Domain Admin

backend/migrations/002_admin_users_self_service.sql

@@ -0,0 +1,26 @@
+-- ============================================================
+-- 002_admin_users_self_service.sql
+-- Phase 2: Domain-Admin support.
+--
+-- The admin_users table already has all required columns from 001_init.sql:
+--   - role TEXT NOT NULL DEFAULT 'super_admin'
+--   - allowed_domains TEXT[] NOT NULL DEFAULT '{}'
+--   - active BOOLEAN NOT NULL DEFAULT true
+--
+-- This migration just adds a check constraint on role and an index
+-- for fast role/active lookups.
+-- ============================================================
+
+-- Drop any old/legacy variants of the constraint to make this migration
+-- idempotent across environments.
+ALTER TABLE admin_users DROP CONSTRAINT IF EXISTS admin_users_role_chk;
+ALTER TABLE admin_users DROP CONSTRAINT IF EXISTS admin_users_role_check;
+
+-- Reapply the canonical check constraint.
+ALTER TABLE admin_users
+  ADD CONSTRAINT admin_users_role_check
+  CHECK (role IN ('super_admin', 'domain_admin'));
+
+-- Useful index for role-based filtering.
+CREATE INDEX IF NOT EXISTS idx_admin_users_role_active
+  ON admin_users(role, active);