-- Issue #13：在 project_all_permission 之后执行，可重复执行。
-- 项目 → 项目管理 → 四个原页面。保留页面 ID/权限及移动菜单。
-- 全部项目权限仍挂在项目一级节点，不以目录授权隐式授予业务权限。
START TRANSACTION;

INSERT INTO sys_menu (id, menu_name, parent_id, menu_type, path, component, perms,
    is_frame, visible, status, tenant_no, order_num, create_dept_id, create_time, update_time, del_flag)
SELECT MD5(CONCAT(top_menu.tenant_no, ':menu:project:management')), '项目管理', top_menu.id,
    'M', 'management', '', 'menu:project:management', 1, '1', '1', top_menu.tenant_no,
    1, '', NOW(), NOW(), 0
FROM sys_menu top_menu
WHERE top_menu.perms='menu:project' AND top_menu.del_flag=0
AND NOT EXISTS (SELECT 1 FROM sys_menu existing
    WHERE existing.tenant_no=top_menu.tenant_no AND existing.perms='menu:project:management');

UPDATE sys_menu leaf
JOIN sys_menu group_menu ON group_menu.tenant_no=leaf.tenant_no
    AND group_menu.perms='menu:project:management' AND group_menu.del_flag=0
SET leaf.parent_id=group_menu.id, leaf.update_time=NOW()
WHERE leaf.del_flag=0 AND leaf.perms IN (
    'project:team:list', 'project:project:list', 'project:statistics:list', 'project:assignment:edit');

-- 仅已有页面/编辑按钮授权的角色补齐目录、项目一级和 Web 根。
-- 只拥有全部项目选择权限的角色不增加四个管理页面的访问权限。
INSERT INTO sys_role_menu (id, role_id, menu_id, tenant_no, create_dept_id, create_time, update_time, del_flag)
SELECT DISTINCT MD5(CONCAT(grant_row.tenant_no, ':project-management-ancestor:', grant_row.role_id, ':', ancestor.id)),
    grant_row.role_id, ancestor.id, grant_row.tenant_no, '', NOW(), NOW(), 0
FROM sys_role_menu grant_row
JOIN sys_role role_row ON role_row.id=grant_row.role_id AND role_row.tenant_no=grant_row.tenant_no
    AND role_row.del_flag=0
JOIN sys_menu leaf ON leaf.id=grant_row.menu_id AND leaf.tenant_no=grant_row.tenant_no
    AND leaf.del_flag=0 AND leaf.perms IN ('project:team:list', 'project:project:list',
        'project:statistics:list', 'project:assignment:edit', 'project:team:edit', 'project:project:edit')
JOIN sys_menu group_menu ON group_menu.tenant_no=grant_row.tenant_no
    AND group_menu.perms='menu:project:management' AND group_menu.del_flag=0
JOIN sys_menu top_menu ON top_menu.id=group_menu.parent_id AND top_menu.tenant_no=grant_row.tenant_no
    AND top_menu.perms='menu:project' AND top_menu.del_flag=0
JOIN sys_menu ancestor ON ancestor.tenant_no=grant_row.tenant_no AND ancestor.del_flag=0
    AND ancestor.id IN (group_menu.id, top_menu.id, top_menu.parent_id)
WHERE grant_row.del_flag=0
AND NOT EXISTS (SELECT 1 FROM sys_role_menu existing
    WHERE existing.tenant_no=grant_row.tenant_no AND existing.role_id=grant_row.role_id
        AND existing.menu_id=ancestor.id AND existing.del_flag=0)
ON DUPLICATE KEY UPDATE del_flag=0, update_time=NOW();

COMMIT;