-- Add domain security levels table
-- Stores per-tenant security classification for domains (BC OData is read-only)

CREATE TABLE IF NOT EXISTS `helpdesk_domain_security_levels` (
    `id`             BIGINT UNSIGNED  NOT NULL AUTO_INCREMENT,
    `tenant_id`      INT UNSIGNED     NOT NULL,
    `domain_no`      VARCHAR(30)      NOT NULL,
    `security_level` VARCHAR(20)      NOT NULL DEFAULT 'normal',
    `created_by`     INT UNSIGNED     NULL,
    `updated_by`     INT UNSIGNED     NULL,
    `created_at`     DATETIME         NOT NULL DEFAULT CURRENT_TIMESTAMP,
    `updated_at`     DATETIME         NULL DEFAULT NULL ON UPDATE CURRENT_TIMESTAMP,
    PRIMARY KEY (`id`),
    UNIQUE KEY `uq_tenant_domain` (`tenant_id`, `domain_no`),
    KEY `idx_tenant_level` (`tenant_id`, `security_level`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;