ALTER TABLE workspaces ADD COLUMN is_private BOOLEAN NOT NULL DEFAULT FALSE;
ALTER TABLE pads ADD COLUMN is_private BOOLEAN NOT NULL DEFAULT FALSE;
CREATE TABLE resource_permissions (
 resource_kind TEXT NOT NULL,
 resource_slug TEXT NOT NULL,
 user_id BIGINT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
 permission TEXT NOT NULL CHECK(permission IN ('ro','rw')),
 created_at TEXT NOT NULL DEFAULT (CURRENT_TIMESTAMP::text),
 PRIMARY KEY(resource_kind, resource_slug, user_id)
);
CREATE INDEX idx_resource_permissions_user ON resource_permissions(user_id);
CREATE TABLE resource_share_links (
 token_hash TEXT PRIMARY KEY,
 resource_kind TEXT NOT NULL,
 resource_slug TEXT NOT NULL,
 permission TEXT NOT NULL CHECK(permission IN ('ro','rw')),
 expires_at TEXT,
 created_by BIGINT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
 created_at TEXT NOT NULL DEFAULT (CURRENT_TIMESTAMP::text),
 revoked_at TEXT
);
CREATE INDEX idx_resource_share_links_resource ON resource_share_links(resource_kind, resource_slug);