-- Slice 7A · Grant Finance Manager read on the CRM entities so they can see the pipeline
-- Executive already has these. Idempotent.
INSERT INTO user_groups_perms (user_group_id, controller_allowed, action_allowed, created_by, created_on)
SELECT g.c0d, ctrl, act, 0, NOW()
FROM (
    SELECT 'BusinessLeads' AS ctrl, 'index' AS act UNION ALL
    SELECT 'BusinessLeads', 'view'                 UNION ALL
    SELECT 'BdmPlans',      'index'                UNION ALL
    SELECT 'BdmPlans',      'view'                 UNION ALL
    SELECT 'NestTenders',   'index'                UNION ALL
    SELECT 'NestTenders',   'view'
) c
CROSS JOIN user_groups g
WHERE g.user_group_name = 'Finance Manager'
  AND NOT EXISTS (
    SELECT 1 FROM user_groups_perms p
     WHERE p.user_group_id = g.c0d
       AND p.controller_allowed = c.ctrl
       AND p.action_allowed = c.act
  );
