-- Pacific Logistics · slice 33 · P9 annual PAYE certificate
--
-- Grants only. Anyone who can render a payslip can render a P9.
-- Mobile access is via /Api/myP9 which needs no perm row (bearer auth).

INSERT IGNORE INTO user_groups_perms (user_group_id, controller_allowed, action_allowed, created_by, created_on) VALUES
-- Executive (1) — read
(1,  'Payroll', 'p9',       1, NOW()),
(1,  'Payroll', 'p9Batch',  1, NOW()),
-- Finance Manager (2)
(2,  'Payroll', 'p9',       1, NOW()),
(2,  'Payroll', 'p9Batch',  1, NOW()),
-- Accountant (3)
(3,  'Payroll', 'p9',       1, NOW()),
(3,  'Payroll', 'p9Batch',  1, NOW()),
-- HR Officer (24)
(24, 'Payroll', 'p9',       1, NOW()),
(24, 'Payroll', 'p9Batch',  1, NOW()),
-- Administrator (10)
(10, 'Payroll', 'p9',       1, NOW()),
(10, 'Payroll', 'p9Batch',  1, NOW());

SELECT ug.user_group_name, GROUP_CONCAT(ugp.action_allowed ORDER BY ugp.action_allowed) AS actions
  FROM user_groups_perms ugp
  JOIN user_groups ug ON ug.c0d = ugp.user_group_id
 WHERE ugp.controller_allowed = 'Payroll'
   AND ugp.action_allowed IN ('p9', 'p9Batch')
 GROUP BY ug.c0d, ug.user_group_name;
