has_helpers 5.0.2

data/app/workers/sidekiq/elasticsearch_old_index_cleaner_worker.rb

@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+
+module Sidekiq
+  class ElasticsearchOldIndexCleanerWorker
+    include Sidekiq::Worker
+    sidekiq_options queue: "elasticsearch_reindex"
+
+    def perform
+      # Record the starting time of the process
+      starting_time = ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)
+
+      # Iterate over each index class and attempt to clean old indices
+      ::HasHelpers::Index.indices&.each do |index_class|
+        clean_old_indices(index_class, starting_time)
+      rescue StandardError => e
+        handle_error(index_class.name, starting_time, e)
+      end
+    end
+
+    private
+
+    def clean_old_indices(index_class, starting_time)
+      # Initialize the options hash with the class name and starting time
+      options = { index_class_name: index_class.name, start_time: starting_time }
+
+      # Select indices to delete based on indices that do not have aliases, meaning, old indices
+      indices_to_delete = index_class.old_indices
+
+      # Preserve recent indices by removing them from the indices_to_delete list
+      preserve_recent_indices!(indices_to_delete, index_class)
+
+      # Delete the selected indices
+      delete_indices(index_class, indices_to_delete, starting_time)
+
+      # Obtain the old indices remaining
+      remaining_indices = index_class.old_indices
+
+      # Check the status based on the count of remaining indices compared to indices to delete
+      if indices_to_delete.length == remaining_indices.length
+        options[:status] = "NOT_SUCCESS"   # All indices intended for deletion are still present
+        options[:count] = "0"
+      elsif remaining_indices.empty?
+        options[:status] = "COMPLETE_SUCCESS"   # No indices remain
+        options[:count] = indices_to_delete.length
+      else
+        options[:status] = "PARTIAL_SUCCESS"    # Some indices remain
+        options[:count] = remaining_indices.length
+      end
+
+      # Save the status and other options to the stats
+      save_to_stats(options)
+    end
+
+    def preserve_recent_indices!(indices_to_delete, index_class)
+      most_recent_indices = most_recent_index_names(index_class.indices)
+
+      # Get the most recent index names from indices
+      most_recent_indices.each do |most_recent_name|
+        next unless most_recent_name&.match?(/20\d{15}/)
+
+        indices_to_delete.reject! { |non_aliased_index_name, _| non_aliased_index_name == most_recent_name }
+      end
+    end
+
+    def most_recent_index_names(indices)
+      # Separate keyword indices from non-keyword indices
+      keyword_indices = indices.keys.select { |idx_name| idx_name.include?("keyword") }
+      non_keyword_indices = indices.keys - keyword_indices
+
+      # Return the most recent keyword index and the most recent non-keyword index
+      [keyword_indices.sort.last, non_keyword_indices.sort.last].compact
+    end
+
+    def delete_indices(index_class, indices_to_delete, starting_time)
+      indices_to_delete.each do |name, _|
+        index_class.delete(name)
+      rescue StandardError => e
+        error = "Failed to delete index #{name}: #{e.message}"
+        handle_error(index_class, starting_time, error)
+      end
+    end
+
+    def handle_error(index_class_name, starting_time, error)
+      options = { index_class_name: index_class_name, start_time: starting_time, status: "ERROR", count: nil }
+      # Save the error details to stats
+      save_to_stats(options, error)
+    end
+
+    def save_to_stats(options, error = nil)
+      index_class_name = options[:index_class_name]
+      main_type = "Elasticsearch"
+      sub_type = "old_index_cleaner"
+      data = {
+        index_resource: index_class_name.constantize.model.table_name,
+        old_indexes_deleted: options[:count],
+        status: options[:status],
+        error_type: error&.class&.name,
+        errors: error&.message
+      }
+
+      ::HasHelpers::Stat.save_to_stats(
+        ::HasHelpers::Stat.new,
+        index_class_name,
+        main_type,
+        sub_type,
+        data,
+        options[:start_time],
+        ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)
+      ) if ::HasHelpers::Feature.active?(:elasticsearch_reindex_stat)
+    end
+  end
+end

