"""role column on users for the /admin panel (Stage 5).

Revision ID: 0004
Revises: 0003
Create Date: 2026-08-13

Adds a non-null `role` column (default 'user') constrained to ('user','admin').
The admin panel gate (settings.admin_required_role) matches this value. Existing
rows back-fill to 'user' via the server_default; admin accounts are promoted
manually (`UPDATE users SET role='admin' WHERE email=...`).
"""

from __future__ import annotations

from collections.abc import Sequence

import sqlalchemy as sa
from alembic import op

# revision identifiers, used by Alembic.
revision: str = "0004"
down_revision: str | None = "0003"
branch_labels: str | Sequence[str] | None = None
depends_on: str | Sequence[str] | None = None


def upgrade() -> None:
    op.add_column(
        "users",
        sa.Column("role", sa.String(), nullable=False, server_default=sa.text("'user'")),
    )
    op.create_check_constraint("users_role_check", "users", "role IN ('user','admin')")
    op.create_index("users_role_idx", "users", ["role"])


def downgrade() -> None:
    op.drop_index("users_role_idx", table_name="users")
    op.drop_constraint("users_role_check", "users", type_="check")
    op.drop_column("users", "role")