-- +goose Up
-- Bench import compliance log. WS9 bulk loads a real cleared workforce bench (resumes and structured
-- profiles) into a tenant. Every committed record gets one append friendly compliance row here: which
-- candidate, which source kind, the file or batch it came from, the operator provided legal basis, and
-- when. Tenant scoped under RLS so an org sees only its own bench import history. Mirrors the
-- sourcing_log shape from 0008_external_sourcing.sql.

CREATE TABLE bench_import_log (
    id              uuid PRIMARY KEY DEFAULT gen_random_uuid(),
    organization_id uuid NOT NULL REFERENCES organizations(id),
    candidate_id    uuid,                        -- null after the candidate is deleted
    source          text NOT NULL DEFAULT '',    -- for example bench_file or bench_csv
    file_or_batch   text NOT NULL DEFAULT '',    -- the resume file path or the batch identifier
    legal_basis     text NOT NULL DEFAULT '',    -- the operator provided lawful basis for the import
    collected_at    timestamptz NOT NULL DEFAULT now()
);
CREATE INDEX idx_bench_import_log_org ON bench_import_log (organization_id, collected_at DESC);

ALTER TABLE bench_import_log ENABLE ROW LEVEL SECURITY;
ALTER TABLE bench_import_log FORCE  ROW LEVEL SECURITY;
CREATE POLICY bench_import_log_isolation ON bench_import_log
    USING      (organization_id = NULLIF(current_setting('app.current_org_id', true), '')::uuid)
    WITH CHECK (organization_id = NULLIF(current_setting('app.current_org_id', true), '')::uuid);

GRANT SELECT, INSERT ON bench_import_log TO missionmatch_app;

-- +goose Down
DROP TABLE IF EXISTS bench_import_log;