INSERT INTO users (tenant_id, full_name, email, password_hash, role, status, mfa_enabled)
SELECT t.id, 'QA Admin', 'qa.admin@demo.local', '$2y$10$x3XGuIH38L9oYA0XUDWPc.K5VzTpzTfBaXHaqKVLMel8Bauw54hG6', 'admin', 'active', 0
FROM tenants t
WHERE t.slug = 'demo'
ON DUPLICATE KEY UPDATE full_name = VALUES(full_name), role = VALUES(role), status = VALUES(status);

INSERT INTO users (tenant_id, full_name, email, password_hash, role, status, mfa_enabled)
SELECT t.id, 'QA Manager', 'qa.manager@demo.local', '$2y$10$x3XGuIH38L9oYA0XUDWPc.K5VzTpzTfBaXHaqKVLMel8Bauw54hG6', 'manager', 'active', 0
FROM tenants t
WHERE t.slug = 'demo'
ON DUPLICATE KEY UPDATE full_name = VALUES(full_name), role = VALUES(role), status = VALUES(status);

INSERT INTO users (tenant_id, full_name, email, password_hash, role, status, mfa_enabled)
SELECT t.id, 'QA Agent', 'qa.agent@demo.local', '$2y$10$x3XGuIH38L9oYA0XUDWPc.K5VzTpzTfBaXHaqKVLMel8Bauw54hG6', 'agent', 'active', 0
FROM tenants t
WHERE t.slug = 'demo'
ON DUPLICATE KEY UPDATE full_name = VALUES(full_name), role = VALUES(role), status = VALUES(status);

INSERT INTO users (tenant_id, full_name, email, password_hash, role, status, mfa_enabled)
SELECT t.id, 'QA Viewer', 'qa.viewer@demo.local', '$2y$10$x3XGuIH38L9oYA0XUDWPc.K5VzTpzTfBaXHaqKVLMel8Bauw54hG6', 'viewer', 'active', 0
FROM tenants t
WHERE t.slug = 'demo'
ON DUPLICATE KEY UPDATE full_name = VALUES(full_name), role = VALUES(role), status = VALUES(status);

INSERT INTO teams (tenant_id, name, description)
SELECT t.id, 'QA Ventas Norte', 'Equipo QA para pruebas de jerarquia'
FROM tenants t
WHERE t.slug = 'demo'
ON DUPLICATE KEY UPDATE description = VALUES(description);

INSERT INTO teams (tenant_id, name, description)
SELECT t.id, 'QA Ventas Sur', 'Subequipo QA para pruebas de jerarquia'
FROM tenants t
WHERE t.slug = 'demo'
ON DUPLICATE KEY UPDATE description = VALUES(description);

UPDATE teams parent
JOIN teams child ON child.tenant_id = parent.tenant_id AND child.name = 'QA Ventas Sur'
SET child.parent_team_id = parent.id
WHERE parent.name = 'QA Ventas Norte';

INSERT INTO team_user (tenant_id, team_id, user_id, team_role)
SELECT t.id, tm.id, u.id, 'lead'
FROM tenants t
JOIN teams tm ON tm.tenant_id = t.id AND tm.name = 'QA Ventas Norte'
JOIN users u ON u.tenant_id = t.id AND u.email = 'qa.manager@demo.local'
WHERE t.slug = 'demo'
ON DUPLICATE KEY UPDATE team_role = VALUES(team_role);

INSERT INTO team_user (tenant_id, team_id, user_id, team_role)
SELECT t.id, tm.id, u.id, 'member'
FROM tenants t
JOIN teams tm ON tm.tenant_id = t.id AND tm.name = 'QA Ventas Sur'
JOIN users u ON u.tenant_id = t.id AND u.email = 'qa.agent@demo.local'
WHERE t.slug = 'demo'
ON DUPLICATE KEY UPDATE team_role = VALUES(team_role);

INSERT INTO custom_roles (tenant_id, code, name, is_active, created_by)
SELECT t.id, 'qa_limited_editor', 'QA Limited Editor', 1, owner_u.id
FROM tenants t
JOIN users owner_u ON owner_u.tenant_id = t.id AND owner_u.role = 'owner'
WHERE t.slug = 'demo'
LIMIT 1
ON DUPLICATE KEY UPDATE name = VALUES(name), is_active = VALUES(is_active);

INSERT INTO custom_role_permissions (custom_role_id, module_name, action_name, field_name, is_allowed, condition_json)
SELECT cr.id, 'pipeline', 'create', NULL, 1, JSON_OBJECT('max_amount', 5000)
FROM custom_roles cr
JOIN tenants t ON t.id = cr.tenant_id
WHERE t.slug = 'demo' AND cr.code = 'qa_limited_editor'
ON DUPLICATE KEY UPDATE is_allowed = VALUES(is_allowed), condition_json = VALUES(condition_json);

INSERT INTO user_custom_roles (tenant_id, user_id, custom_role_id)
SELECT t.id, u.id, cr.id
FROM tenants t
JOIN users u ON u.tenant_id = t.id AND u.email = 'qa.agent@demo.local'
JOIN custom_roles cr ON cr.tenant_id = t.id AND cr.code = 'qa_limited_editor'
WHERE t.slug = 'demo'
ON DUPLICATE KEY UPDATE custom_role_id = VALUES(custom_role_id);

INSERT INTO user_data_scopes (tenant_id, user_id, module_name, scope_type)
SELECT t.id, u.id, 'contacts', 'team'
FROM tenants t
JOIN users u ON u.tenant_id = t.id AND u.email = 'qa.manager@demo.local'
WHERE t.slug = 'demo'
ON DUPLICATE KEY UPDATE scope_type = VALUES(scope_type);

INSERT INTO role_permissions (tenant_id, role, module_name, action_name, field_name, is_allowed)
SELECT t.id, 'viewer', 'contacts', 'edit', NULL, 0
FROM tenants t
WHERE t.slug = 'demo'
ON DUPLICATE KEY UPDATE is_allowed = VALUES(is_allowed);

INSERT INTO field_permissions (tenant_id, role, module_name, field_name, visibility, editable)
SELECT t.id, 'viewer', 'contacts', 'email', 'hidden', 0
FROM tenants t
WHERE t.slug = 'demo'
ON DUPLICATE KEY UPDATE visibility = VALUES(visibility), editable = VALUES(editable);
