-- v1.1.8 F3 — extend topics.auth_mode CHECK to allow 'session'.
--
-- v1.1.6 shipped 'public' + 'token'. v1.1.8 adds 'session' so a
-- topic can authorize SSE subscribers against a per-app user session
-- minted by users::login. The realtime authority delegates verify to
-- UsersService::verify_session_for_realtime, which returns the user
-- on success; the subscription proceeds with that principal.
--
-- 'script' (v1.2 script-mediated subscribe auth) extends the
-- constraint a third time later.

ALTER TABLE topics DROP CONSTRAINT IF EXISTS topics_auth_mode_check;
ALTER TABLE topics ADD CONSTRAINT topics_auth_mode_check
    CHECK (auth_mode IN ('public', 'token', 'session'));
