@fayz-ai/db 0.11.0 → 0.13.0

package/migrations/050_authz_core.sql

@@ -0,0 +1,230 @@
+-- ============================================================================
+-- 050_authz_core.sql — the authz core (ADR 0006 / PRD 01 / #133): schema §3.
+--
+-- Tenancy, RBAC catalog, membership, the precomputed unit scope and the generic
+-- relation tuples of the Multi-Tenant Authorization & Data Scoping
+-- Architecture v2. Exactly two authorization surfaces (user_unit_access,
+-- resource_grants) plus the RBAC catalog; business tables carry tenant_id /
+-- unit_id / owner_id and one RLS template (043) — nothing else decides access.
+--
+-- Where it lives (DECISIONS 2026-08-18): schema `app`, per the spec and the
+-- issue's default until the platform session rules otherwise. `public.tenants`
+-- stays the tenant table — every FK in the fleet already points at it — and
+-- gains `kind`. Reads for UI go through public.v_authz_* (043); writes through
+-- the RLS write policies below or the RPCs of #134.
+--
+-- Idempotent and replay-safe: IF NOT EXISTS / guarded DO blocks throughout;
+-- policies are DROP IF EXISTS + CREATE. Nothing here touches tenant_members
+-- or locations — retiring them is #134's migration, on top of this.
+-- ============================================================================
+
+CREATE SCHEMA IF NOT EXISTS app;
+GRANT USAGE ON SCHEMA app TO authenticated, service_role;
+-- anon deliberately gets nothing: the authz core has no anonymous surface.
+
+-- ─────────────────────────────── Tenancy ───────────────────────────────
+-- tenants(kind network|business): a network groups units under franchisee /
+-- regional parent units; a business is one company. ADR 0002 maps V1's licence
+-- to a tenant and V1's franchise mode to kind='network'.
+ALTER TABLE public.tenants ADD COLUMN IF NOT EXISTS kind text NOT NULL DEFAULT 'business';
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'tenants_kind_check' AND conrelid = 'public.tenants'::regclass) THEN
+    ALTER TABLE public.tenants ADD CONSTRAINT tenants_kind_check CHECK (kind IN ('network', 'business'));
+  END IF;
+END $$;
+
+CREATE TABLE IF NOT EXISTS app.units (
+  tenant_id      uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  id             uuid NOT NULL DEFAULT gen_random_uuid(),
+  kind           text NOT NULL CHECK (kind IN ('hq', 'branch')),
+  parent_unit_id uuid,                       -- grouping: franchisee, region (subtree propagation)
+  name           text NOT NULL,
+  slug           text,
+  active         boolean NOT NULL DEFAULT true,
+  company_legal_entity_id uuid,               -- Empresa: public.company_legal_entities (CNPJ/CPF); FK added by 065 (#138)
+  metadata       jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at     timestamptz NOT NULL DEFAULT now(),
+  updated_at     timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (id),
+  UNIQUE (tenant_id, id),
+  UNIQUE (tenant_id, slug),
+  FOREIGN KEY (tenant_id, parent_unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL,
+  CHECK (parent_unit_id IS DISTINCT FROM id)
+);
+CREATE INDEX IF NOT EXISTS units_tenant_parent_idx ON app.units (tenant_id, parent_unit_id);
+CREATE UNIQUE INDEX IF NOT EXISTS units_one_hq_per_tenant ON app.units (tenant_id) WHERE kind = 'hq';
+DROP TRIGGER IF EXISTS units_updated_at ON app.units;
+CREATE TRIGGER units_updated_at BEFORE UPDATE ON app.units
+  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+-- ─────────────────────────────── RBAC catalog ──────────────────────────
+-- Global catalog: keys are '{plugin}.{action}', seeded by the platform and by
+-- each plugin's declaredFeatures (#136). A key is a row, never DDL.
