-- Replace unused UserRole.viewer with admin + permissions JSON

CREATE TYPE "UserRole_new" AS ENUM ('super_admin', 'admin');

ALTER TABLE "users" ALTER COLUMN "role" DROP DEFAULT;

ALTER TABLE "users"
  ALTER COLUMN "role" TYPE "UserRole_new"
  USING (
    CASE
      WHEN "role"::text = 'viewer' THEN 'admin'::"UserRole_new"
      ELSE "role"::text::"UserRole_new"
    END
  );

DROP TYPE "UserRole";

ALTER TYPE "UserRole_new" RENAME TO "UserRole";

ALTER TABLE "users" ALTER COLUMN "role" SET DEFAULT 'super_admin'::"UserRole";

ALTER TABLE "users" ADD COLUMN IF NOT EXISTS "permissions" JSONB NOT NULL DEFAULT '[]';

-- Existing managers keep full access
UPDATE "users" SET "role" = 'super_admin', "permissions" = '[]'::jsonb;