-- 028: Slim bundles for custom Access Control roles that should see only the
-- Requisitions and Interviews/Calendar tabs. The tags already exist (001, 019);
-- the seeded bundles are too wide — requisitions_management includes
-- requisitions.manage (org-wide list), analytics_dashboard hangs interviews.view
-- off dashboard/analytics/offers, hiring_forms has interview writes but no view.
--
-- These two are NOT attached to seeded staff roles (those already have the wide
-- bundles). Admins tick them on a new role in Access Control.
-- Applied at startup by alembic_setup.run_manual_sql(). Log in again after.

-- =============================================================================
-- 1. Own requisitions only (omit .manage so is_admin() stays false)
-- =============================================================================
INSERT INTO app.permissions (name, description, permission_tags, is_system, created_at, updated_at, is_active, is_deleted)
SELECT
    'requisitions_self',
    'Own employee requisition forms: view, create, edit (not org-wide manage)',
    (
        SELECT COALESCE(jsonb_agg(id ORDER BY id), '[]'::jsonb)
        FROM app.permission_tags
        WHERE is_deleted = false
          AND tag_name IN ('requisitions.view', 'requisitions.create', 'requisitions.edit')
    ),
    true,
    NOW(),
    NOW(),
    true,
    false
WHERE NOT EXISTS (
    SELECT 1 FROM app.permissions WHERE name = 'requisitions_self'
);

-- =============================================================================
-- 2. Interviews / Calendar tab (view + schedule + amend)
-- =============================================================================
INSERT INTO app.permissions (name, description, permission_tags, is_system, created_at, updated_at, is_active, is_deleted)
SELECT
    'interviews_tab',
    'Interviews and Calendar tabs: list, schedule, reschedule',
    (
        SELECT COALESCE(jsonb_agg(id ORDER BY id), '[]'::jsonb)
        FROM app.permission_tags
        WHERE is_deleted = false
          AND tag_name IN ('interviews.view', 'interviews.create', 'interviews.edit')
    ),
    true,
    NOW(),
    NOW(),
    true,
    false
WHERE NOT EXISTS (
    SELECT 1 FROM app.permissions WHERE name = 'interviews_tab'
);