+CREATE TABLE IF NOT EXISTS app.permissions (
+  key         text PRIMARY KEY,
+  plugin      text NOT NULL,
+  description text,
+  created_at  timestamptz NOT NULL DEFAULT now(),
+  CHECK (key ~ '^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_-]*)+$')
+);
+CREATE INDEX IF NOT EXISTS permissions_plugin_idx ON app.permissions (plugin);
+
+-- Roles per tenant. is_system rows come from the vertical template (owner,
+-- manager, reception, professional, …) and cannot be deleted; a tenant may add
+-- its own ("kit por cargo" of a network is a tenant role, not a system one).
+CREATE TABLE IF NOT EXISTS app.roles (
+  tenant_id  uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  id         uuid NOT NULL DEFAULT gen_random_uuid(),
+  key        text NOT NULL,
+  name       text NOT NULL,
+  description text,
+  is_system  boolean NOT NULL DEFAULT false,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_id, id),
+  UNIQUE (id),
+  UNIQUE (tenant_id, key),
+  CHECK (key ~ '^[a-z][a-z0-9_-]*$')
+);
+DROP TRIGGER IF EXISTS roles_updated_at ON app.roles;
+CREATE TRIGGER roles_updated_at BEFORE UPDATE ON app.roles
+  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+CREATE TABLE IF NOT EXISTS app.role_permissions (
+  tenant_id  uuid NOT NULL,
+  role_id    uuid NOT NULL,
+  permission text NOT NULL REFERENCES app.permissions(key) ON DELETE CASCADE,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_id, role_id, permission),
+  FOREIGN KEY (tenant_id, role_id) REFERENCES app.roles(tenant_id, id) ON DELETE CASCADE
+);
+CREATE INDEX IF NOT EXISTS role_permissions_perm_idx ON app.role_permissions (tenant_id, permission);
+
+-- ─────────────────────────────── Membership ────────────────────────────
+-- One membership per (tenant, user): the base role, whether the user sees every
+-- unit (franchisor / network owner), and whether it is active. person_id links
+-- the login to the one Person of that human in the tenant (#137).
+CREATE TABLE IF NOT EXISTS app.memberships (
+  tenant_id  uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  user_id    uuid NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+  id         uuid NOT NULL DEFAULT gen_random_uuid(),
+  role_id    uuid NOT NULL,
+  all_units  boolean NOT NULL DEFAULT false,
+  active     boolean NOT NULL DEFAULT true,
+  person_id  uuid,
+  invited_by uuid,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_id, user_id),
+  UNIQUE (id),
+  FOREIGN KEY (tenant_id, role_id) REFERENCES app.roles(tenant_id, id)
+);
+CREATE INDEX IF NOT EXISTS memberships_user_idx ON app.memberships (user_id) WHERE active;
+CREATE INDEX IF NOT EXISTS memberships_role_idx ON app.memberships (tenant_id, role_id);
+DROP TRIGGER IF EXISTS memberships_updated_at ON app.memberships;
+CREATE TRIGGER memberships_updated_at BEFORE UPDATE ON app.memberships
+  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+-- Explicit units of a member (Toast/Square style) with an optional per-unit
+-- role override — the effective role in that unit (§8).
+CREATE TABLE IF NOT EXISTS app.membership_units (
+  tenant_id        uuid NOT NULL,
+  user_id          uuid NOT NULL,
+  unit_id          uuid NOT NULL,
+  role_override_id uuid,
+  created_at       timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_id, user_id, unit_id),
+  FOREIGN KEY (tenant_id, user_id) REFERENCES app.memberships(tenant_id, user_id) ON DELETE CASCADE,
+  FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE CASCADE,
+  FOREIGN KEY (tenant_id, role_override_id) REFERENCES app.roles(tenant_id, id)
+);
+CREATE INDEX IF NOT EXISTS membership_units_unit_idx ON app.membership_units (tenant_id, unit_id);
+
+-- ─────────────── Precomputed scope (Salesforce-style share table) ───────
+-- DERIVED. Maintained by the fan-out triggers (042) and the reconciliation job.
