<?php
/**
 * migrate_061_doc_permissions.php — Permessi documentali profilabili per ruolo (org-scoped).
 * Tabella matrice Ruolo x Azione del ciclo di vita documenti ISMS. IDEMPOTENTE.
 */
if (PHP_SAPI !== 'cli') { http_response_code(403); exit("CLI only\n"); }
require_once __DIR__ . '/../config/env.php';
require_once __DIR__ . '/../config/database.php';
$pdo = Database::getInstance();
$pdo->exec("CREATE TABLE IF NOT EXISTS isms_doc_permissions (
  id INT AUTO_INCREMENT PRIMARY KEY,
  organization_id INT NOT NULL,
  capability VARCHAR(20) NOT NULL,
  role VARCHAR(30) NOT NULL,
  allowed TINYINT(1) NOT NULL DEFAULT 1,
  updated_at DATETIME NULL,
  UNIQUE KEY uk_docperm (organization_id, capability, role),
  INDEX idx_docperm_org (organization_id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4");
echo "Migrazione 061 — tabella isms_doc_permissions OK. Prossima mig=062.\n";