# `roles` — Role Reference Table

**Module:** Authentication  
**Type:** Reference / Lookup  
**Soft Delete:** No  

---

## Purpose

Defines the three user roles in the INVEETAIRE platform. This is a system-seeded table; rows are never created or deleted at runtime.

---

## Description

The `roles` table acts as the authority for access control. Every `users` record references one role, which determines which portal and features the user can access. Roles are immutable after deployment.

---

## Columns

| Column | Type | Nullable | Default | Description |
|--------|------|----------|---------|-------------|
| `id` | `TINYINT UNSIGNED AUTO_INCREMENT` | No | — | Surrogate primary key |
| `name` | `VARCHAR(50)` | No | — | Display name: `Super Admin`, `Couple`, `Event Crew` |
| `slug` | `VARCHAR(50)` | No | — | Machine identifier: `super_admin`, `couple`, `crew` |
| `description` | `VARCHAR(255)` | Yes | NULL | Human-readable scope description |
| `is_system` | `TINYINT(1)` | No | `1` | Always 1 — seeded roles cannot be deleted |
| `created_at` | `DATETIME` | No | `CURRENT_TIMESTAMP` | Seeded at deployment |

---

## Primary Key

`id` — `TINYINT UNSIGNED`

---

## Indexes

| Name | Columns | Type |
|------|---------|------|
| `PRIMARY` | `id` | Primary |

---

## Foreign Keys

None. This is a root reference table.

---

## Referenced By

| Table | Column | On Delete |
|-------|--------|-----------|
| `users` | `role_id` | RESTRICT |

---

## Seeded Values

| id | name | slug |
|----|------|------|
| 1 | Super Admin | super_admin |
| 2 | Couple | couple |
| 3 | Event Crew | crew |

---

## Business Rules

- Roles are seeded at deployment and cannot be modified at runtime
- `is_system = 1` prevents deletion via UI
- The `slug` is used in session snapshots (`role_snapshot` in `sessions`) and middleware checks

---

## Notes

- The `RoleMiddleware` compares against `slug` values, not `id`
- `role_snapshot` in the `sessions` table stores the slug at login time to avoid a JOIN on every request