BEGIN;

INSERT INTO permissions (code, description, resource, action) VALUES
('user:password:reset:any', 'Reset any user password in tenant', 'user_password', 'reset_any')
ON CONFLICT (code) DO NOTHING;

INSERT INTO role_permissions (role_id, permission_id)
SELECT r.id, p.id
FROM roles r, permissions p
WHERE r.name = 'Admin'
  AND r.is_system = TRUE
  AND p.code = 'user:password:reset:any'
ON CONFLICT DO NOTHING;

INSERT INTO role_permissions (role_id, permission_id)
SELECT r.id, p.id
FROM roles r, permissions p
WHERE r.name = 'SuperAdmin'
  AND r.tenant_id = '00000000-0000-0000-0000-000000000001'
  AND p.code = 'user:password:reset:any'
ON CONFLICT DO NOTHING;

COMMIT;