+-- Never written by app code: no INSERT/UPDATE/DELETE grant to any API role.
+CREATE TABLE IF NOT EXISTS app.user_unit_access (
+  tenant_id uuid NOT NULL,
+  user_id   uuid NOT NULL,
+  unit_id   uuid NOT NULL,
+  via       text NOT NULL CHECK (via IN ('all_units', 'explicit', 'subtree')),
+  PRIMARY KEY (tenant_id, user_id, unit_id),
+  FOREIGN KEY (tenant_id, user_id) REFERENCES app.memberships(tenant_id, user_id) ON DELETE CASCADE,
+  FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE CASCADE
+);
+CREATE INDEX IF NOT EXISTS user_unit_access_unit_idx ON app.user_unit_access (tenant_id, unit_id);
+
+-- Diff-log of every reconciliation run (§6). diff <> 0 outside a migration is
+-- an incident, not a perf issue: v_authz_reconciliation_alerts (043) lists them.
+CREATE TABLE IF NOT EXISTS app.authz_reconciliation_log (
+  id         bigserial PRIMARY KEY,
+  tenant_id  uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  run_at     timestamptz NOT NULL DEFAULT now(),
+  source     text NOT NULL CHECK (source IN ('migration', 'scheduled', 'manual', 'test')),
+  added      integer NOT NULL DEFAULT 0,
+  removed    integer NOT NULL DEFAULT 0,
+  details    jsonb NOT NULL DEFAULT '[]'::jsonb
+);
+CREATE INDEX IF NOT EXISTS authz_reconciliation_log_tenant_idx ON app.authz_reconciliation_log (tenant_id, run_at DESC);
+
+-- ─────────────── Generic relation tuples (ERPNext UserPermission / Zanzibar) ───
+CREATE TABLE IF NOT EXISTS app.resource_grants (
+  tenant_id     uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  resource_type text NOT NULL,   -- plugin-namespaced: 'catalog.product', 'people.person', …
+  resource_id   uuid NOT NULL,
+  relation      text NOT NULL,   -- 'available_in', 'owner', 'shared_with', 'visible_to', …
+  subject_type  text NOT NULL CHECK (subject_type IN ('user', 'unit', 'role')),
+  subject_id    uuid NOT NULL,
+  created_by    uuid,
+  created_at    timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_id, resource_type, resource_id, relation, subject_type, subject_id),
+  CHECK (resource_type ~ '^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)*$'),
+  CHECK (relation ~ '^[a-z][a-z0-9_]*$')
+);
+-- Reverse lookup: "what can this subject access?"
+CREATE INDEX IF NOT EXISTS resource_grants_subject_idx
+  ON app.resource_grants (tenant_id, subject_type, subject_id, relation, resource_type);
+
+-- ─────────────────────────────── Grants ────────────────────────────────
+-- Reads for every API role that has a session; RLS (below) narrows to the
+-- caller's tenant. Writes only where a policy exists to gate them.
+GRANT SELECT ON app.units, app.permissions, app.roles, app.role_permissions,
+                app.memberships, app.membership_units, app.user_unit_access,
+                app.resource_grants, app.authz_reconciliation_log TO authenticated;
+GRANT INSERT, UPDATE, DELETE ON app.units, app.roles, app.role_permissions,
+                app.memberships, app.membership_units, app.resource_grants TO authenticated;
+GRANT ALL ON ALL TABLES IN SCHEMA app TO service_role;
+GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA app TO service_role;
+-- user_unit_access is derived: no API role may write it (the trigger functions
+-- are SECURITY DEFINER and owned by the migration role).
