CREATE TABLE "meta"."edit_log" (
	"id" bigint PRIMARY KEY GENERATED ALWAYS AS IDENTITY (sequence name "meta"."edit_log_id_seq" INCREMENT BY 1 MINVALUE 1 MAXVALUE 9223372036854775807 START WITH 1 CACHE 1),
	"at" timestamp with time zone DEFAULT now() NOT NULL,
	"user_id" text,
	"user_email" text,
	"schema_name" text NOT NULL,
	"table_name" text NOT NULL,
	"action" text NOT NULL,
	"pk" jsonb,
	"before" jsonb,
	"after" jsonb,
	CONSTRAINT "edit_log_action_check" CHECK (action IN ('insert','update','delete','import','add_column'))
);
--> statement-breakpoint
CREATE INDEX "edit_log_table_at_index" ON "meta"."edit_log" ("schema_name","table_name","at");--> statement-breakpoint
-- Hand-written below this line (not generated by drizzle-kit).
-- The app role appends to and reads the log; nobody updates or deletes through the app.
-- personal_ro gets no access: before/after values can hold private (health) data.
-- Grants only run on prod (as `personal`); the dev DB is owned by personal_dev.
DO $$
BEGIN
  IF current_user = 'personal' AND EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'personal_app') THEN
    GRANT SELECT, INSERT ON meta.edit_log TO personal_app;
    GRANT USAGE ON SEQUENCE meta.edit_log_id_seq TO personal_app;
  END IF;
  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'personal_ro') THEN
    REVOKE ALL ON meta.edit_log FROM personal_ro;
  END IF;
END $$;