0017_user_deletion.sql14 lines · main

1	-- 0017_user_deletion — adds the deletion_reason column so the audit
2	-- trail can carry a (short, optional) free-text justification the user
3	-- supplies when they click "delete account". `deleted_at` already
4	-- exists on users (migration 0001); this only adds the reason field.
5
6	ALTER TABLE "users"
7	ADD COLUMN IF NOT EXISTS "deletion_reason" text;
8
9	-- Pseudonymise PII once a row is soft-deleted: email + audit-log FKs
10	-- survive (so admin can correlate post-deletion incidents), but legal
11	-- name / address / VAT / company name / display name / image all clear
12	-- inside the same transaction the service runs. No DB-side trigger —
13	-- the service is the only path that touches deletion, and a trigger
14	-- would make the hard-delete cron's logic harder to reason about.