Jul 15 - Add Auditor user role

migrations/versions/phase40_auditor_role.py

@@ -0,0 +1,45 @@
+"""phase40 — add 'auditor' role to users.role ENUM
+
+Introduces a new staff role, Auditor, with the same access as Project Manager
+plus full issue-management powers (assign, verify, quick-assign, handler triage,
+create) — but NOT issue deletion (that stays admin/director).
+
+This is a pure ENUM expansion (adds a value, no data migration, no value
+removal), so the 3-step ENUM protocol does not apply. Re-running the same
+MODIFY is a no-op — safe to re-run.
+"""
+
+revision      = 'phase40_auditor_role'
+down_revision = 'phase39_area_public_token'
+branch_labels = None
+depends_on    = None
+
+from alembic import op
+import sqlalchemy as sa
+
+
+_ENUM_WITH_AUDITOR = (
+    "ENUM('admin','director','inspector','project_manager','customer','auditor')"
+)
+_ENUM_WITHOUT_AUDITOR = (
+    "ENUM('admin','director','inspector','project_manager','customer')"
+)
+
+
+def upgrade():
+    bind = op.get_bind()
+    # Idempotent: MODIFY to the expanded set is harmless if already applied.
+    op.execute(sa.text(
+        f"ALTER TABLE users MODIFY COLUMN role {_ENUM_WITH_AUDITOR} NOT NULL"
+    ))
+
+
+def downgrade():
+    bind = op.get_bind()
+    # Reassign any auditor rows before contracting the ENUM so no data is lost.
+    op.execute(sa.text(
+        "UPDATE users SET role = 'project_manager' WHERE role = 'auditor'"
+    ))
+    op.execute(sa.text(
+        f"ALTER TABLE users MODIFY COLUMN role {_ENUM_WITHOUT_AUDITOR} NOT NULL"
+    ))