-- Admin (role_id = 6) gets every permission enabled.
INSERT INTO role_permissions (role_id, permission_id, enabled)
SELECT 6, id, 1 FROM permissions
ON DUPLICATE KEY UPDATE enabled = 1;

-- Customer Service (role_id = 5) — exact example given in spec section 5:
-- customer.view=ON, customer.edit=ON, customer.delete=OFF,
-- billing.view=ON, billing.edit=OFF, network.view=OFF,
-- mikrotik.execute=OFF, settings.view=OFF
INSERT INTO role_permissions (role_id, permission_id, enabled)
SELECT 5, id,
    CASE slug
        WHEN 'customer.view' THEN 1
        WHEN 'customer.edit' THEN 1
        WHEN 'customer.add' THEN 1
        WHEN 'billing.view' THEN 1
        WHEN 'payment.view' THEN 1
        WHEN 'tickets.view' THEN 1
        WHEN 'tickets.edit' THEN 1
        WHEN 'community.view' THEN 1
        WHEN 'tutorials.view' THEN 1
        WHEN 'dashboard.view' THEN 1
        ELSE 0
    END
FROM permissions
ON DUPLICATE KEY UPDATE enabled = VALUES(enabled);

-- Customer-facing tiers (Silver/Gold/Platinum/Supreme) only get the
-- member-portal-equivalent permission; their portal access is governed
-- separately by AuthMiddleware + ownership checks (they only ever see
-- their own customer record), not by the admin RBAC module list.
INSERT INTO role_permissions (role_id, permission_id, enabled)
SELECT r.id, p.id, 1
FROM roles r
JOIN permissions p ON p.slug = 'dashboard.view'
WHERE r.slug IN ('silver','gold','platinum','supreme')
ON DUPLICATE KEY UPDATE enabled = 1;