+REVOKE INSERT, UPDATE, DELETE ON app.user_unit_access FROM authenticated, anon;
+REVOKE ALL ON app.permissions FROM anon;
+REVOKE INSERT, UPDATE, DELETE ON app.permissions FROM authenticated;
+ALTER DEFAULT PRIVILEGES IN SCHEMA app REVOKE ALL ON TABLES FROM anon;
+ALTER DEFAULT PRIVILEGES IN SCHEMA app REVOKE EXECUTE ON FUNCTIONS FROM public, anon;
+
+-- ─────────────────────────────── RLS on the authz tables ────────────────
+-- The helpers of 041 are needed by the policies below; 041 runs after this file,
+-- so the policies are (re)created at the end of 041 where the functions exist.
+ALTER TABLE app.units ENABLE ROW LEVEL SECURITY;
+ALTER TABLE app.units FORCE ROW LEVEL SECURITY;
+ALTER TABLE app.permissions ENABLE ROW LEVEL SECURITY;
+ALTER TABLE app.roles ENABLE ROW LEVEL SECURITY;
+ALTER TABLE app.roles FORCE ROW LEVEL SECURITY;
+ALTER TABLE app.role_permissions ENABLE ROW LEVEL SECURITY;
+ALTER TABLE app.role_permissions FORCE ROW LEVEL SECURITY;
+ALTER TABLE app.memberships ENABLE ROW LEVEL SECURITY;
+ALTER TABLE app.memberships FORCE ROW LEVEL SECURITY;
+ALTER TABLE app.membership_units ENABLE ROW LEVEL SECURITY;
+ALTER TABLE app.membership_units FORCE ROW LEVEL SECURITY;
+ALTER TABLE app.user_unit_access ENABLE ROW LEVEL SECURITY;
+ALTER TABLE app.user_unit_access FORCE ROW LEVEL SECURITY;
+ALTER TABLE app.resource_grants ENABLE ROW LEVEL SECURITY;
+ALTER TABLE app.resource_grants FORCE ROW LEVEL SECURITY;
+ALTER TABLE app.authz_reconciliation_log ENABLE ROW LEVEL SECURITY;
+ALTER TABLE app.authz_reconciliation_log FORCE ROW LEVEL SECURITY;
+
+-- The catalog is global and harmless to read: every signed-in user may list it.
+DROP POLICY IF EXISTS permissions_select ON app.permissions;
+CREATE POLICY permissions_select ON app.permissions FOR SELECT TO authenticated USING (true);

package/migrations/051_authz_helpers.sql

@@ -0,0 +1,330 @@
+-- ============================================================================
+-- 051_authz_helpers.sql — the RLS helpers (§7) and effective role (§8).
+--
+-- All `STABLE SECURITY DEFINER SET search_path = ''`, meant to be called wrapped
+-- in `(select …)` so the planner caches them per statement (initPlan). They
+-- read the authz tables with the migration role's privileges (no recursion into
+-- RLS) and never raise: an RLS policy is not a place to throw, so junk resolves
+-- to "no access".
+--
+-- Also here: the RLS policies of the authz tables themselves (040 could not
+-- create them before the helpers existed).
+-- ============================================================================
+
+-- ── current_tenant_id() ─────────────────────────────────────────────────
+-- The tenant this request acts in. Same claim semantics as public.user_tenant_ids()
+-- (028): a top-level `tenant_id` JWT claim NARROWS and never widens — with a
+-- signed-in session it must match an active membership; a session-less signed
+-- token is scoped by the claim alone (only we can mint one). Without a claim,
+-- a user with exactly one active membership acts in it; a multi-tenant user
+-- without a claim acts in none (fail closed — the app sets the claim / active
+-- tenant). Only tenant_id (and, later, the active unit) live in the JWT:
+-- permissions and unit scope always come from tables (revocation is instant).
