-- hr-system 权限底座(T08/F11) DDL + 种子数据
CREATE TABLE IF NOT EXISTS sys_data_scope (
    id VARCHAR(32) NOT NULL COMMENT '主键',
    admin_user_id VARCHAR(32) NULL COMMENT '管理员用户(sys_user.id)',
    scope_type VARCHAR(16) NULL COMMENT '范围类型(org/field/all)',
    org_ids_json TEXT NULL COMMENT '组织维度(org_unit.id 列表,含子树服务端展开)',
    field_ids_json TEXT NULL COMMENT '花名册字段维度(roster_field_def.id 白名单)',
    remark TEXT NULL,
    created_by VARCHAR(32) NULL,
    updated_by VARCHAR(32) NULL,
    created_at TIMESTAMP NULL,
    updated_at TIMESTAMP NULL,
    PRIMARY KEY (id),
    INDEX idx_admin_user (admin_user_id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='数据范围配置(F11,双维度)';

INSERT IGNORE INTO sys_role (id, role_code, role_name, remark, created_by, created_at, updated_at) VALUES
('ROLE_EMPLOYEE','employee','员工自助','员工本人查看/修改个人档案、发起自助申请','system',NOW(),NOW()),
('ROLE_MANAGER','manager','经理','管理本部门员工、发起并审批本部门人事异动','system',NOW(),NOW()),
('ROLE_HR_ADMIN','hr_admin','HR管理员','管理全公司人事业务，受数据范围约束','system',NOW(),NOW()),
('ROLE_SYS_ADMIN','sys_admin','系统管理员','系统配置、角色/管理员/数据范围/审计管理','system',NOW(),NOW());

INSERT IGNORE INTO sys_user (id, username, real_name, password, status, created_at, updated_at) VALUES
('USER_ADMIN','admin','系统管理员','',1,NOW(),NOW());

INSERT IGNORE INTO sys_user_role (user_id, role_id) VALUES
('USER_ADMIN','ROLE_EMPLOYEE'),('USER_ADMIN','ROLE_MANAGER'),('USER_ADMIN','ROLE_HR_ADMIN'),('USER_ADMIN','ROLE_SYS_ADMIN');

INSERT IGNORE INTO sys_permission (id, perm_code, perm_name, perm_path, created_at) VALUES
('PERM_ROLE_ADMIN','hr_system:role_admin','角色权限配置','/hr_system/role_admin',NOW()),
('PERM_DATA_SCOPE','hr_system:data_scope','数据范围配置','/hr_system/data_scope',NOW()),
('PERM_AUDIT_LOG','hr_system:audit_log','操作日志查询','/hr_system/audit_log',NOW());

INSERT IGNORE INTO sys_role_permission (role_id, perm_id) VALUES
('ROLE_SYS_ADMIN','PERM_ROLE_ADMIN'),('ROLE_SYS_ADMIN','PERM_DATA_SCOPE'),('ROLE_SYS_ADMIN','PERM_AUDIT_LOG');