// src/server/features/system/db/role_permissions.table.ts
// Role permissions table schema for dynamic permission management

import { mysqlTable, varchar, boolean, timestamp, uniqueIndex } from 'drizzle-orm/mysql-core';

/**
 * Role permissions table - stores dynamic permissions for each role
 * 
 * This table allows for dynamic permission management (PBAC - Permission-Based Access Control)
 * where permissions can be assigned to roles at runtime without code changes.
 */
export const rolePermissionsTable = mysqlTable('role_permissions', {
  id: varchar('id', { length: 36 }).primaryKey().$defaultFn(() => crypto.randomUUID()),
  role: varchar('role', { length: 50 }).notNull(),
  resource: varchar('resource', { length: 100 }).notNull(),
  action: varchar('action', { length: 50 }).notNull(),
  isEnabled: boolean('is_enabled').notNull().default(true),
  createdAt: timestamp('created_at').notNull().defaultNow(),
  updatedAt: timestamp('updated_at').notNull().defaultNow().onUpdateNow(),
}, (table) => ({
  // Unique constraint on role + resource + action to prevent duplicates
  uniqueRoleResourceAction: uniqueIndex('unique_role_resource_action').on(table.role, table.resource, table.action),
}));