/**
 * Identity schema evolution: roles for RBAC (introduced by F-006).
 * Role is authorization truth and belongs with the account row.
 * Shipped as its own migration to keep ownership explicit.
 */

/** @param {import('node-pg-migrate').MigrationBuilder} pgm */
export const up = (pgm) => {
  pgm.sql(`
    ALTER TABLE identity_users
      ADD COLUMN role text NOT NULL DEFAULT 'customer'
      CHECK (role IN ('customer', 'admin'))
  `);
};

/** @param {import('node-pg-migrate').MigrationBuilder} pgm */
export const down = (pgm) => {
  pgm.sql('ALTER TABLE identity_users DROP COLUMN role');
};