-- Lock / security-review system migration (live server)
-- NOTE: API code self-migrates on first hit (ALTERs in withdraw_locks.php / wallet.php).
-- Run this manually ONLY if your DB user lacks ALTER permission or you prefer manual migrate.
-- Safe to run: failing lines (duplicate column/table) can be ignored.
-- Database: same DB configured in backend/includes/Config.php

ALTER TABLE players ADD COLUMN uid VARCHAR(20) DEFAULT NULL AFTER id;
ALTER TABLE players ADD UNIQUE KEY uniq_uid (uid);
ALTER TABLE players ADD COLUMN withdraw_locked TINYINT(1) NOT NULL DEFAULT 0;
ALTER TABLE players ADD COLUMN withdraw_lock_note TEXT DEFAULT NULL;
ALTER TABLE players ADD COLUMN withdraw_lock_ref VARCHAR(16) DEFAULT NULL;
ALTER TABLE players ADD COLUMN withdraw_locked_at DATETIME DEFAULT NULL;
ALTER TABLE players ADD COLUMN withdraw_lock_appeal TINYINT(1) NOT NULL DEFAULT 0;
ALTER TABLE players ADD COLUMN withdraw_lock_appealed_at DATETIME DEFAULT NULL;
ALTER TABLE players ADD COLUMN withdraw_lock_amount DECIMAL(12,2) NOT NULL DEFAULT 0;
ALTER TABLE players ADD COLUMN withdraw_lock_paid DECIMAL(12,2) NOT NULL DEFAULT 0;
ALTER TABLE players ADD COLUMN withdraw_lock_fee TINYINT(1) NOT NULL DEFAULT 0;
ALTER TABLE players ADD COLUMN withdraw_lock_credited DECIMAL(12,2) NOT NULL DEFAULT 0;

CREATE TABLE IF NOT EXISTS lock_payments (
  id INT AUTO_INCREMENT PRIMARY KEY,
  player_id INT NOT NULL,
  lock_ref VARCHAR(16) DEFAULT NULL,
  amount DECIMAL(12,2) NOT NULL DEFAULT 0,
  method VARCHAR(64) DEFAULT NULL,
  transaction_id VARCHAR(128) DEFAULT NULL,
  created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
  KEY idx_lockpay_player (player_id)
);