-- v1.1.8 User Management — per-app string-tagged roles.
--
-- v1.1.8 ships ROLE STORAGE ONLY. There is no role registry, no
-- hierarchy, no permission matrix — what "admin" / "editor" /
-- "viewer" mean is up to the script app. The `users::*` SDK
-- surfaces a Vec<String> on every AppUser record; the surrounding
-- script reads it and gates behavior accordingly.
--
-- Per-role permission matrices are a v1.2 design item (see brief);
-- pre-baking them would either cement a wrong model or force a
-- breaking change at v1.2.

CREATE TABLE app_user_roles (
    app_id      UUID NOT NULL REFERENCES apps(id) ON DELETE CASCADE,
    user_id     UUID NOT NULL REFERENCES app_users(id) ON DELETE CASCADE,
    role        TEXT NOT NULL,
    created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    PRIMARY KEY (app_id, user_id, role)
);

CREATE INDEX idx_app_user_roles_user ON app_user_roles (app_id, user_id);
