-- ============================================================
-- Schema Update v4
-- Run this AFTER schema_update_v3.sql.
-- Upgrades user_permissions so superadmin/admin can explicitly DENY a
-- permission a role would normally have, not just grant extra ones.
-- ============================================================

ALTER TABLE user_permissions
  ADD COLUMN state ENUM('grant','deny') NOT NULL DEFAULT 'grant' AFTER permission_code;
