-- SCIM provenance for user accounts.
--
-- Records the organization whose SCIM connector CREATED this account, and
-- only that case: accounts that already existed when a SCIM connector first
-- referenced them stay NULL forever.
--
-- This is what lets SCIM deprovisioning tell a shadow account (which exists
-- only because an IdP made it, and is worth disabling when the IdP drops it)
-- apart from a real person's pre-existing account (which an org-scoped
-- credential must never be able to delete). Before this column existed,
-- deprovisioning soft-deleted the target's ENTIRE platform account —
-- personal repos and every other org included.
--
-- Additive and idempotent: no drops, no backfill. NULL is the safe default,
-- and NULL is the value that denies deletion.
--
-- The statement-breakpoint markers are load-bearing, not decoration. The
-- migration runner's fallback splitter breaks on a semicolon at end of line
-- and is not dollar-quote aware, so it would shred the DO block below into
-- invalid fragments. Every other migration here that uses a DO block marks
-- its boundaries the same way.

ALTER TABLE users
  ADD COLUMN IF NOT EXISTS scim_provisioned_by_org_id uuid;
--> statement-breakpoint
DO $$
BEGIN
  IF NOT EXISTS (
    SELECT 1 FROM pg_constraint
    WHERE conname = 'users_scim_provisioned_by_org_id_fkey'
  ) THEN
    ALTER TABLE users
      ADD CONSTRAINT users_scim_provisioned_by_org_id_fkey
      FOREIGN KEY (scim_provisioned_by_org_id)
      REFERENCES organizations(id) ON DELETE SET NULL;
  END IF;
END $$;
--> statement-breakpoint
CREATE INDEX IF NOT EXISTS users_scim_provisioned_by_org_id_idx
  ON users (scim_provisioned_by_org_id)
  WHERE scim_provisioned_by_org_id IS NOT NULL;