-- Ops-E: RBAC role · user status check · push_jobs stub

ALTER TABLE admin_accounts
  ADD COLUMN IF NOT EXISTS role varchar(16) NOT NULL DEFAULT 'super';

ALTER TABLE admin_accounts
  DROP CONSTRAINT IF EXISTS admin_accounts_role_check;

ALTER TABLE admin_accounts
  ADD CONSTRAINT admin_accounts_role_check
  CHECK (role IN ('super', 'ops'));

UPDATE admin_accounts SET role = 'super' WHERE role IS NULL OR role = '';

ALTER TABLE users
  DROP CONSTRAINT IF EXISTS users_status_check;

ALTER TABLE users
  ADD CONSTRAINT users_status_check
  CHECK (status IN ('active', 'banned'));

CREATE TABLE IF NOT EXISTS push_jobs (
  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
  title varchar(128) NOT NULL,
  body text NOT NULL DEFAULT '',
  audience varchar(64) NOT NULL DEFAULT 'all',
  status varchar(32) NOT NULL DEFAULT 'draft',
  created_by uuid NOT NULL REFERENCES admin_accounts(id),
  created_at timestamptz NOT NULL DEFAULT now(),
  updated_at timestamptz NOT NULL DEFAULT now(),
  CONSTRAINT push_jobs_status_check CHECK (status IN ('draft', 'cancelled'))
);

CREATE INDEX IF NOT EXISTS idx_push_jobs_created ON push_jobs(created_at DESC);