-- +goose Up
-- Records the last sign in, which nothing has ever done.
--
-- users.last_login_at and its generated query have existed since the foundation migration and no code
-- path called them, so the column was NULL for every account that had ever signed in. The People screen
-- added in phase 19 showed "never signed in" beside the owner who was reading it.
--
-- The first attempt at a fix was a plain UPDATE from the auth service, and it silently did nothing.
-- Login happens BEFORE any tenant context exists, so app.current_org_id is unset and the row level
-- policy on users matches zero rows. Every other privileged auth write goes through a SECURITY DEFINER
-- function for exactly this reason; the stamp needs the same treatment rather than an exception.
--
-- Scoped as tightly as the job allows: it writes one column on one row identified by primary key, and it
-- can neither read nor return anything.
-- +goose StatementBegin
CREATE OR REPLACE FUNCTION auth_touch_last_login(p_user_id uuid) RETURNS void AS $$
BEGIN
    UPDATE users SET last_login_at = now(), updated_at = now() WHERE id = p_user_id;
END;
$$ LANGUAGE plpgsql SECURITY DEFINER SET search_path = public, pg_temp;
-- +goose StatementEnd

REVOKE ALL ON FUNCTION auth_touch_last_login(uuid) FROM PUBLIC;
GRANT EXECUTE ON FUNCTION auth_touch_last_login(uuid) TO missionmatch_app;

-- +goose Down
DROP FUNCTION IF EXISTS auth_touch_last_login(uuid);