<?php

use App\Models\Permission;
use App\Models\Role;
use Illuminate\Database\Migrations\Migration;

return new class extends Migration
{
    public function up(): void
    {
        $permission = Permission::query()->firstOrCreate(
            ['name' => 'attendances_approve_regularization'],
            ['display_name' => 'Attendances approve regularization']
        );

        Role::withoutGlobalScopes()
            ->whereIn('name', ['admin', 'hr', 'manager'])
            ->each(function (Role $role) use ($permission): void {
                $role->permissions()->syncWithoutDetaching([(int) $permission->id]);
            });

        Role::withoutGlobalScopes()
            ->whereIn('name', ['employee', 'finance'])
            ->each(function (Role $role) use ($permission): void {
                $role->permissions()->detach((int) $permission->id);
            });
    }

    public function down(): void
    {
        // No-op: permission assignments are managed by TenantRoleService.
    }
};