BEGIN;
INSERT INTO roles (code, label, description) VALUES
  ('owner','Owner','Full platform, finance, users, backup and system governance'),
  ('admin','Admin','Operational administration excluding owner-only governance'),
  ('manager','Manager','Cross-functional operating management'),
  ('accounts','Accounts','Ledger, invoice payment, receivable and payable functions'),
  ('sales','Sales','CRM, quotation, invoice, collection follow-up and agreement functions'),
  ('office_staff','Office Staff','Customer entry, task coordination and ticket intake'),
  ('store','Store','Product, warehouse, stock movement and parts issue functions'),
  ('service_manager','Service Manager','Ticket allocation, warranty and engineer schedule functions'),
  ('engineer','Engineer','Only own assigned jobs, service evidence and approved parts usage')
ON CONFLICT (code) DO UPDATE SET label=EXCLUDED.label, description=EXCLUDED.description;

INSERT INTO role_permissions (role_code, permission_code) VALUES
  ('owner','*'),
  ('admin','dashboard.read'),('admin','customer.*'),('admin','ticket.*'),('admin','stock.*'),('admin','engineer.*'),('admin','report.*'),('admin','user.manage'),('admin','import.manage'),
  ('manager','dashboard.read'),('manager','customer.*'),('manager','ticket.*'),('manager','stock.read'),('manager','engineer.*'),('manager','report.read'),
  ('accounts','dashboard.read'),('accounts','invoice.read'),('accounts','payment.*'),('accounts','ledger.*'),('accounts','customer.read'),('accounts','supplier.read'),('accounts','report.finance'),
  ('sales','customer.*'),('sales','invoice.*'),('sales','agreement.*'),('sales','payment.read'),('sales','ticket.read'),
  ('office_staff','customer.create'),('office_staff','customer.read'),('office_staff','ticket.create'),('office_staff','ticket.read'),('office_staff','task.*'),
  ('store','product.*'),('store','stock.*'),('store','ticket.parts_issue'),('store','report.stock'),
  ('service_manager','ticket.*'),('service_manager','engineer.*'),('service_manager','warranty.*'),('service_manager','stock.read'),('service_manager','ticket.parts_issue'),
  ('engineer','ticket.assigned.read'),('engineer','ticket.own.start'),('engineer','ticket.own.complete'),('engineer','ticket.own.photo'),('engineer','ticket.own.location'),('engineer','ticket.own.parts_request')
ON CONFLICT DO NOTHING;
COMMIT;