-- =============================================================================
-- Migración 003 — Nueva tabla `task_permissions_map`
-- Paso 6 del plan: core/docs/permissions-plan.md
-- =============================================================================
-- EJECUTAR en: nucleo_base
-- Reversible: sí (ver sección ROLLBACK al final)
-- PROPÓSITO: Mapear cada task de API → (mod_id, bit requerido)
--            Usado por checkTaskPermission() en class.users.php
-- =============================================================================
DROP TABLE IF EXISTS `task_permissions_map`;

CREATE TABLE `task_permissions_map` (
  `tpm_id`        INT NOT NULL AUTO_INCREMENT COMMENT 'Identificador único',
  `tpm_task`      VARCHAR(100) NOT NULL COMMENT 'Nombre del task PHP, e.g. createRol',
  `tpm_context`   ENUM('module','config') NOT NULL DEFAULT 'module'
    COMMENT 'module = verificar bits en roles_modules | config = verificar rol_config_sections',
  `tpm_mod_id`    INT DEFAULT NULL
    COMMENT 'ID del módulo (solo cuando tpm_context=module)',
  `tpm_config_bit` INT DEFAULT NULL
    COMMENT 'Valor del bit en rol_config_sections (solo cuando tpm_context=config)',
  `tpm_permit_bit` TINYINT DEFAULT NULL
    COMMENT '0=Ver,1=Agregar,2=Editar,3=Eliminar,4=Aprobar,5=Exportar,6=Configurar',
  `tpm_state`     TINYINT NOT NULL DEFAULT 1 COMMENT '1=activo, 0=inactivo',
  PRIMARY KEY (`tpm_id`),
  UNIQUE KEY `uq_task` (`tpm_task`),
  KEY `idx_mod` (`tpm_mod_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci
  COMMENT='Mapeo de tasks de API a permisos requeridos';

-- =============================================================================
-- Seed: tasks del config admin (context=config)
-- =============================================================================
-- Valores de tpm_config_bit (bitmask rol_config_sections):
--   1=Configuración, 2=Sistemas, 4=Sitios, 8=Usuarios, 16=Roles, 32=Grupos, 64=Tipos de Documentos

INSERT INTO `task_permissions_map`
  (`tpm_task`, `tpm_context`, `tpm_mod_id`, `tpm_config_bit`, `tpm_permit_bit`)
VALUES
  -- Sistemas
  ('createSystem',             'config', NULL, 2,  NULL),
  ('updateSystem',             'config', NULL, 2,  NULL),
  ('changeStateSystem',        'config', NULL, 2,  NULL),
  ('createSite',               'config', NULL, 4,  NULL), -- Sitios
  ('updateSite',               'config', NULL, 4,  NULL),
  ('changeStateSite',          'config', NULL, 4,  NULL),
  ('createUser',               'config', NULL, 8,  NULL), -- Usuarios
  ('updateUser',               'config', NULL, 8,  NULL),
  ('changeStateUser',          'config', NULL, 8,  NULL),
  ('deleteUser',               'config', NULL, 8,  NULL),
  ('getUserFormData',          'config', NULL, 8,  NULL),
  ('createRol',                'config', NULL, 16, NULL), -- Roles
  ('updateRol',                'config', NULL, 16, NULL),
  ('deleteRol',                'config', NULL, 16, NULL),
  ('changeStateRol',           'config', NULL, 16, NULL),
  ('getRoleFormData',          'config', NULL, 16, NULL),
  ('createGroup',              'config', NULL, 32, NULL), -- Grupos
  ('updateGroup',              'config', NULL, 32, NULL),
  ('deleteGroup',              'config', NULL, 32, NULL),
  ('changeStateGroup',         'config', NULL, 32, NULL),
  ('createDocumentType',       'config', NULL, 64, NULL), -- Tipos de Documentos REMS
  ('updateDocumentType',       'config', NULL, 64, NULL),
  ('deleteDocumentType',       'config', NULL, 64, NULL),
  ('changeStateDocumentType',  'config', NULL, 64, NULL);

-- =============================================================================
-- Seed placeholder: tasks de módulos REMS (context=module)
-- Completar tpm_mod_id con los IDs reales de la tabla `modules`
-- =============================================================================
-- INSERT INTO `task_permissions_map` (`tpm_task`, `tpm_context`, `tpm_mod_id`, `tpm_permit_bit`) VALUES
--   ('getProperties',    'module', <mod_id_rems_properties>, 0),  -- Ver
--   ('createProperty',   'module', <mod_id_rems_properties>, 1),  -- Agregar
--   ('updateProperty',   'module', <mod_id_rems_properties>, 2),  -- Editar
--   ('deleteProperty',   'module', <mod_id_rems_properties>, 3),  -- Eliminar
--   ('approveContract',  'module', <mod_id_rems_contracts>,  4),  -- Aprobar
--   ('exportProperties', 'module', <mod_id_rems_properties>, 5),  -- Exportar
--   ('getDocumentTypes', 'module', <mod_id_rems_config>,     6);  -- Configurar

-- =============================================================================
-- ROLLBACK
-- =============================================================================
-- DROP TABLE IF EXISTS `task_permissions_map`;