-- 024_manager_candidates_rbac.sql
-- Manual one-shot: hiring_manager can list candidates on their requisition
-- jobs and write notes on those profiles. Form fill already comes from
-- hiring_forms (interviews.create/edit) + analytics_dashboard (interviews.view).
-- Applied at startup by alembic_setup.run_manual_sql().
--
-- Users must log in again after this applies — the frontend caches /users/me.

-- =============================================================================
-- 1. Bundle: candidates.view / create / edit (list + notes)
-- =============================================================================
INSERT INTO app.permissions (name, description, permission_tags, is_system, created_at, updated_at, is_active, is_deleted)
SELECT
    'manager_candidates',
    'Hiring manager: list candidates on own requisition jobs, view profiles, write notes',
    (
        SELECT COALESCE(jsonb_agg(id ORDER BY id), '[]'::jsonb)
        FROM app.permission_tags
        WHERE is_deleted = false
          AND tag_name IN ('candidates.view', 'candidates.create', 'candidates.edit')
    ),
    true,
    NOW(),
    NOW(),
    true,
    false
WHERE NOT EXISTS (
    SELECT 1 FROM app.permissions WHERE name = 'manager_candidates'
);

-- =============================================================================
-- 2. Attach the bundle to hiring_manager only
-- =============================================================================
UPDATE app.roles r
SET permissions = COALESCE(r.permissions, '[]'::jsonb) || jsonb_build_array(p.id),
    updated_at = NOW()
FROM app.permissions p
WHERE p.name = 'manager_candidates'
  AND r.role_name = 'hiring_manager'
  AND NOT (COALESCE(r.permissions, '[]'::jsonb) @> jsonb_build_array(p.id));