-- 008_hiring_forms_rbac.sql
-- Manual one-shot: a `hiring_forms` bundle granting interviews.create/edit/delete
-- so staff roles can fill and amend the digitized hiring forms (Annexure A
-- requisition, Annexure E interview analysis + cultural fit) served by the
-- candidate_forms domain. The interviews.* tags themselves were seeded by 001;
-- the analytics_dashboard bundle only carries interviews.view, which is why the
-- write tags need this bundle. Mirrors 007's idempotent pattern; applied
-- automatically at startup by alembic_setup.run_manual_sql() and recorded in
-- manual_migrations.
--
-- Users must log in again after this applies — permissions are resolved from
-- the DB per request, but the frontend caches the list from /users/me.

-- =============================================================================
-- 1. Bundle holding the interviews write tags
-- =============================================================================
INSERT INTO app.permissions (name, description, permission_tags, is_system, created_at, updated_at, is_active, is_deleted)
SELECT
    'hiring_forms',
    'Fill and amend candidate hiring forms (requisition, interview analysis, cultural fit)',
    (
        SELECT COALESCE(jsonb_agg(id ORDER BY id), '[]'::jsonb)
        FROM app.permission_tags
        WHERE is_deleted = false
          AND tag_name IN ('interviews.create', 'interviews.edit', 'interviews.delete')
    ),
    true,
    NOW(),
    NOW(),
    true,
    false
WHERE NOT EXISTS (
    SELECT 1 FROM app.permissions WHERE name = 'hiring_forms'
);

-- =============================================================================
-- 2. Attach the bundle to the staff roles (idempotent; same role list as 007)
-- =============================================================================
UPDATE app.roles r
SET permissions = COALESCE(r.permissions, '[]'::jsonb) || jsonb_build_array(p.id),
    updated_at = NOW()
FROM app.permissions p
WHERE p.name = 'hiring_forms'
  AND r.role_name IN (
      'system_administrator',
      'hr_administrator',
      'recruiter',
      'hiring_manager',
      'department_head',
      'ceo'
  )
  AND NOT (COALESCE(r.permissions, '[]'::jsonb) @> jsonb_build_array(p.id));