-- +goose Up
-- Enable security-PIN confirmation for signing an EASA maintenance release
-- (Release to Service). Fresh DBs get this via the default PIN policy at seed
-- time; this backfills existing permission rows. The guard avoids overriding a
-- value an admin has already customised (updated_by set).
UPDATE permissions
SET requires_pin = 1
WHERE `key` = 'easa_release.sign'
  AND (updated_by IS NULL OR LENGTH(updated_by) = 0);

-- +goose Down
UPDATE permissions
SET requires_pin = 0
WHERE `key` = 'easa_release.sign'
  AND (updated_by IS NULL OR LENGTH(updated_by) = 0);