data/app/workers/sidekiq/elasticsearch_process_batch.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+module Sidekiq
+  class ElasticsearchProcessBatch
+    include ::Sidekiq::Worker
+    sidekiq_options queue: "elasticsearch"
+
+    THROTTLE = ::Sidekiq::Limiter.concurrent(
+      "has_helpers-elasticsearch_process_batch",
+      25,
+      wait_timeout: 10.seconds,
+      lock_timeout: 5.minutes
+    )
+
+    def perform(index_class_name, index_name, record_ids, routing_map = {})
+      THROTTLE.within_limit do
+        index_klass = index_class_name.constantize
+        is_keyword_index = (index_name.include?("keyword"))
+        records = ActiveRecord::Base.connection.select_all <<-SQL
+          SELECT * FROM #{index_klass.view_name} WHERE id IN (#{record_ids.map { |id| "'#{id}'" }.join(",")})
+        SQL
+        # Converts PG arrays to Ruby arrays.
+        records.each do |record|
+          record.each do |k, v|
+            record[k] = records.column_types[k].deserialize v if records.column_types[k].class == ActiveRecord::ConnectionAdapters::PostgreSQL::OID::Array
+          end
+        end.map(&:symbolize_keys!)
+
+        record_type = index_klass.type
+
+        indexes = records.map do |record|
+          attributes = HasHelpers::Index.default_attributes.merge(record.except(index_klass.active_record.primary_key))
+
+          if is_keyword_index
+            data = attributes
+            data.each do |field, field_value|
+              data[field] = field_value&.to_s if field_value.is_a?(::Integer) || field_value.is_a?(::Float) # Storing text instead of numbers allows for easier wildcard searching
+            end
+          else
+            all_fields = index_klass.all_values_from_attributes(attributes)
+            data = attributes.merge(all_fields: all_fields)
+          end
+          routing = index_klass.is_global? ? 0 : record[:organization_id]
+          {
+            index: {
+              routing: routing,
+              _index: index_name,
+              _id: record[index_klass.active_record.primary_key.to_sym],
+              _type: record_type,
+              data: data
+            }
+          }
+        end
+
+        found_ids = records.map { |r| r[index_klass.active_record.primary_key.to_sym].to_s }
+        delete_ids = record_ids.map(&:to_s) - found_ids
+        deletes = delete_ids.filter_map do |record_id|
+          routing = index_klass.is_global? ? 0 : routing_map[record_id]
+          next if routing.blank?
+
+          {
+            delete: {
+              routing: routing,
+              _index: index_name,
+              _id: record_id,
+              _type: record_type
+            }
+          }
+        end
+
+        if (index_klass.index_name != index_name && index_klass.keyword_search_index_name != index_name) || Searchkick.client.indices.exists_alias?(name: index_name)
+          Searchkick.indexer.queue([*indexes, *deletes])
+        else
+          self.class.perform_in(1.minute, index_class_name, index_name, record_ids)
+        end
+      end
+    rescue Sidekiq::Limiter::OverLimit
+      if batch
+        batch.jobs do
+          self.class.perform_in(1.minute, index_class_name, index_name, record_ids)
+        end
+      else
+        self.class.perform_in(1.minute, index_class_name, index_name, record_ids)
+      end
+    end
+  end
+end

data/app/workers/sidekiq/elasticsearch_process_queue.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Sidekiq
+  class ElasticsearchProcessQueue
+    include ::Sidekiq::Worker
+    sidekiq_options unique_for: 10.minutes, unique_until: :start, queue: "elasticsearch"
+
+    def perform(index_class_name, index_name)
+      starting_time = ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)
+      index_klass = index_class_name.constantize
+      limit = 100
+      is_keyword_search = index_name.include?("keyword")
+      reindex_queue = is_keyword_search ? index_klass.keyword_reindex_queue : index_klass.reindex_queue
+      records = reindex_queue.reserve(limit: limit)
+      if records.any?
+        batch = Sidekiq::Batch.new
+        record_ids = records.map { |record| record[:record_id] }
+        key = records.map { |record| record[:key] }.uniq
+        routing_map = records.each_with_object({}) { |record, h| h[record[:record_id]] = record[:routing_key] }
+        batch.on(:success, self.class, "index_class_name" => index_class_name, "record_ids_count" => record_ids.size, "key" => key, "starting_time" => starting_time)
+        batch.jobs do
+          ::Sidekiq::ElasticsearchProcessBatch.perform_async(index_klass.name, index_name, record_ids, routing_map) if ::Searchkick.client.indices.exists_alias?(name: index_name)
+        end
+
+        if record_ids.size == limit
+          ::Sidekiq::ElasticsearchProcessQueue.perform_async(index_class_name, index_name)
+        end
+      end
+    end
+
+    def on_success(_status, options)
+      index_class_name = options["index_class_name"]
+      record_ids_count = options["record_ids_count"]
+      key = options["key"]
+      starting_time = options["starting_time"]
+      ::Stat.save_to_stats(Stat.new, "Sidekiq::ElasticsearchProcessQueue", "elasticsearch", index_class_name, { record_ids_count: record_ids_count }, starting_time, ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)) if ::HasHelpers::Feature.active?(:elasticsearch_reindex_stat)
+      ::HasHelpers::Index.after_index(key)
+    end
+  end
+end

