insert into staff_roles (code, name, description, default_entry, status, permissions, role_family, role_level, sort_order, is_system)
values (
  'system_admin',
  '系统运维管理员',
  '负责系统状态、异常中心、组织权限、用户和会员状态运维。',
  '/admin/system',
  'active',
  array[
    'operations:read',
    'operations:write',
    'user:read',
    'user:write',
    'membership_subscription:read',
    'membership_subscription:update',
    'staff:read',
    'staff:write',
    'role:read',
    'role:write',
    'org:read',
    'org:write',
    'audit:read'
  ]::text[],
  'system',
  30,
  30,
  true
)
on conflict (code) do update set
  name = excluded.name,
  description = excluded.description,
  default_entry = excluded.default_entry,
  status = excluded.status,
  permissions = excluded.permissions,
  role_family = excluded.role_family,
  role_level = excluded.role_level,
  sort_order = excluded.sort_order,
  is_system = excluded.is_system,
  updated_at = now();

update staff_roles
set permissions = array(
  select distinct unnest(permissions || array[
    'membership_subscription:read',
    'membership_subscription:update'
  ]::text[])
),
updated_at = now()
where code in ('super_admin', 'operations_admin');

update staff_roles
set description = '负责商品、数据页面、优惠码、专家审核、活动报名、合作咨询、会员状态和订单只读。',
updated_at = now()
where code = 'operations_admin';
