<?php

use Illuminate\Database\Migrations\Migration;
use Spatie\Permission\Models\Permission;
use Spatie\Permission\Models\Role;
use Spatie\Permission\PermissionRegistrar;

/**
 * `vpn.manage` — create, block and delete VPN accesses. Granted to Owner and
 * Admin only: a VPN access reaches the management network, so it is a stronger
 * capability than the customer-facing ones Support/Billing hold.
 */
return new class extends Migration
{
    public function up(): void
    {
        app(PermissionRegistrar::class)->forgetCachedPermissions();

        Permission::findOrCreate('vpn.manage', 'web');
        foreach (['Owner', 'Admin'] as $role) {
            Role::findOrCreate($role, 'web')->givePermissionTo('vpn.manage');
        }

        app(PermissionRegistrar::class)->forgetCachedPermissions();
    }

    public function down(): void
    {
        app(PermissionRegistrar::class)->forgetCachedPermissions();
        Permission::query()->where('name', 'vpn.manage')->delete();
        app(PermissionRegistrar::class)->forgetCachedPermissions();
    }
};
