-- =========================================================
-- MIGRATION: BVN Verification (KYC Tier 2)
-- We deliberately do NOT store the full BVN — only the last
-- 4 digits, for display purposes. This limits exposure if
-- the database is ever compromised.
-- =========================================================

ALTER TABLE users
    ADD COLUMN bvn_verified    TINYINT(1) NOT NULL DEFAULT 0 AFTER phone_number,
    ADD COLUMN bvn_last4       VARCHAR(4) DEFAULT NULL AFTER bvn_verified,
    ADD COLUMN bvn_verified_at DATETIME   DEFAULT NULL AFTER bvn_last4;