-- Helpdesk module: assign permissions to Admin and Support roles.
-- Admin gets full access (helpdesk.access + helpdesk.settings.manage).
-- Support gets helpdesk.access only.
-- Idempotent: safe to run multiple times.

-- Admin: full helpdesk access
INSERT INTO `role_permissions` (`role_id`, `permission_id`, `created`)
SELECT r.id, p.id, NOW()
FROM roles r
JOIN permissions p ON p.`key` IN ('helpdesk.access', 'helpdesk.settings.manage')
WHERE r.description IN ('Admin', 'Administrator') OR r.id = 1
ON DUPLICATE KEY UPDATE role_id = role_id;

-- Support: helpdesk read access
INSERT INTO `role_permissions` (`role_id`, `permission_id`, `created`)
SELECT r.id, p.id, NOW()
FROM roles r
JOIN permissions p ON p.`key` = 'helpdesk.access'
WHERE r.code = 'SUPPORT'
ON DUPLICATE KEY UPDATE role_id = role_id;