+CREATE OR REPLACE FUNCTION app.current_tenant_id()
+RETURNS uuid
+LANGUAGE plpgsql STABLE SECURITY DEFINER
+SET search_path = ''
+AS $$
+DECLARE
+  v_uid    uuid := auth.uid();
+  v_jwt    jsonb := coalesce(auth.jwt(), '{}'::jsonb);
+  v_raw    text;
+  v_tenant uuid;
+  v_n      integer;
+BEGIN
+  IF jsonb_exists(v_jwt, 'tenant_id') THEN
+    v_raw := v_jwt ->> 'tenant_id';
+    -- Presence expresses intent to be narrowed; an unparseable value is no tenant.
+    IF v_raw IS NULL OR v_raw !~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$' THEN
+      RETURN NULL;
+    END IF;
+    v_tenant := v_raw::uuid;
+    IF v_uid IS NULL THEN
+      RETURN v_tenant;
+    END IF;
+    IF EXISTS (SELECT 1 FROM app.memberships m WHERE m.tenant_id = v_tenant AND m.user_id = v_uid AND m.active) THEN
+      RETURN v_tenant;
+    END IF;
+    RETURN NULL;
+  END IF;
+
+  IF v_uid IS NULL THEN
+    RETURN NULL;
+  END IF;
+  SELECT count(*), (array_agg(m.tenant_id))[1] INTO v_n, v_tenant
+    FROM app.memberships m WHERE m.user_id = v_uid AND m.active;
+  IF v_n = 1 THEN
+    RETURN v_tenant;
+  END IF;
+  RETURN NULL;
+END $$;
+
+-- ── unit_scoping_on() — the per-account switch main already had ─────────
+-- `039_unit_tree` gave every tenant a `unit_scoping_enabled`, off by default,
+-- and that is a better design than the always-on this chain originally shipped:
+-- a network turns it on when it is ready, and turning it off gives everything
+-- back without moving a row. The policy template honours that switch instead of
+-- replacing it.
+--
+-- Switch off ⇒ every unit of the account is yours, which is exactly the
+-- behaviour from before units existed.
+CREATE OR REPLACE FUNCTION app.unit_scoping_on()
+RETURNS boolean
+LANGUAGE sql STABLE SECURITY DEFINER
+SET search_path = ''
+AS $$
+  SELECT coalesce((SELECT t.unit_scoping_enabled FROM public.tenants t
+                    WHERE t.id = app.current_tenant_id()), false);
+$$;
+REVOKE ALL ON FUNCTION app.unit_scoping_on() FROM public, anon;
+GRANT EXECUTE ON FUNCTION app.unit_scoping_on() TO authenticated, service_role;
+
+-- ── has_unit(unit) ──────────────────────────────────────────────────────
+-- O(1) on the share table's PK. A NULL unit is a tenant-wide resource: the
+-- template checks `unit_id IS NULL OR has_unit(unit_id)` itself.
+CREATE OR REPLACE FUNCTION app.has_unit(p_unit uuid)
+RETURNS boolean
+LANGUAGE sql STABLE SECURITY DEFINER
+SET search_path = ''
+AS $$
+  SELECT p_unit IS NOT NULL
+     AND CASE WHEN app.unit_scoping_on()
+              THEN EXISTS (SELECT 1 FROM app.user_unit_access a
+                            WHERE a.tenant_id = app.current_tenant_id()
+                              AND a.user_id = auth.uid()
+                              AND a.unit_id = p_unit)
+              -- switch off: every unit of the account is yours
+              ELSE EXISTS (SELECT 1 FROM app.units u
+                            WHERE u.id = p_unit AND u.tenant_id = app.current_tenant_id())
+         END;
+$$;
+
+-- ── effective_role_id(tenant, user, unit) ───────────────────────────────
+-- §8: membership_units.role_override_id when present for (user, unit), else
+-- memberships.role_id. Inactive membership ⇒ no role.
