-- The WEB (Website/CMS) module was added to AppModule.java after the Enterprise plan's
-- `modules` seed data was written, so ModuleAccessFilter rejects every /api/web/** request
-- with 403 MODULE_ACCESS_DENIED for every tenant, regardless of role — TENANT_ADMIN included.
-- This adds "WEB" to any plan missing it. Idempotent (JSON_CONTAINS-guarded), additive only.
-- Deploy: mysql -u root -p db_abos_v0.1 < db/fix_enterprise_plan_missing_web_module.sql

USE db_abos_v0.1;

UPDATE dim_subscription_plans
SET modules = JSON_ARRAY_APPEND(modules, '$', 'WEB')
WHERE NOT JSON_CONTAINS(modules, '"WEB"');