feat: setup and roles

drizzle/migrations/20261008180028_admin-roles/migration.sql

@@ -0,0 +1,7 @@
+ALTER TABLE "sessions" ADD COLUMN "impersonated_by" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "role" text DEFAULT 'user';--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "banned" boolean DEFAULT false;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "ban_reason" text;--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "ban_expires" timestamp with time zone;--> statement-breakpoint
+-- Accounts were all equal until now, so the oldest one becomes the admin.
+UPDATE "users" SET "role" = 'admin' WHERE "id" = (SELECT "id" FROM "users" ORDER BY "created_at", "id" LIMIT 1);

drizzle/schema.ts

@@ -254,6 +254,11 @@ export const users = pgTable("users", {
     emailVerified: boolean("email_verified").default(false).notNull(),
     image: text("image"),
     twoFactorEnabled: boolean("two_factor_enabled").default(false),
+    // 'admin' or 'user', the first account of an instance is its admin
+    role: text("role").default("user"),
+    banned: boolean("banned").default(false),
+    banReason: text("ban_reason"),
+    banExpires: timestamptz("ban_expires"),
     createdAt: timestamptz("created_at").defaultNow().notNull(),
     updatedAt: timestamptz("updated_at")
         .defaultNow()
@@ -295,6 +300,7 @@ export const sessions = pgTable(
         userId: text("user_id")
             .notNull()
             .references(() => users.id, { onDelete: "cascade" }),
+        impersonatedBy: text("impersonated_by"),
     },
     (table) => [index("sessions_userId_idx").on(table.userId)],
 );