-- Classic personal access tokens are gone: every token is fine-grained. A classic token (NULL permissions)
-- granted the user's full access, which is exactly "all repositories, write on every area", so existing
-- ones are converted to that grant. Code treats any remaining NULL as no access (fail closed). Converted rows
-- keep scopes = 'converted-classic' so REST minting keeps refusing them, as it refused classic tokens: they
-- were created without the fine-grained flow and REST has no password re-check (AUTH-A1).
UPDATE access_tokens
SET permissions = '{"contents":"write","issues":"write","pulls":"write","actions":"write","admin":"write"}',
    all_repos = 1,
    scopes = 'converted-classic'
WHERE permissions IS NULL;

-- Enforce it in the schema too. SQLite can't add NOT NULL to an existing column without rebuilding the table,
-- which here would mean recreating its delegation triggers and foreign keys; these triggers give the same
-- guarantee for every insert and update.
CREATE TRIGGER access_tokens_permissions_required_insert BEFORE INSERT ON access_tokens
WHEN NEW.permissions IS NULL
BEGIN
  SELECT RAISE(ABORT, 'access_tokens.permissions is required: classic tokens no longer exist');
END;

CREATE TRIGGER access_tokens_permissions_required_update BEFORE UPDATE OF permissions ON access_tokens
WHEN NEW.permissions IS NULL
BEGIN
  SELECT RAISE(ABORT, 'access_tokens.permissions is required: classic tokens no longer exist');
END;