data/app/workers/sidekiq/elasticsearch_reindex.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+module Sidekiq
+  class ElasticsearchReindex
+    include ::Sidekiq::Worker
+    sidekiq_options queue: "elasticsearch_reindex"
+
+    def on_success(_status, options)
+      index_name = options["index_name"]
+      index_class_name = options["index_class_name"]
+      is_keyword_index = options["is_keyword_index"]
+      start_time = options["start_time"]
+      index_class = index_class_name.constantize
+      reindex_queue = is_keyword_index ? index_class.keyword_reindex_queue : index_class.reindex_queue
+
+      index_class.promote(index_name)
+      # Index all records updated during the reindex
+      index_class.active_record.where("updated_at >= ?", start_time).find_each do |record|
+        reindex_queue.push(record.id.to_s)
+      end
+      ::Sidekiq::ElasticsearchProcessQueue.perform_async(index_class.name, index_name)
+
+      index_class.update_settings(index_name, index: { refresh_interval: "1s" })
+    end
+
+    def perform(index_class_name, index_name)
+      index_class = index_class_name.constantize
+
+      logger.info "Reindexing #{index_class_name}"
+
+      options = { index_class_name: index_class_name, index_name: index_name, is_keyword_index: index_name.include?("keyword"), start_time: Time.current }
+
+      batch = Sidekiq::Batch.new
+      batch.on(:success, Sidekiq::ElasticsearchReindex, **options)
+      batch.jobs do
+        Cursor.execute(name: index_name, sql: index_class.active_record.select(:id).to_sql) do |cursor|
+          while (records = cursor.next(100)) do
+            record_ids = records.map { |record| record["id"] }
+            Sidekiq::Client.push("class" => Sidekiq::ElasticsearchProcessBatch, "args" => [index_class_name, index_name, record_ids], "queue" => "elasticsearch_reindex")
+          end
+        end
+      end
+
+      # https://github.com/mperham/sidekiq/issues/2700
+      ::HasUtils::Env.run_on_environment(::HasUtils::Env::TEST) do
+        if Sidekiq::Testing.inline?
+          stringified_options = options.map { |k, v| [k.to_s, v.to_s] }.to_h
+          on_success("status", stringified_options)
+        end
+      end
+    end
+  end
+end

data/config/initializers/action_view.rb

@@ -0,0 +1,7 @@
+# typed: strict
+# frozen_string_literal: true
+
+# Disable automatic partial path prefixing
+Rails.application.config.to_prepare do
+  ::ActionView::Base.prefix_partial_path_with_controller_namespace = false
+end

data/config/initializers/inflections.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+# Be sure to restart your server when you modify this file.
+
+# Add new inflection rules using the following format. Inflections
+# are locale-specific, and you may define rules for as many different
+# locales as you wish. All of these examples are active by default:
+# ActiveSupport::Inflector.inflections(:en) do |inflect|
+#   inflect.plural /^(ox)$/i, '\1en'
+#   inflect.singular /^(ox)en/i, '\1'
+#   inflect.irregular 'person', 'people'
+#   inflect.uncountable %w( fish sheep )
+# end
+
+# These inflection rules are supported but not enabled by default:
+# ActiveSupport::Inflector.inflections(:en) do |inflect|
+#   inflect.acronym 'RESTful'
+# end
+
+ActiveSupport::Inflector.inflections do |inflect|
+  inflect.acronym "DB"
+  inflect.acronym "API"
+  inflect.acronym "DN"
+end

