BEGIN;

-- =========================
-- Departments (as requested)
-- =========================
-- Root org namespace is "eslogad" in ltree path
INSERT INTO departments (name, code, path) VALUES
                                               ('RENBINMINLOG', 'renbinminlog', 'eslogad.renbinminlog'),
                                               ('FASKON BMN',   'faskon_bmn',   'eslogad.faskon_bmn'),
                                               ('BEKPALKES',    'bekpalkes',    'eslogad.bekpalkes')
    ON CONFLICT (code) DO UPDATE
                              SET name = EXCLUDED.name,
                              path = EXCLUDED.path,
                              updated_at = CURRENT_TIMESTAMP;

-- =========================
-- Positions (hierarchy)
-- =========================
-- Conventions:
-- - superadmin is a separate root
-- - eslogad.aslog is head; waaslog_* under aslog
-- - paban_* under each waaslog_*; pabandya_* under its paban_*
INSERT INTO positions (name, code, path) VALUES
                                             -- ROOTS
                                             ('SUPERADMIN',                  'superadmin',                 'superadmin'),
                                             ('ASLOG',                       'aslog',                      'eslogad.aslog'),

                                             -- WAASLOG under ASLOG
                                             ('WAASLOG RENBINMINLOG',        'waaslogrenbinminlog',        'eslogad.aslog.waaslog_renbinminlog'),
                                             ('WAASLOG FASKON BMN',          'waaslogfaskonbmn',           'eslogad.aslog.waaslog_faskon_bmn'),
                                             ('WAASLOG BEKPALKES',           'waaslogbekpalkes',           'eslogad.aslog.waaslog_bekpalkes'),

                                             -- Other posts directly under ASLOG
                                             ('KADISADAAD',                  'kadisadaad',                 'eslogad.aslog.kadisadaad'),
                                             ('KATUUD',                      'katuud',                     'eslogad.aslog.katuud'),
                                             ('SPRI',                        'spri',                       'eslogad.aslog.spri'),

                                             -- PABAN under WAASLOG RENBINMINLOG
                                             ('PABAN I/REN',                 'paban-I-ren',                'eslogad.aslog.waaslog_renbinminlog.paban_I_ren'),
                                             ('PABAN II/BINMINLOG',          'paban-II-binminlog',         'eslogad.aslog.waaslog_renbinminlog.paban_II_binminlog'),

                                             -- PABAN under WAASLOG FASKON BMN
                                             ('PABAN III/FASKON',            'paban-III-faskon',           'eslogad.aslog.waaslog_faskon_bmn.paban_III_faskon'),
                                             ('PABAN IV/BMN',                'paban-iv-bmn',               'eslogad.aslog.waaslog_faskon_bmn.paban_IV_bmn'),

                                             -- PABAN under WAASLOG BEKPALKES
                                             ('PABAN V/BEK',                 'paban-v-bek',                'eslogad.aslog.waaslog_bekpalkes.paban_V_bek'),
                                             ('PABAN VI/ALPAL',              'paban-vi-alpal',             'eslogad.aslog.waaslog_bekpalkes.paban_VI_alpal'),
                                             ('PABAN VII/KES',               'paban-vii-kes',              'eslogad.aslog.waaslog_bekpalkes.paban_VII_kes'),

                                             -- PABANDYA under PABAN I/REN
                                             ('PABANDYA 1 / RENPROGGAR',     'pabandya-1-renproggar',      'eslogad.aslog.waaslog_renbinminlog.paban_I_ren.pabandya_1_renproggar'),
                                             ('PABANDYA 2 / DALWASGAR',      'pabandya-2-dalwasgar',       'eslogad.aslog.waaslog_renbinminlog.paban_I_ren.pabandya_2_dalwasgar'),
                                             ('PABANDYA 3 / ANEVDATA',       'pabandya-3-anevdata',        'eslogad.aslog.waaslog_renbinminlog.paban_I_ren.pabandya_3_anevdata'),

                                             -- PABANDYA under PABAN II/BINMINLOG
                                             ('PABANDYA 1 / MINLOG',         'pabandya-1-minlog',          'eslogad.aslog.waaslog_renbinminlog.paban_II_binminlog.pabandya_1_minlog'),
                                             ('PABANDYA 2 / HIBAHKOD',       'pabandya-2-hibahkod',        'eslogad.aslog.waaslog_renbinminlog.paban_II_binminlog.pabandya_2_hibahkod'),
                                             ('PABANDYA 3 / PUSMAT',         'pabandya-3-pusmat',          'eslogad.aslog.waaslog_renbinminlog.paban_II_binminlog.pabandya_3_pusmat'),

