rfc-app/backend/migrations/011_allowlist.sql

-- Private-beta email allowlist.
--
-- The framework supports a deployment-gated sign-in mode: when this
-- table contains rows, only emails listed here (case-insensitively)
-- may sign in via OAuth. Users already provisioned in the `users`
-- table are grandfathered in by gitea_id and never re-checked against
-- this list — so the operator who allow-listed themselves, signed in
-- once, then removed their own email from the list does not lose
-- access.
--
-- An empty `allowed_emails` table is the "open" state: no allowlist
-- gate runs, and any successful OAuth sign-in provisions a new user
-- as before. This means a fresh framework install behaves exactly as
-- prior versions until the operator adds the first row, at which
-- point the gate turns on for everyone not yet in `users`.

CREATE TABLE allowed_emails (
    email            TEXT PRIMARY KEY COLLATE NOCASE,
    added_by_user_id INTEGER REFERENCES users(id) ON DELETE SET NULL,
    note             TEXT,
    created_at       TEXT NOT NULL DEFAULT (datetime('now'))
);