feat: phase2 migration — triage fields, RCA structured data, write_audit_log RPC

supabase/migrations/20260711000011_phase2_triage_rca.sql

@@ -0,0 +1,32 @@
+-- Triage classification fields on incidents
+ALTER TABLE incidents
+  ADD COLUMN IF NOT EXISTS is_fatality              BOOLEAN NOT NULL DEFAULT false,
+  ADD COLUMN IF NOT EXISTS is_serious_bodily_injury BOOLEAN NOT NULL DEFAULT false,
+  ADD COLUMN IF NOT EXISTS is_dangerous_occurrence  BOOLEAN NOT NULL DEFAULT false,
+  ADD COLUMN IF NOT EXISTS is_occupational_disease  BOOLEAN NOT NULL DEFAULT false,
+  ADD COLUMN IF NOT EXISTS triage_notes             TEXT,
+  ADD COLUMN IF NOT EXISTS triaged_by               UUID REFERENCES users(id),
+  ADD COLUMN IF NOT EXISTS triaged_at               TIMESTAMPTZ;
+
+-- Structured RCA data on investigations
+ALTER TABLE investigations
+  ADD COLUMN IF NOT EXISTS five_why_steps       JSONB,
+  ADD COLUMN IF NOT EXISTS fishbone_categories  JSONB;
+
+-- Audit log write helper — SECURITY DEFINER so callers cannot bypass RLS
+CREATE OR REPLACE FUNCTION public.write_audit_log(
+  p_table_name TEXT,
+  p_record_id  UUID,
+  p_action     TEXT,
+  p_new_value  JSONB DEFAULT NULL,
+  p_old_value  JSONB DEFAULT NULL
+)
+RETURNS VOID
+LANGUAGE plpgsql
+SECURITY DEFINER
+AS $$
+BEGIN
+  INSERT INTO audit_log (table_name, record_id, action, changed_by, new_value, old_value)
+  VALUES (p_table_name, p_record_id, p_action, auth.uid(), p_new_value, p_old_value);
+END;
+$$;