fix(estimates): allow approved estimate revocation

backend/hermes/alembic/versions/a7c3e9d4b821_add_repair_estimate_revoke_permission.py

@@ -0,0 +1,67 @@
+"""add repair estimate revoke permission
+
+Revision ID: a7c3e9d4b821
+Revises: f4a9c2d7e118
+Create Date: 2026-07-05 15:30:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision: str = "a7c3e9d4b821"
+down_revision: Union[str, Sequence[str], None] = "f4a9c2d7e118"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+PERMISSION_NAME = "repair_estimates.revoke"
+
+
+def upgrade() -> None:
+    op.execute(
+        sa.text(
+            """
+            INSERT INTO permissions (name, display_name, description, module)
+            VALUES (
+                :name,
+                'Kostenvoranschläge zurücknehmen',
+                'Freigegebene Kostenvoranschläge administrativ zurücknehmen',
+                'repair_estimates'
+            )
+            ON CONFLICT (name) DO UPDATE SET
+                display_name = excluded.display_name,
+                description = excluded.description,
+                module = excluded.module
+            """
+        ).bindparams(name=PERMISSION_NAME)
+    )
+    for role_name in ("administrator", "management"):
+        op.execute(
+            sa.text(
+                """
+                INSERT INTO role_permissions (role_id, permission_id)
+                SELECT roles.id, permissions.id
+                FROM roles, permissions
+                WHERE roles.name = :role_name
+                  AND permissions.name = :permission_name
+                ON CONFLICT DO NOTHING
+                """
+            ).bindparams(role_name=role_name, permission_name=PERMISSION_NAME)
+        )
+
+
+def downgrade() -> None:
+    op.execute(
+        sa.text(
+            """
+            DELETE FROM role_permissions
+            WHERE permission_id IN (
+                SELECT id FROM permissions WHERE name = :permission_name
+            )
+            """
+        ).bindparams(permission_name=PERMISSION_NAME)
+    )
+    op.execute(sa.text("DELETE FROM permissions WHERE name = :permission_name").bindparams(permission_name=PERMISSION_NAME))