-- The SQLite baseline predates the access-role table.
CREATE TABLE IF NOT EXISTS workbench_access_roles (
    id TEXT PRIMARY KEY,
    tenant_id INTEGER NOT NULL,
    name TEXT NOT NULL,
    description TEXT NOT NULL DEFAULT '',
    permissions TEXT NOT NULL DEFAULT '[]',
    version INTEGER NOT NULL DEFAULT 1,
    created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
    updated_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
    UNIQUE (tenant_id, name)
);
-- Preserve legacy role expansion until the role is explicitly saved.
ALTER TABLE workbench_access_roles
    ADD COLUMN permission_version INTEGER NOT NULL DEFAULT 0;