-- Distinguish non-interactive OAuth identities from human product users.
-- This migration is intentionally re-runnable.

ALTER TABLE users
    DROP CONSTRAINT IF EXISTS users_role_check;

ALTER TABLE users
    ADD CONSTRAINT users_role_check
    CHECK (role IN ('admin', 'service', 'user'));