-- Upgrade an existing calcserubi database to version 2.3.0
-- (super-admin role, mandatory password change after reset, TOTP 2FA).
-- Run ONCE, manually (phpMyAdmin > tab SQL, or the mysql client), with an
-- account that may ALTER the database. Then the application user only needs
-- SELECT, INSERT, UPDATE, DELETE.

ALTER TABLE admins
  ADD COLUMN role VARCHAR(20) NOT NULL DEFAULT 'admin' COMMENT 'super_admin | admin' AFTER full_name,
  ADD COLUMN must_change_password TINYINT(1) NOT NULL DEFAULT 0 AFTER is_active,
  ADD COLUMN otp_secret VARCHAR(255) NULL COMMENT 'TOTP secret, encrypted with security.app_key' AFTER must_change_password,
  ADD COLUMN otp_enabled TINYINT(1) NOT NULL DEFAULT 0 AFTER otp_secret,
  ADD COLUMN otp_last_step BIGINT NULL COMMENT 'last accepted TOTP time step (replay guard)' AFTER otp_enabled,
  ADD COLUMN recovery_codes TEXT NULL COMMENT 'JSON list of HMAC-hashed one-time recovery codes' AFTER otp_last_step;

-- The oldest active admin becomes the first super admin. Check the result and
-- adjust if another person should hold the role:
--   SELECT id, username, role FROM admins;
UPDATE admins SET role = 'super_admin'
WHERE id = (SELECT id FROM (SELECT MIN(id) AS id FROM admins WHERE is_active = 1) AS first_admin);

-- Workbook cell references removed from older seeded descriptions (previously done on
-- every request). Written without REGEXP_REPLACE so it also runs on MySQL 5.7.
UPDATE settings SET description = TRIM(SUBSTRING_INDEX(description, ' (COB!', 1))
WHERE description LIKE '% (COB!%';
UPDATE settings SET description = TRIM(SUBSTRING_INDEX(description, ' (CALC!', 1))
WHERE description LIKE '% (CALC!%';