-- 061_doc_permissions.sql — Permessi documentali profilabili per ruolo (org-scoped).
-- Matrice Ruolo x Azione del ciclo di vita documenti ISMS (Impostazioni > Permessi documentali).
-- Apply autoritativo idempotente: application/cli/migrate_061_doc_permissions.php
-- Default (se nessun override): edit/submit/approve/publish/reject/archive/new_version =
--   org_admin, compliance_manager, board_member. super_admin sempre consentito.

CREATE TABLE IF NOT EXISTS isms_doc_permissions (
  id INT AUTO_INCREMENT PRIMARY KEY,
  organization_id INT NOT NULL,
  capability VARCHAR(20) NOT NULL,   -- edit|submit|approve|publish|reject|archive|new_version
  role VARCHAR(30) NOT NULL,         -- org_admin|compliance_manager|board_member|auditor|employee|consultant
  allowed TINYINT(1) NOT NULL DEFAULT 1,
  updated_at DATETIME NULL,
  UNIQUE KEY uk_docperm (organization_id, capability, role),
  INDEX idx_docperm_org (organization_id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;