idk

database/migration_20260612_events_leads_rgpd.sql

@@ -0,0 +1,22 @@
+-- ─── event_leads: consent + provenance + FK (D1) ────────────────────────────
+-- event_leads captures PII from a public form. Under the GDPR we must record
+-- demonstrable consent and minimise/retain responsibly. Add the consent flag,
+-- the exact text the visitor agreed to, and request provenance (IP + UA) so a
+-- submission can be evidenced. Also wire the missing FK to events so leads are
+-- removed with their event (no orphans).
+--
+-- NB: filename sorts AFTER migration_20260612_events.sql (which creates the
+-- table), so the runner applies them in the right order.
+
+ALTER TABLE `event_leads`
+    ADD COLUMN IF NOT EXISTS `consent`      TINYINT(1)   NOT NULL DEFAULT 0 AFTER `message`,
+    ADD COLUMN IF NOT EXISTS `consent_text` VARCHAR(255) NOT NULL DEFAULT '' AFTER `consent`,
+    ADD COLUMN IF NOT EXISTS `ip`           VARCHAR(45)  NOT NULL DEFAULT '' AFTER `consent_text`,
+    ADD COLUMN IF NOT EXISTS `user_agent`   VARCHAR(255) NOT NULL DEFAULT '' AFTER `ip`;
+
+-- Referential integrity: delete leads when their event is hard-deleted.
+-- (Has no IF NOT EXISTS in MariaDB; if re-running after a partial apply, drop
+--  the constraint first.)
+ALTER TABLE `event_leads`
+    ADD CONSTRAINT `fk_event_leads_event`
+        FOREIGN KEY (`e_id`) REFERENCES `events` (`e_id`) ON DELETE CASCADE;