-- Role expansion — spec section 3.
--
-- This migration ONLY adds enum values. Postgres forbids using a new enum value
-- in the same transaction that added it, and the Supabase CLI wraps each
-- migration file in one transaction, so every use of these values must live in
-- a later file. Do not add anything else here.
--
-- Existing values ('admin', 'teacher', 'parent') are kept. 'admin' is retained
-- as the legacy organization-wide administrator so the policies written before
-- this migration keep working unchanged; 20260807000100 teaches the role
-- helpers that 'org_admin' and 'super_admin' also satisfy it.

ALTER TYPE public.app_role ADD VALUE IF NOT EXISTS 'super_admin';
ALTER TYPE public.app_role ADD VALUE IF NOT EXISTS 'org_admin';
ALTER TYPE public.app_role ADD VALUE IF NOT EXISTS 'campus_admin';
ALTER TYPE public.app_role ADD VALUE IF NOT EXISTS 'management';
ALTER TYPE public.app_role ADD VALUE IF NOT EXISTS 'billing_admin';
ALTER TYPE public.app_role ADD VALUE IF NOT EXISTS 'staff';
ALTER TYPE public.app_role ADD VALUE IF NOT EXISTS 'auditor';