-- Slice 8X · perms
-- 1) pricingPdf perms mirror pricingXlsx so CRM (and PC/PM/FM/Exec/Admin) can download the PDF too.
-- 2) saveContractTermsAj extended to CRM + Executive so CRM can start the handoff (assign FM) and Exec can
--    edit at approval time. Per-role RBAC on the seat columns is enforced inside the model — CRM can only
--    touch assigned_fm_user_id; other seats remain read-only for them.

INSERT INTO user_groups_perms (user_group_id, controller_allowed, action_allowed, created_by, created_on)
SELECT g.c0d, 'Tenders', 'pricingPdf', 0, NOW()
FROM user_groups g
JOIN (SELECT DISTINCT user_group_id FROM user_groups_perms
      WHERE controller_allowed='Tenders' AND action_allowed='pricingXlsx') w
     ON w.user_group_id = g.c0d
WHERE NOT EXISTS (
    SELECT 1 FROM user_groups_perms p
    WHERE p.user_group_id = g.c0d
      AND p.controller_allowed='Tenders'
      AND p.action_allowed='pricingPdf'
);

INSERT INTO user_groups_perms (user_group_id, controller_allowed, action_allowed, created_by, created_on)
SELECT g.c0d, 'Tenders', 'saveContractTermsAj', 0, NOW()
FROM user_groups g
WHERE g.user_group_name IN ('CRM','Executive')
  AND NOT EXISTS (
    SELECT 1 FROM user_groups_perms p
    WHERE p.user_group_id = g.c0d
      AND p.controller_allowed='Tenders'
      AND p.action_allowed='saveContractTermsAj'
);
