-- Gold Jewellery Software - Developer role & account
-- Migration 011: adds a Developer role with full permissions, and a
-- DevProMax account under it. This account is a normal row in `users`,
-- shows up in /users like any other account, and its actions log to
-- audit_logs like any other user — there is no hidden-account or
-- unlogged-access mechanism in this codebase, by design.
--
-- Also moves Data Tools access (system.manage) from Admin to
-- Developer-only, since that's the intent behind creating this role —
-- Admin's own role_permissions grant is revoked for that one permission
-- so the underlying access is actually restricted, not just the sidebar
-- link cosmetically hidden while Admin could still reach it by URL.
USE gold_jewellery;

INSERT INTO roles (name, description) VALUES
 ('Developer', 'Technical maintenance access — full permissions, same visibility and audit trail as any other account')
ON DUPLICATE KEY UPDATE description = VALUES(description);

-- Grant Developer every permission that exists so far.
INSERT INTO role_permissions (role_id, permission_id)
SELECT r.id, p.id FROM roles r CROSS JOIN permissions p
WHERE r.name = 'Developer'
ON DUPLICATE KEY UPDATE role_id = role_id;

-- The DevProMax account. Password hash below is for 'Promax@7797',
-- generated with bcrypt (compatible with PHP's password_verify()) — if
-- you'd rather generate it fresh yourself instead of trusting this one,
-- run: php -r "echo password_hash('Promax@7797', PASSWORD_DEFAULT), PHP_EOL;"
-- and swap the hash below (or UPDATE it after this migration runs).
INSERT INTO users (role_id, name, username, email, password_hash, is_active)
SELECT r.id, 'DevProMax', 'DevProMax', 'promaxsoftwares@gmail.com',
       '$2b$10$FDYkTfd2hAXqmboDyE67/euasv0PVjmkJJlZxI7HwbBp7RRJMUEHG', 1
FROM roles r WHERE r.name = 'Developer'
ON DUPLICATE KEY UPDATE name = VALUES(name);

-- Restrict Data Tools to Developer only — remove Admin's system.manage grant.
DELETE rp FROM role_permissions rp
JOIN roles r ON r.id = rp.role_id
JOIN permissions p ON p.id = rp.permission_id
WHERE r.name = 'ADMIN' AND p.slug = 'system.manage';