-- Fixes: a staff-role employee scheduled for MOD duty never sees the
-- Manager on Duty module in their sidebar, even while actively on duty.
--
-- Root cause: the MOD module's nav_module_roles grant only included
-- admin/superadmin/manager/supervisor/hr/gm. MOD access is meant to be
-- controlled entirely by WHO IS ACTUALLY ON DUTY right now (see
-- mod/includes/mod_shift_gate.php, checked in components/sidebar.php),
-- not by role -- but that real-time check only ever runs for roles that
-- already passed this base whitelist. Any role missing from the
-- whitelist is filtered out before the shift-gate logic is ever reached,
-- regardless of whether that person is genuinely scheduled and on duty.
--
-- Fix: grant every known role base access to the module. The shift-gate
-- still does the real, per-request filtering (hiding it from everyone
-- except whoever is actually on duty right now, with admin/superadmin
-- retaining their standing override) -- this migration only removes the
-- role-level wall that was preventing that check from ever running for
-- staff (and accounts/audit/opm) in the first place.
--
-- Uses INSERT IGNORE specifically so it's safe whether or not the
-- original nav migration (2026_09_14_add_nav_module_access.sql) has
-- already been run -- it only adds rows that don't already exist.

INSERT IGNORE INTO `nav_module_roles` (`module_id`, `role`)
SELECT nm.id, r.role
FROM `nav_modules` nm
CROSS JOIN (
    SELECT 'staff' AS role UNION SELECT 'accounts' UNION SELECT 'audit' UNION SELECT 'opm'
) r
WHERE nm.`module_key` = 'mod';