+CREATE OR REPLACE FUNCTION app.effective_role_id(p_tenant uuid, p_user uuid, p_unit uuid DEFAULT NULL)
+RETURNS uuid
+LANGUAGE sql STABLE SECURITY DEFINER
+SET search_path = ''
+AS $$
+  SELECT coalesce(
+    (SELECT mu.role_override_id
+       FROM app.membership_units mu
+      WHERE p_unit IS NOT NULL
+        AND mu.tenant_id = p_tenant AND mu.user_id = p_user AND mu.unit_id = p_unit
+        AND mu.role_override_id IS NOT NULL),
+    (SELECT m.role_id
+       FROM app.memberships m
+      WHERE m.tenant_id = p_tenant AND m.user_id = p_user AND m.active)
+  );
+$$;
+
+-- ── has_permission(perm[, unit]) ────────────────────────────────────────
+-- Resolves against the effective role for the row's unit when one is given,
+-- else the base role. `{feature}.manage` implies every `{feature}.{action}`
+-- (the SDK's resolveAccess semantics, mirrored — same source, no drift). No
+-- owner bypass: an owner is a role whose permission set is the whole catalog.
+CREATE OR REPLACE FUNCTION app.has_permission(p_perm text, p_unit uuid DEFAULT NULL)
+RETURNS boolean
+LANGUAGE sql STABLE SECURITY DEFINER
+SET search_path = ''
+AS $$
+  SELECT EXISTS (
+    SELECT 1
+      FROM app.role_permissions rp
+     WHERE rp.tenant_id = app.current_tenant_id()
+       AND rp.role_id = app.effective_role_id(app.current_tenant_id(), auth.uid(), p_unit)
+       AND rp.permission IN (p_perm, regexp_replace(p_perm, '\.[^.]+$', '.manage'))
+  );
+$$;
+
+-- Does the user hold the permission in ANY of their roles (base or any unit
+-- override)? For UI affordances and tenant-wide actions, not for row scope.
+CREATE OR REPLACE FUNCTION app.has_permission_anywhere(p_perm text)
+RETURNS boolean
+LANGUAGE sql STABLE SECURITY DEFINER
+SET search_path = ''
+AS $$
+  SELECT EXISTS (
+    SELECT 1
+      FROM app.role_permissions rp
+     WHERE rp.tenant_id = app.current_tenant_id()
+       AND rp.permission IN (p_perm, regexp_replace(p_perm, '\.[^.]+$', '.manage'))
+       AND rp.role_id IN (
+         SELECT m.role_id FROM app.memberships m
+          WHERE m.tenant_id = rp.tenant_id AND m.user_id = auth.uid() AND m.active
+         UNION
+         SELECT mu.role_override_id FROM app.membership_units mu
+          WHERE mu.tenant_id = rp.tenant_id AND mu.user_id = auth.uid() AND mu.role_override_id IS NOT NULL
+       )
+  );
+$$;
+
+-- ── has_grant(type, id, relations[]) ────────────────────────────────────
+-- resource_grants where the subject is me, one of my units, or one of my roles.
+CREATE OR REPLACE FUNCTION app.has_grant(p_type text, p_id uuid, p_relations text[])
+RETURNS boolean
+LANGUAGE sql STABLE SECURITY DEFINER
+SET search_path = ''
+AS $$
+  SELECT EXISTS (
+    SELECT 1
+      FROM app.resource_grants g
+     WHERE g.tenant_id = app.current_tenant_id()
+       AND g.resource_type = p_type
+       AND g.resource_id = p_id
+       AND g.relation = ANY (p_relations)
+       AND (
+            (g.subject_type = 'user' AND g.subject_id = auth.uid())
+         OR (g.subject_type = 'unit' AND EXISTS (
+               SELECT 1 FROM app.user_unit_access a
+                WHERE a.tenant_id = g.tenant_id AND a.user_id = auth.uid() AND a.unit_id = g.subject_id))
+         OR (g.subject_type = 'role' AND g.subject_id IN (
+               SELECT m.role_id FROM app.memberships m
+                WHERE m.tenant_id = g.tenant_id AND m.user_id = auth.uid() AND m.active
+               UNION
+               SELECT mu.role_override_id FROM app.membership_units mu
+                WHERE mu.tenant_id = g.tenant_id AND mu.user_id = auth.uid() AND mu.role_override_id IS NOT NULL))
+       )
+  );
+$$;
+
+-- "No available_in tuples ⇒ available everywhere" (§9.1): a tenant-wide
+-- resource is visible in a unit unless the resource has been restricted, in
+-- which case the unit must be one of the granted ones.
