-- Switches student login from a fake generated email (slug@students.axioma-study.kz,
-- only ever existed because users.email was NOT NULL/UNIQUE) to their IIN
-- (users.iin, already used elsewhere for student records). Other roles are
-- unaffected and keep logging in with email.
--
-- Safe to run once; the backfill UPDATE only fills NULLs so re-running is a no-op.

ALTER TABLE users MODIFY email VARCHAR(255) NULL;

-- Backfill: some students already have an IIN recorded on `students` but their
-- linked `users` row never got it (StudentProfileController::store() only wrote
-- students.iin, not users.iin, until this change) — copy it over so they can log
-- in immediately instead of waiting on a manual re-entry.
UPDATE users u
JOIN students s ON s.user_id = u.id
SET u.iin = s.iin
WHERE u.role = 'student' AND u.iin IS NULL AND s.iin IS NOT NULL;

UPDATE users SET email = NULL WHERE role = 'student';
