-- =====================================================================
--  RETAIL PHARMACY PLATFORM
--  Schema Pack T — Refill reminder consent v1.0
--
--  Apply AFTER schema-phase2f-messaging.sql.
--
--  =================================================================
--  A MEDICINE REMINDER IS NOT AN OFFER
--  =================================================================
--
--  consent_event.purpose already declares three values —
--  TRANSACTIONAL, MARKETING and REFILL_REMINDER. The customer table
--  carries flags for the first two. REFILL_REMINDER could never be
--  recorded, so refill reminders were sent under general marketing
--  consent.
--
--  That collapses two different things:
--
--    - "tell me when my BP tablets are due"  — a patient with a chronic
--      condition, who wants this, and for whom missing it is a health
--      outcome rather than a lost sale
--    - "tell me about your offers"           — advertising
--
--  A patient forced to accept advertising to get medicine reminders
--  will decline both, and the shop loses the one that mattered. A
--  patient who accepts offers has not thereby agreed to have his
--  disease inferred from a message log.
--
--  Under the DPDP Act the second is the sharper risk: a refill reminder
--  names a medicine, and a medicine implies a diagnosis. Consent for
--  that is not consent for a discount coupon, and a regulator reading
--  one consent flag covering both will say so.
-- =====================================================================

SET NAMES utf8mb4;

ALTER TABLE customer
  ADD COLUMN consent_refill TINYINT(1) NOT NULL DEFAULT 0
      COMMENT 'separate from consent_marketing: a medicine reminder is not an offer'
      AFTER consent_marketing;

-- Existing customers: NOT carried over from consent_marketing.
--
-- Inheriting it would manufacture consent nobody gave, for the most
-- sensitive category of message the shop sends. A shop that wants
-- refill reminders asks again. That is the correct cost of having
-- conflated the two.

-- =====================================================================
--  INVARIANTS asserted in tests:
--
--   1. A refill reminder is BLOCKED without consent_refill, whatever
--      consent_marketing says.
--   2. General marketing consent alone never permits one.
--   3. Withdrawing refill consent does not withdraw transactional
--      consent — a bill still reaches the customer who asked for it.
--   4. STOP withdraws everything, because a customer saying stop is not
--      distinguishing categories.
-- =====================================================================