Files
saqel/backend/migrations/20260908_secure_identity_and_staff.sql
T

53 lines
2.8 KiB
SQL

ALTER TABLE `students`
DROP INDEX `national_id`,
DROP INDEX `idx_students_national_id`,
MODIFY `national_id` TEXT NOT NULL,
ADD COLUMN `national_id_hash` CHAR(64) NULL AFTER `national_id`,
ADD INDEX `idx_students_national_id_hash` (`national_id_hash`),
MODIFY `readiness_score` DECIMAL(5,2) NOT NULL DEFAULT 0.00;
ALTER TABLE `school_rosters`
DROP INDEX `idx_school_national_id`,
DROP INDEX `idx_roster_national_id`,
MODIFY `national_id` TEXT NOT NULL,
ADD COLUMN `national_id_hash` CHAR(64) NULL AFTER `national_id`,
ADD INDEX `idx_roster_national_id_hash` (`national_id_hash`);
-- Backfill national_id_hash from the application before making these columns
-- NOT NULL and UNIQUE. The encryption key must remain the production key.
CREATE TABLE IF NOT EXISTS `staff_accounts` (
`id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
`uuid` CHAR(36) NOT NULL UNIQUE,
`identity_id` BIGINT UNSIGNED NOT NULL,
`full_name` VARCHAR(255) NOT NULL,
`role` ENUM('school_admin', 'directorate_admin', 'supervisor', 'super_admin') NOT NULL,
`school_id` BIGINT UNSIGNED DEFAULT NULL,
`directorate_id` BIGINT UNSIGNED DEFAULT NULL,
`status` ENUM('active', 'suspended') NOT NULL DEFAULT 'active',
`created_at` TIMESTAMP NULL DEFAULT CURRENT_TIMESTAMP,
`updated_at` TIMESTAMP NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
PRIMARY KEY (`id`),
UNIQUE KEY `idx_staff_identity_role` (`identity_id`, `role`),
KEY `idx_staff_school` (`school_id`),
KEY `idx_staff_directorate` (`directorate_id`),
CONSTRAINT `fk_staff_identity` FOREIGN KEY (`identity_id`) REFERENCES `auth_identities` (`id`) ON DELETE CASCADE,
CONSTRAINT `fk_staff_school` FOREIGN KEY (`school_id`) REFERENCES `schools` (`id`) ON DELETE SET NULL,
CONSTRAINT `fk_staff_directorate` FOREIGN KEY (`directorate_id`) REFERENCES `directorates` (`id`) ON DELETE SET NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
CREATE TABLE IF NOT EXISTS `guardian_link_requests` (
`id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
`uuid` CHAR(36) NOT NULL UNIQUE,
`guardian_id` BIGINT UNSIGNED NOT NULL,
`student_id` BIGINT UNSIGNED NOT NULL,
`relationship_type` ENUM('father', 'mother', 'brother', 'guardian') NOT NULL DEFAULT 'guardian',
`status` ENUM('pending', 'approved', 'rejected', 'cancelled') NOT NULL DEFAULT 'pending',
`reviewed_at` TIMESTAMP NULL DEFAULT NULL,
`created_at` TIMESTAMP NULL DEFAULT CURRENT_TIMESTAMP,
PRIMARY KEY (`id`),
UNIQUE KEY `uq_guardian_link_pending` (`guardian_id`, `student_id`, `status`),
CONSTRAINT `fk_link_request_guardian` FOREIGN KEY (`guardian_id`) REFERENCES `guardians` (`id`) ON DELETE CASCADE,
CONSTRAINT `fk_link_request_student` FOREIGN KEY (`student_id`) REFERENCES `students` (`id`) ON DELETE CASCADE
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;