-- Caterium v17.7.4: move mandatory temporary-password state to server-controlled app metadata.
-- Legacy user_metadata is client-editable and must not be trusted for this security state.

begin;

update auth.users
set raw_app_meta_data = coalesce(raw_app_meta_data, '{}'::jsonb)
  || jsonb_build_object(
    'must_change_password', true,
    'password_policy_version', 'v1774'
  )
where lower(coalesce(raw_user_meta_data->>'must_change_password', '')) = 'true'
  and lower(coalesce(raw_app_meta_data->>'must_change_password', 'false')) <> 'true';

commit;