-- +goose Up

-- 新增“人工实名认证”权限：第三方实名服务不可用或异常时，
-- 由后台用户管理补录已核验的实名信息。
INSERT INTO permissions (code, name, resource, action) VALUES
('user:manual_realname', '人工实名认证', 'user', 'manual_realname')
ON DUPLICATE KEY UPDATE
  name = VALUES(name),
  resource = VALUES(resource),
  action = VALUES(action);

-- super_admin 拥有全部权限，补授新权限。
INSERT IGNORE INTO role_permissions (role_id, permission_id)
SELECT r.id, p.id FROM roles r, permissions p
WHERE r.code = 'super_admin' AND p.code = 'user:manual_realname';

-- ops（运营）负责用户管理，授予人工实名权限。
INSERT IGNORE INTO role_permissions (role_id, permission_id)
SELECT r.id, p.id FROM roles r, permissions p
WHERE r.code = 'ops' AND p.code = 'user:manual_realname';

-- +goose Down

DELETE rp FROM role_permissions rp
JOIN permissions p ON p.id = rp.permission_id
WHERE p.code = 'user:manual_realname';

DELETE FROM permissions WHERE code = 'user:manual_realname';