-- Rename the app RBAC field so it is never confused with the better-auth admin
-- plugin's `role`. `member_roles` holds a user's assigned community roles
-- (coordinator, facilitator, …); the admin plugin's `role` is platform-level.
ALTER TABLE user RENAME COLUMN roles TO member_roles;

-- better-auth admin plugin schema. `role` gates the admin/impersonation
-- endpoints (default 'user'); ban_* back the ban feature; session.impersonated_by
-- records the admin's id while a session is an impersonation.
ALTER TABLE user ADD COLUMN role TEXT NOT NULL DEFAULT 'user';
ALTER TABLE user ADD COLUMN banned INTEGER NOT NULL DEFAULT 0;
ALTER TABLE user ADD COLUMN ban_reason TEXT;
ALTER TABLE user ADD COLUMN ban_expires TEXT;
ALTER TABLE session ADD COLUMN impersonated_by TEXT;