SET NAMES utf8mb4 COLLATE utf8mb4_unicode_ci;

-- 098 尚未发布时本迁移为空操作；若某个环境曾执行过早期 098（曾把四项权限都给运营岗位），
-- 这里通过角色 code、权限 code 的唯一索引和关联表主键定点撤销，不扫描任何业务数据表。
DELETE role_permission
FROM admin_role_permissions role_permission
JOIN admin_roles role ON role.id = role_permission.role_id
JOIN admin_permissions permission ON permission.id = role_permission.permission_id
WHERE role.code IN ('ops-admin', 'operations-specialist')
  AND permission.code IN (
    'external-admin-user:create',
    'external-admin-user:reset-password'
  );