-- Restrict Bearer API keys to public-visibility tickets by default (#70).
--
-- Previously any 'read'-scope key bypassed ticket visibility entirely —
-- Confidential and Internal tickets were readable by any key, regardless
-- of who it was issued to. see_all_visibility is an explicit opt-in an
-- admin sets per-key when a key genuinely needs to see non-public tickets;
-- it defaults to 0 (public-only) for both new and existing keys, since the
-- prior blanket-access behavior is the thing being restricted.
--
-- Safe to re-run.

ALTER TABLE `api_keys`
    ADD COLUMN IF NOT EXISTS `see_all_visibility` tinyint(1) NOT NULL DEFAULT 0 AFTER `scope`;