data/config/initializers/marginalia.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+require "marginalia"
+
+Rails.application.config.to_prepare do
+  ::Marginalia::Comment.components = []
+  ::Marginalia::Comment.prepend_comment = true
+end

data/config/initializers/mime_types.rb

@@ -0,0 +1,6 @@
+# typed: strict
+# frozen_string_literal: true
+
+Rails.application.config.to_prepare do
+  Mime::Type.register "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", :xlsx
+end

data/config/initializers/opentelemetry.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+require "opentelemetry/sdk"
+require "opentelemetry/exporter/otlp"
+require "opentelemetry/instrumentation/rails"
+
+if ::HasUtils::Env.current_environment.production? || ::HasUtils::Env.current_environment.staging?
+  OpenTelemetry::SDK.configure do |c|
+    c.service_name = "#{ENV['POD_NAMESPACE']}-#{ENV['SERVER_ROLE']}"
+    c.use_all # enables all instrumentations!
+  end
+end

data/config/initializers/redis_conf.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+class RedisConf
+  class << self
+    def current
+      @current ||= Redis.new(config_options)
+    end
+
+    def reset!
+      @current&.close
+      @current = nil
+    end
+
+    def config_options
+      @config_options ||= (config.redis || {})
+    end
+
+    private
+
+    def config
+      @config ||= ::HasHelpers::LazyConfig.new(config_path)
+    end
+
+    def config_path
+      # you can configure redis several ways:
+      # first with env variable REDIS_CONFIG_FILE
+      # second with host_project_redis_config, ex inside the host project ReadyGOP/config/redis.yml
+      # third by default has_helpers/config/redis.yml
+      ENV["REDIS_CONFIG_FILE"] || host_project_redis_config || File.dirname(__FILE__) + "/../redis.yml"
+    end
+
+    def host_project_redis_config
+      if defined?(Rails) && Rails.root && File.exist?(Rails.root.join("config/redis.yml"))
+        Rails.root.join("config/redis.yml")
+      else
+        nil
+      end
+    end
+  end
+end

data/config/initializers/searchkick.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+Searchkick.search_method_name = :elasticsearch
+Searchkick.redis = ConnectionPool.new { RedisConf.current }
+
+if ENV["ELASTICSEARCH_URL"].present? || ENV["ELASTIC_SEARCH_URL"].present?
+  # TODO: remove ELASTICSEARCH_URL after ops_care change
+  Searchkick.client = Elasticsearch::Client.new url: (ENV["ELASTICSEARCH_URL"] || ENV["ELASTIC_SEARCH_URL"])
+end

data/config/initializers/will_paginate.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+require "will_paginate/array" # Support for paginating Arrays
+require "will_paginate/view_helpers/link_renderer"
+
+WillPaginate::ViewHelpers.pagination_options[:inner_window] = 2
+
+class PaginationListLinkRenderer < WillPaginate::ViewHelpers::LinkRenderer
+  def to_html
+    @options[:outer_window] = 0; links = windowed_links
+    links.unshift(page_control(@collection.current_page - 1, "previous", "page-control previous")) if @collection.previous_page
+    links.push(page_control(@collection.current_page + 1, "next", "page-control next")) if @collection.next_page
+
+    %Q(<ul class="page-controls #{ " #{@options[:class]}" if @options[:class]}">#{links.join("")}</ul>)
+  end
+
+  protected
+
+  def windowed_links
+    windowed_page_numbers.map { |n| page_control(n, nil, (n == current_page ? "page-control disabled" : "page-control")) }
+  end
+
+  def page_control(value, name, class_name)
+    if value.to_s == "gap"
+      '<li class="page-control disabled" title="Hidden page(s)" ><abbr>...</abbr></li>' # The title attribute was moved from the abbr tag to the surrounding li tag because a dotted underline was rendered beneath the abbr tag in Chrome and Firefox. The problem was not fixed by applying border-width: 0; as is commenly suggested.
+    else
+      [].tap do |s|
+        s << %Q(<li class="#{class_name}"><label class="label-over-input">)
+        if ["next", "previous"].include?(name.to_s)
+          s << %Q(<i class="fa fa-angle-#{name == "previous" ? "left" : "right"}"></i>)
+        else
+          s << value.to_s
+        end
+        s << %Q(<input class="input-under-label" type="submit" value="#{value}" name="page" />) unless /disabled/.match?(class_name)
+        s << "</label></li>"
+      end.join
+    end
+  end
+end

