Subversion Repositories SmartDukaan

-- Migration: Demo partner access (2026-09-25)

--

-- Lets an admin tag any partner to a Sales person purely so they can open that partner's

-- dashboard / Franchise App for a demo. The binding lives ONLY in cs.demo_partner_access and is

-- read ONLY at the partner-view entry points (fofo Partner access dropdown, login-as-partner-readonly,

-- /mobileapp token; web /getPartners, /getPartnersList, /impersonate). The position mappings

-- (cs.position / cs.partner_position and CsService.getAuthUser*Mapping) are NOT touched, so no

-- performance, target, report or cron figure changes.

--

-- A grant is active while revoked_at IS NULL. Revoke stamps revoked_at/revoked_by (history kept);

-- re-granting after a revoke inserts a new row.

CREATE TABLE IF NOT EXISTS cs.demo_partner_access (

    id           INT         NOT NULL AUTO_INCREMENT,

    auth_user_id INT         NOT NULL,

    fofo_id      INT         NOT NULL,

    created_by   INT         NOT NULL,

    created_at   DATETIME    NOT NULL,

    revoked_by   INT         NULL,

    revoked_at   DATETIME    NULL,

    PRIMARY KEY (id),

    KEY idx_demo_partner_access_auth_user (auth_user_id, revoked_at),

    KEY idx_demo_partner_access_fofo (fofo_id)

) ENGINE = InnoDB DEFAULT CHARSET = utf8;

-- Menu "Demo Partner Access" under Admin Control (id=176), next to "Partner access" (92).

-- Deliberately NOT copied from menu 92: that one is visible to Sales, who must not grant to themselves.

INSERT INTO auth.menu (display_text, description, parent_menu_id, sequence, action_class, icon_class)

SELECT 'Demo Partner Access',

       'Grant / revoke demo dashboard access to partners for Sales team',

       176,

       COALESCE((SELECT MAX(sequence) FROM auth.menu WHERE parent_menu_id = 176), 0) + 1,

       'demo-partner-access',

       NULL

WHERE NOT EXISTS (SELECT 1 FROM auth.menu WHERE action_class = 'demo-partner-access');

-- Who sees it (same rule as the sidebar, AdminUser.adminPanel, and the server guard DemoPartnerAccessService.canManage):

-- AdminUser.ALL_MENU_EMAILS and every L5 position holder see all menus anyway; beyond them, the

-- menu_category rows below. escalation_type here is the EscalationType ORDINAL ('3' = L4), the same

-- Business Intelligence mapping 70 other menus use. Add rows to widen who can manage grants.

INSERT INTO auth.menu_category (menu_id, category_id, escalation_type)

SELECT m.id, 19, '3'

FROM auth.menu m

WHERE m.action_class = 'demo-partner-access'

  AND NOT EXISTS (SELECT 1 FROM auth.menu_category mc WHERE mc.menu_id = m.id AND mc.category_id = 19 AND mc.escalation_type = '3');

-- Verify

-- SELECT * FROM auth.menu WHERE action_class = 'demo-partner-access';

-- SELECT mc.* FROM auth.menu_category mc JOIN auth.menu m ON m.id = mc.menu_id WHERE m.action_class = 'demo-partner-access';

-- Rollback

-- DELETE mc FROM auth.menu_category mc JOIN auth.menu m ON m.id = mc.menu_id WHERE m.action_class = 'demo-partner-access';

-- DELETE FROM auth.menu WHERE action_class = 'demo-partner-access';

-- DROP TABLE cs.demo_partner_access;