-- Slice 8g-GoodsCrm · perms
--
-- CRM authors items (add/remove) + submits the chain. Admin also has these for support.
-- Model-level guards additionally block based on crm_status + role.

INSERT INTO user_groups_perms (user_group_id, controller_allowed, action_allowed, created_by, created_on)
SELECT g.c0d, 'Projects', a.act, 0, NOW()
FROM (
    SELECT 'goodsAddItemAj'          AS act UNION ALL
    SELECT 'goodsRemoveItemAj'              UNION ALL
    SELECT 'goodsSubmitOnboardingAj'
) a
CROSS JOIN user_groups g
WHERE g.user_group_name IN ('CRM','Administrator')
  AND NOT EXISTS (
    SELECT 1 FROM user_groups_perms p
    WHERE p.user_group_id = g.c0d
      AND p.controller_allowed = 'Projects'
      AND p.action_allowed     = a.act
  );