data/config/redis.yml

@@ -0,0 +1,12 @@
+development:
+  redis:
+    url: <%= ENV.fetch("REDIS_URL", "redis://127.0.0.1/0") %>
+test:
+  redis:
+    url: <%= ENV.fetch("REDIS_URL", "redis://127.0.0.1/0") %>
+staging:
+  redis:
+    url: <%= ENV.fetch("REDIS_URL", "redis://127.0.0.1/0") %>
+production:
+  redis:
+    url: <%= ENV.fetch("REDIS_URL", "redis://127.0.0.1/0") %>

data/config/routes.rb

@@ -0,0 +1,27 @@
+# typed: false
+# frozen_string_literal: true
+
+Rails.application.routes.draw do
+  get "/_health_check" => "has_helpers/health_check#ping"
+  get "/health_check/ping" => "has_helpers/health_check#ping"
+  get "/health_check/pingdb" => "has_helpers/health_check#pingdb"
+  get "/health_check/pingwh" => "has_helpers/health_check#pingwh"
+  get "/health_check/pinggj" => "has_helpers/health_check#pinggj"
+  get "/health_check/pingdbs" => "has_helpers/health_check#pingdbs"
+end
+
+HasHelpers::Engine.routes.draw do
+  mount HasHelpers::ServiceTrust::Engine => "/", as: :service_trust_jwks
+
+  constraints(lambda { |_req| HasHelpers::FactoryApi.enabled? }) do
+    scope :test do
+      scope :factory do
+        get "/:resource/:id", to: "factory#show", as: :factory_show
+        post :create,         to: "factory#create"
+        post :build,          to: "factory#build"
+        post :seed,           to: "factory#seed"
+        post :scenario,       to: "factory#scenario"
+      end
+    end
+  end
+end

data/config/service_trust_routes.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+HasHelpers::ServiceTrust::Engine.routes.draw do
+  get "/.well-known/jwks.json", to: "jwks#show"
+end

data/config.ru

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+require "rubygems"
+require "bundler"
+
+Bundler.require :default, :development
+
+Combustion.initialize! :all
+run Combustion::Application

data/db/migrate/20230127194725_create_organization_table.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+class CreateOrganizationTable < ActiveRecord::Migration[6.1]
+  def change
+    create_table :organizations, id: :integer do |t|
+      t.text      :name,                       null: false
+      t.text      :domain,                     null: false
+      t.integer   :time_zone_id,               null: false
+      t.boolean   :is_use_roles_for_authorization
+      t.integer   :firm_id,                    index: true
+      t.inet      :ip_whitelist,                      array: true
+      t.datetime  :created_at,                 null: false, default: -> { "CURRENT_TIMESTAMP" }
+      t.datetime  :updated_at,                 null: false, default: -> { "CURRENT_TIMESTAMP" }
+    end
+
+    add_check_constraint :organizations, "LENGTH(name) < 64", name: "HQMLC_max_length_name"
+    add_check_constraint :organizations, "LENGTH(domain) < 64", name: "HQMLC_max_length_domain"
+    add_check_constraint :organizations, "created_at <= updated_at", name: "HQUAC_updated_at_check"
+
+    add_foreign_key :organizations, :time_zones, column: :time_zone_id, validate: false
+
+    add_index :organizations, :name,        unique: true
+    add_index :organizations, :domain,      unique: true
+  end
+end

data/db/migrate/20230127194726_validate_organization_foreign_keys.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class ValidateOrganizationForeignKeys < ActiveRecord::Migration[6.1]
+  def change
+    validate_foreign_key :organizations, :time_zones
+  end
+end