                                             -- PABANDYA under PABAN IV/BMN
                                             ('PABANDYA 1 / TANAH',          'pabandya-1-tanah',           'eslogad.aslog.waaslog_faskon_bmn.paban_IV_bmn.pabandya_1_tanah'),
                                             ('PABANDYA 2 / PANGKALAN KONSTRUKSI','pabandya-2-pangkalankonstruksi','eslogad.aslog.waaslog_faskon_bmn.paban_IV_bmn.pabandya_2_pangkalan_konstruksi'),
                                             ('PABANDYA 3 / FASMATZI',       'pabandya-3-fasmatzi',        'eslogad.aslog.waaslog_faskon_bmn.paban_IV_bmn.pabandya_3_fasmatzi'),

                                             -- PABANDYA under PABAN IV/BMN (AKUN group)
                                             ('PABANDYA 1 / AKUN BB',        'pabandya-1-akunbb',          'eslogad.aslog.waaslog_faskon_bmn.paban_IV_bmn.pabandya_1_akun_bb'),
                                             ('PABANDYA 2 / AKUN BTB',       'pabandya-2-akunbtb',         'eslogad.aslog.waaslog_faskon_bmn.paban_IV_bmn.pabandya_2_akun_btb'),
                                             ('PABANDYA 3 / SISFO BMN DAN UAKPB-KP','pabandya-3-sisfo-bmn-uakpbkp','eslogad.aslog.waaslog_faskon_bmn.paban_IV_bmn.pabandya_3_sisfo_bmn_uakpb_kp'),

                                             -- PABANDYA under PABAN III/FASKON
                                             ('PABANDYA 1 / JATOPTIKMU',     'pabandya-1-jatoptikmu',      'eslogad.aslog.waaslog_faskon_bmn.paban_III_faskon.pabandya_1_jatoptikmu'),
                                             ('PABANDYA 2 / RANTEKMEK',      'pabandya-2-rantekmek',       'eslogad.aslog.waaslog_faskon_bmn.paban_III_faskon.pabandya_2_rantekmek'),
                                             ('PABANDYA 3 / ALHUBTOPPALSUS', 'pabandya-3-alhubtoppalsus',  'eslogad.aslog.waaslog_faskon_bmn.paban_III_faskon.pabandya_3_alhubtoppalsus'),
                                             ('PABANDYA 4 / PESUD',          'pabandya-4-pesud',           'eslogad.aslog.waaslog_faskon_bmn.paban_III_faskon.pabandya_4_pesud'),

                                             -- PABANDYA under PABAN VII/KES
                                             ('PABANDYA 1 / BEKKES',         'pabandya-1-bekkes',          'eslogad.aslog.waaslog_bekpalkes.paban_VII_kes.pabandya_1_bekkes'),
                                             ('PABANDYA 2 / ALKES',          'pabandya-2-alkes',           'eslogad.aslog.waaslog_bekpalkes.paban_VII_kes.pabandya_2_alkes')
    ON CONFLICT (code) DO UPDATE
                              SET name = EXCLUDED.name,
                              path = EXCLUDED.path,
                              updated_at = CURRENT_TIMESTAMP;

-- =========================
-- SUPERADMIN role (minimal)
-- =========================
INSERT INTO roles (name, code, description) VALUES
                                                ('SUPERADMIN', 'superadmin', 'Full system access and management'),
                                                ('ADMIN',      'admin',      'Manage users, letters, and settings within their department'),
                                                ('HEAD',       'head',       'Approve outgoing letters and manage dispositions in their department'),
                                                ('STAFF',      'staff',      'Create letters, process assigned dispositions')
    ON CONFLICT (code) DO UPDATE
                              SET name = EXCLUDED.name,
                              description = EXCLUDED.description,
                              updated_at = CURRENT_TIMESTAMP;

-- =========================
-- Users (seed 1 superadmin)
-- =========================
-- Replace the plaintext password as needed; pgcrypto hashes it with bcrypt.
INSERT INTO users (username, password_hash, name, email, status, is_active)
VALUES ('superadmin',
        crypt('ChangeMe!Super#123', gen_salt('bf')),
        'Super Admin',
        'superadmin@example.com',
        'active',
        TRUE)
    ON CONFLICT (username) DO UPDATE
                                  SET name = EXCLUDED.name,
                                  email = EXCLUDED.email,
                                  status = EXCLUDED.status,
                                  is_active = EXCLUDED.is_active,
                                  updated_at = CURRENT_TIMESTAMP;

-- =========================
-- Link: SUPERADMIN user ↔ role ↔ position
-- =========================
WITH u AS (SELECT id FROM users WHERE username = 'superadmin'),
     r AS (SELECT id FROM roles  WHERE code = 'superadmin'),
     p AS (SELECT id FROM positions WHERE code = 'superadmin')
INSERT INTO user_role (user_id, role_id)
SELECT u.id, r.id FROM u, r
    ON CONFLICT (user_id, role_id) WHERE removed_at IS NULL DO NOTHING;

WITH u AS (SELECT id FROM users WHERE username = 'superadmin'),
     p AS (SELECT id FROM positions WHERE code = 'superadmin')
INSERT INTO user_position (user_id, position_id)
SELECT u.id, p.id FROM u, p
    ON CONFLICT (user_id, position_id) WHERE removed_at IS NULL DO NOTHING;

COMMIT;