<?php

use App\Models\Permission;
use App\Models\Role;
use App\Services\TenantRoleService;
use Illuminate\Database\Migrations\Migration;

return new class extends Migration
{
    public function up(): void
    {
        $names = ['biometric_devices_view', 'biometric_devices_manage'];

        foreach ($names as $name) {
            Permission::firstOrCreate(
                ['name' => $name],
                ['name' => $name, 'display_name' => ucfirst(str_replace('_', ' ', $name))]
            );
        }

        $permissionIds = Permission::query()
            ->whereIn('name', $names)
            ->pluck('id', 'name');

        $adminAndHr = Role::withoutGlobalScopes()
            ->whereIn('name', ['admin', 'hr'])
            ->get();

        foreach ($adminAndHr as $role) {
            $role->permissions()->syncWithoutDetaching($permissionIds->values()->all());
        }

        $managers = Role::withoutGlobalScopes()
            ->where('name', 'manager')
            ->get();

        $viewId = $permissionIds->get('biometric_devices_view');
        if ($viewId) {
            foreach ($managers as $role) {
                $role->permissions()->syncWithoutDetaching([$viewId]);
            }
        }

        // Keep default role templates in sync for future companies.
        TenantRoleService::ensurePermissionsSeeded();
    }

    public function down(): void
    {
        $permissionIds = Permission::query()
            ->whereIn('name', ['biometric_devices_view', 'biometric_devices_manage'])
            ->pluck('id');

        if ($permissionIds->isEmpty()) {
            return;
        }

        foreach (Role::withoutGlobalScopes()->get() as $role) {
            $role->permissions()->detach($permissionIds->all());
        }

        Permission::query()->whereIn('id', $permissionIds)->delete();
    }
};