data/db/migrate/20230206141413_create_security_models.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+class CreateSecurityModels < ActiveRecord::Migration[6.1]
+  def up
+    create_table :roles, id: :uuid do |t|
+      t.text        :name,                  null: false
+      t.integer     :organization_id,       null: false
+      t.uuid        :created_by_id,         null: false
+      t.uuid        :updated_by_id,         null: false
+      t.datetime    :created_at,            null: false,    default: -> { "CURRENT_TIMESTAMP" }
+      t.datetime    :updated_at,            null: false,    default: -> { "CURRENT_TIMESTAMP" }
+    end
+
+    add_check_constraint :roles, "LENGTH(name) < 128", name: "HQMLC_max_length_name", validate: false
+    add_foreign_key :roles, :organizations, column: :organization_id, validate: false
+
+    create_table :applications do |t|
+      t.string :name,                          null: false, limit: 63
+      t.string :project,                       limit: 63
+      t.string :production_url,                limit: 255
+      t.string :staging_url,                   limit: 255
+      t.string :development_url,               limit: 255
+      t.string :search_provider,               limit: 255
+      t.timestamps                             null: false
+    end
+
+    create_table :resources, id: :uuid do |t|
+      t.text        :resource_type_id,      null: false
+      t.uuid        :field_resource_id
+      t.text        :field_class_name
+      t.text        :name,                  null: false
+      t.text        :alias_name
+      t.text        :description
+      t.datetime    :created_at,            null: false,    default: -> { "CURRENT_TIMESTAMP" }
+      t.datetime    :updated_at,            null: false,    default: -> { "CURRENT_TIMESTAMP" }
+      t.references  :application,           null: false,    foreign_key: true
+    end
+  end
+
+  def down
+  end
+end

data/db/migrate/20230206141513_create_restriction_model.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+class CreateRestrictionModel < ActiveRecord::Migration[6.1]
+  def up
+    create_table :restrictions, id: :uuid do |t|
+      t.uuid        :resource_id,               null: false
+      t.uuid        :role_id,                   null: false
+      t.uuid        :created_by_id,             null: false
+      t.uuid        :updated_by_id,             null: false
+      t.datetime    :created_at,                null: false,    default: -> { "CURRENT_TIMESTAMP" }
+      t.datetime    :updated_at,                null: false,    default: -> { "CURRENT_TIMESTAMP" }
+    end
+
+    add_foreign_key :restrictions, :resources, column: :resource_id,  validate: false
+    add_foreign_key :restrictions, :roles, validate: false
+  end
+
+  def down
+  end
+end

data/db/migrate/20230206142613_add_security_indexes.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+class AddSecurityIndexes < ActiveRecord::Migration[6.1]
+  disable_ddl_transaction!
+  def up
+    add_index :roles, [:name, :organization_id], unique: true, algorithm: :concurrently, if_not_exists: true
+    add_index :resources, [:application_id, :resource_type_id, :name], algorithm: :concurrently, if_not_exists: true
+    add_index :restrictions, [:resource_id, :role_id], unique: true, name: "index_restriction_on_resource_role_restriction_operation", algorithm: :concurrently, if_not_exists: true
+    add_index :roles, [:organization_id, :id], unique: true, algorithm: :concurrently, if_not_exists: true
+    remove_index :resources, [:application_id, :name], if_exists: true
+  end
+
+  def down; end
+end

data/db/migrate/20230206143513_security_model_constants_seed.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+class SecurityModelConstantsSeed < ActiveRecord::Migration[6.1]
+  def change
+    ::HasHelpers::Operation.seed!
+    ::HasHelpers::ResourceType.seed!
+  end
+end

data/db/migrate/20230206161513_add_organization_to_security_models.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+class AddOrganizationToSecurityModels < ActiveRecord::Migration[6.1]
+  disable_ddl_transaction!
+
+  def up
+    add_column :restrictions, :organization_id, :integer, null: false, if_not_exists: true # rubocop:disable Rails/NotNullColumn
+    add_index :roles, [:organization_id, :id], unique: true, algorithm: :concurrently, if_not_exists: true
+    add_org_scoped_foreign_key from_table: :restrictions, to_table: :roles, validate: false
+  end
+
+  def down; end
+end