init push

migrations/goose/20260630_easa_release_sign_requires_pin.sql

@@ -0,0 +1,15 @@
+-- +goose Up
+-- Enable security-PIN confirmation for signing an EASA maintenance release
+-- (Release to Service). Fresh DBs get this via the default PIN policy at seed
+-- time; this backfills existing permission rows. The guard avoids overriding a
+-- value an admin has already customised (updated_by set).
+UPDATE permissions
+SET requires_pin = 1
+WHERE `key` = 'easa_release.sign'
+  AND (updated_by IS NULL OR LENGTH(updated_by) = 0);
+
+-- +goose Down
+UPDATE permissions
+SET requires_pin = 0
+WHERE `key` = 'easa_release.sign'
+  AND (updated_by IS NULL OR LENGTH(updated_by) = 0);