION ALL SELECT 'MANAGER') r,
  (SELECT 'dashboard'    AS module
   UNION ALL SELECT 'shifts'
   UNION ALL SELECT 'cash_handovers'
   UNION ALL SELECT 'shift_history'
   UNION ALL SELECT 'tank_dip'
   UNION ALL SELECT 'customers'
   UNION ALL SELECT 'stock'
   UNION ALL SELECT 'bulk_sales'
   UNION ALL SELECT 'billing'
   UNION ALL SELECT 'expenses'
   UNION ALL SELECT 'analytics'
   UNION ALL SELECT 'staff'
   UNION ALL SELECT 'roster'
   UNION ALL SELECT 'leave'
   UNION ALL SELECT 'allowances'
   UNION ALL SELECT 'performance'
   UNION ALL SELECT 'notifications'
   UNION ALL SELECT 'settings'
   UNION ALL SELECT 'audit') m;