-- session-security A12c: backfill settings:security:read/write for existing tenants.
-- New tenants receive these via seedPermissions + seedSystemRoles; this migration
-- covers OWNER/ADMIN role_permissions rows created before the keys existed.
-- Idempotent: ON CONFLICT DO NOTHING on permissions.key and role_permissions PK.

INSERT INTO permissions (key, description)
VALUES
  ('settings:security:read', 'View tenant security settings and team sessions'),
  ('settings:security:write', 'Manage tenant security settings and revoke team sessions')
ON CONFLICT (key) DO NOTHING;
--> statement-breakpoint

INSERT INTO role_permissions (role_id, permission_id)
SELECT r.id, p.id
FROM roles r
CROSS JOIN permissions p
WHERE r.is_system_role = true
  AND r.name IN ('OWNER', 'ADMIN')
  AND p.key IN ('settings:security:read', 'settings:security:write')
ON CONFLICT (role_id, permission_id) DO NOTHING;
