SET NAMES utf8mb4;

ALTER TABLE abs_users
    ADD COLUMN IF NOT EXISTS role VARCHAR(50) NOT NULL DEFAULT 'Angajat'
    AFTER phone;

CREATE TABLE IF NOT EXISTS abs_user_module_permissions
(
    id BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
    user_id INT NOT NULL,
    module_key VARCHAR(100) NOT NULL,
    can_access TINYINT(1) NOT NULL DEFAULT 0,
    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP NULL DEFAULT NULL
        ON UPDATE CURRENT_TIMESTAMP,

    UNIQUE KEY uq_abs_user_module_permission
        (user_id, module_key),

    KEY idx_abs_user_module_permissions_user
        (user_id),

    CONSTRAINT fk_abs_user_module_permissions_user
        FOREIGN KEY (user_id)
        REFERENCES abs_users(id)
        ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4
  COLLATE=utf8mb4_unicode_ci;

-- Garantează existența unui SuperAdmin pentru instalațiile deja create.
UPDATE abs_users
SET role = 'SuperAdmin'
WHERE id = (
    SELECT first_user_id
    FROM (
        SELECT MIN(id) AS first_user_id
        FROM abs_users
    ) AS first_user
)
AND NOT EXISTS (
    SELECT 1
    FROM (
        SELECT id
        FROM abs_users
        WHERE role = 'SuperAdmin'
        LIMIT 1
    ) AS existing_superadmin
);

-- Curăță eventualele permisiuni vechi ale SuperAdminului.
DELETE permission
FROM abs_user_module_permissions permission
INNER JOIN abs_users user
    ON user.id = permission.user_id
WHERE user.role = 'SuperAdmin';

-- Permisiunile SuperAdmin nu sunt necesare în tabel:
-- aplicația acordă automat acces complet acestui rol.