-- 0092_inquiries_permission.sql
-- ----------------------------------------------------------------------------
-- New `inquiries` permission resource (view/manage) backing the top-level
-- Inquiries workbench (previously the inbox lived under /admin and was gated on
-- admin.view_audit_log, which sales roles don't have).
--
-- Existing role rows are backfilled so the resource defaults to whatever the
-- role's `clients` access is: view ⟵ clients.view, manage ⟵ clients.create.
-- This lights up the right roles (anyone who can see/create clients) without a
-- manual per-role edit, and defaults to deny for read-only roles.
--
-- New-key only and idempotent via the `? 'inquiries'` guard, so re-running is a
-- no-op. Per-user / port-role override tables are intentionally left untouched:
-- the deep-merge resolver fills missing leaves from the base role (same
-- reasoning as 0041).

UPDATE roles
SET permissions = permissions || jsonb_build_object(
  'inquiries', jsonb_build_object(
    'view',   COALESCE((permissions->'clients'->>'view')::boolean,   false),
    'manage', COALESCE((permissions->'clients'->>'create')::boolean, false)
  )
)
WHERE permissions IS NOT NULL
  AND NOT (permissions ? 'inquiries');
