24 lines
867 B
SQL
24 lines
867 B
SQL
|
-- +goose Up
|
||
|
|
-- Platform staff roles for least-privilege admin/support desk access.
|
||
|
|
-- NULL staff_role + is_platform_admin=true keeps legacy full-admin behavior.
|
||
|
|
|
||
|
|
ALTER TABLE users
|
||
|
|
ADD COLUMN IF NOT EXISTS staff_role TEXT
|
||
|
|
CHECK (staff_role IS NULL OR staff_role IN ('admin', 'developer', 'support_staff'));
|
||
|
|
|
||
|
|
CREATE INDEX IF NOT EXISTS users_staff_role_idx
|
||
|
|
ON users (staff_role)
|
||
|
|
WHERE staff_role IS NOT NULL;
|
||
|
|
|
||
|
|
COMMENT ON COLUMN users.staff_role IS
|
||
|
|
'Platform staff role: admin|developer|support_staff. NULL with is_platform_admin=true = legacy full admin.';
|
||
|
|
|
||
|
|
-- Backfill existing platform admins to explicit admin role (idempotent).
|
||
|
|
UPDATE users
|
||
|
|
SET staff_role = 'admin', updated_at = now()
|
||
|
|
WHERE is_platform_admin = true AND staff_role IS NULL;
|
||
|
|
|
||
|
|
-- +goose Down
|
||
|
|
DROP INDEX IF EXISTS users_staff_role_idx;
|
||
|
|
ALTER TABLE users DROP COLUMN IF EXISTS staff_role;
|