-- 025_manager_role_candidates_rbac.sql
-- The Access Control role named Manager (Ahmed Baig) is not the seeded
-- hiring_manager role. 024 only attached manager_candidates to hiring_manager,
-- so Manager had 0 candidates.* tags and the Candidates nav item never appeared
-- (routes.js permission is candidates.view). Same hole broke Calendar:
-- GET /interview/fetch is gated on candidates.view, not interviews.view.
-- Applied at startup by alembic_setup.run_manual_sql(). Log in again after.

INSERT INTO app.permissions (name, description, permission_tags, is_system, created_at, updated_at, is_active, is_deleted)
SELECT
    'manager_candidates',
    'Hiring manager: list candidates on own requisition jobs, view profiles, write notes',
    (
        SELECT COALESCE(jsonb_agg(id ORDER BY id), '[]'::jsonb)
        FROM app.permission_tags
        WHERE is_deleted = false
          AND tag_name IN ('candidates.view', 'candidates.create', 'candidates.edit')
    ),
    true,
    NOW(),
    NOW(),
    true,
    false
WHERE NOT EXISTS (
    SELECT 1 FROM app.permissions WHERE name = 'manager_candidates'
);

UPDATE app.roles r
SET permissions = COALESCE(r.permissions, '[]'::jsonb) || jsonb_build_array(p.id),
    updated_at = NOW()
FROM app.permissions p
WHERE p.name = 'manager_candidates'
  AND lower(r.role_name) IN ('hiring_manager', 'manager')
  AND NOT (COALESCE(r.permissions, '[]'::jsonb) @> jsonb_build_array(p.id));