-- AP0.3: Capability catalog and role → capability grants

CREATE TABLE capabilities (
    capability_key VARCHAR(128) PRIMARY KEY,
    module VARCHAR(64) NOT NULL,
    description TEXT NOT NULL,
    is_active BOOLEAN NOT NULL DEFAULT TRUE,
    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

CREATE TABLE role_capability_grants (
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    role_scope VARCHAR(16) NOT NULL
        CHECK (role_scope IN ('portal', 'tenant')),
    role_code VARCHAR(32) NOT NULL,
    capability_key VARCHAR(128) NOT NULL REFERENCES capabilities(capability_key) ON DELETE CASCADE,
    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    UNIQUE (role_scope, role_code, capability_key)
);

CREATE INDEX idx_role_capability_grants_lookup
    ON role_capability_grants(role_scope, role_code);