-- Slice 8a-2 · Lpos/draft perms
INSERT INTO user_groups_perms (user_group_id, controller_allowed, action_allowed, created_by, created_on)
SELECT g.c0d, 'Lpos', a.act, 0, NOW()
FROM (SELECT 'draft' AS act UNION ALL SELECT 'draftBatchAj') a
CROSS JOIN user_groups g
WHERE g.user_group_name IN ('Projects Coordinator','Project Manager','Procurement','Administrator')
  AND NOT EXISTS (
    SELECT 1 FROM user_groups_perms p
     WHERE p.user_group_id = g.c0d AND p.controller_allowed = 'Lpos' AND p.action_allowed = a.act
  );

-- Read for Exec + FM (Slice 7 cross-role visibility)
INSERT INTO user_groups_perms (user_group_id, controller_allowed, action_allowed, created_by, created_on)
SELECT g.c0d, 'Lpos', 'draft', 0, NOW()
FROM user_groups g
WHERE g.user_group_name IN ('Executive','Finance Manager')
  AND NOT EXISTS (
    SELECT 1 FROM user_groups_perms p
     WHERE p.user_group_id = g.c0d AND p.controller_allowed = 'Lpos' AND p.action_allowed = 'draft'
  );
