import { type MigrationInterface, type QueryRunner } from 'typeorm';

/**
 * Settlements access — limited to Admin + Accountant per stakeholder
 * spec (settlements is finance-only).
 *
 *   - Promote Accountant: payment_settlement VIEW → EDIT (can now run
 *     Settle / Record Payment / append notes).
 *   - Revoke Operations Manager: previously seeded EDIT (Phase A).
 *   - Revoke Sales Head: previously seeded VIEW (Phase F).
 *
 * Admin keeps DELETE (Phase A seed) — covers the void + amount-edit
 * endpoints which are gated on the highest tier.
 *
 * Idempotent on re-run: UPDATE is a no-op if already EDIT; DELETE
 * is a no-op when the row is already gone. Custom tenant-side grants
 * survive because the WHERE clauses match by role NAME, not by the
 * Phase A seed's identity.
 */
export class SettlementAdminAccountantOnly1780100000000 implements MigrationInterface {
  async up(qr: QueryRunner): Promise<void> {
    // Accountant: VIEW → EDIT
    await qr.query(`
      UPDATE role_permissions rp
         SET access_level = 'edit', updated_at = NOW()
        FROM roles r
       WHERE rp.role_id = r.id
         AND rp.module = 'payment_settlement'
         AND rp.is_deleted = false
         AND LOWER(r.name) = 'accountant'
         AND rp.access_level <> 'edit';
    `);

    // Operations Manager: remove (was EDIT seeded by Phase A)
    await qr.query(`
      DELETE FROM role_permissions rp
        USING roles r
       WHERE rp.role_id = r.id
         AND rp.module = 'payment_settlement'
         AND LOWER(r.name) IN ('operations manager', 'ops manager');
    `);

    // Sales Head: remove (was VIEW seeded by Phase F)
    await qr.query(`
      DELETE FROM role_permissions rp
        USING roles r
       WHERE rp.role_id = r.id
         AND rp.module = 'payment_settlement'
         AND LOWER(r.name) = 'sales head';
    `);
  }

  async down(qr: QueryRunner): Promise<void> {
    // Restore Accountant to VIEW
    await qr.query(`
      UPDATE role_permissions rp
         SET access_level = 'view', updated_at = NOW()
        FROM roles r
       WHERE rp.role_id = r.id
         AND rp.module = 'payment_settlement'
         AND rp.is_deleted = false
         AND LOWER(r.name) = 'accountant';
    `);

    // Re-seed Ops Manager EDIT
    await qr.query(`
      INSERT INTO role_permissions (id, tenant_id, role_id, module, access_level, is_deleted, created_at, updated_at)
      SELECT gen_random_uuid(), r.tenant_id, r.id, 'payment_settlement', 'edit', false, NOW(), NOW()
        FROM roles r
       WHERE r.is_deleted = false
         AND LOWER(r.name) IN ('operations manager', 'ops manager')
         AND NOT EXISTS (
           SELECT 1 FROM role_permissions rp2
            WHERE rp2.role_id = r.id AND rp2.module = 'payment_settlement'
         );
    `);

    // Re-seed Sales Head VIEW
    await qr.query(`
      INSERT INTO role_permissions (id, tenant_id, role_id, module, access_level, is_deleted, created_at, updated_at)
      SELECT gen_random_uuid(), r.tenant_id, r.id, 'payment_settlement', 'view', false, NOW(), NOW()
        FROM roles r
       WHERE r.is_deleted = false
         AND LOWER(r.name) = 'sales head'
         AND NOT EXISTS (
           SELECT 1 FROM role_permissions rp2
            WHERE rp2.role_id = r.id AND rp2.module = 'payment_settlement'
         );
    `);
  }
}