+CREATE OR REPLACE FUNCTION app.available_in_my_units(p_type text, p_id uuid)
+RETURNS boolean
+LANGUAGE sql STABLE SECURITY DEFINER
+SET search_path = ''
+AS $$
+  SELECT NOT EXISTS (
+           SELECT 1 FROM app.resource_grants g
+            WHERE g.tenant_id = app.current_tenant_id()
+              AND g.resource_type = p_type AND g.resource_id = p_id AND g.relation = 'available_in')
+      OR app.has_grant(p_type, p_id, ARRAY['available_in']);
+$$;
+
+-- ── is_member(tenant) ───────────────────────────────────────────────────
+-- Plain active membership, no permission — what the authz tables' own read
+-- policies need ("members see their tenant's units and roles").
+CREATE OR REPLACE FUNCTION app.is_member(p_tenant uuid)
+RETURNS boolean
+LANGUAGE sql STABLE SECURITY DEFINER
+SET search_path = ''
+AS $$
+  SELECT EXISTS (
+    SELECT 1 FROM app.memberships m
+     WHERE m.tenant_id = p_tenant AND m.user_id = auth.uid() AND m.active
+  );
+$$;
+
+REVOKE ALL ON FUNCTION app.current_tenant_id() FROM public;
+REVOKE ALL ON FUNCTION app.has_unit(uuid) FROM public;
+REVOKE ALL ON FUNCTION app.effective_role_id(uuid, uuid, uuid) FROM public;
+REVOKE ALL ON FUNCTION app.has_permission(text, uuid) FROM public;
+REVOKE ALL ON FUNCTION app.has_permission_anywhere(text) FROM public;
+REVOKE ALL ON FUNCTION app.has_grant(text, uuid, text[]) FROM public;
+REVOKE ALL ON FUNCTION app.available_in_my_units(text, uuid) FROM public;
+REVOKE ALL ON FUNCTION app.is_member(uuid) FROM public;
+GRANT EXECUTE ON FUNCTION app.current_tenant_id() TO authenticated, service_role;
+GRANT EXECUTE ON FUNCTION app.has_unit(uuid) TO authenticated, service_role;
+GRANT EXECUTE ON FUNCTION app.effective_role_id(uuid, uuid, uuid) TO authenticated, service_role;
+GRANT EXECUTE ON FUNCTION app.has_permission(text, uuid) TO authenticated, service_role;
+GRANT EXECUTE ON FUNCTION app.has_permission_anywhere(text) TO authenticated, service_role;
+GRANT EXECUTE ON FUNCTION app.has_grant(text, uuid, text[]) TO authenticated, service_role;
+GRANT EXECUTE ON FUNCTION app.available_in_my_units(text, uuid) TO authenticated, service_role;
+GRANT EXECUTE ON FUNCTION app.is_member(uuid) TO authenticated, service_role;
+
+-- ═══════════════════════ RLS on the authz tables ══════════════════════════
+-- Reads: any active member of the tenant sees the tenant's units, roles and
+-- role permissions (the UI needs them to render); memberships and unit rows are
+-- visible to the member herself and to holders of members.read; the share table
+-- to the user herself and to members.read; grants to members of the tenant.
+-- Writes: platform permission keys — no owner/admin literal anywhere.
+
+-- units
+DROP POLICY IF EXISTS units_select ON app.units;
+CREATE POLICY units_select ON app.units FOR SELECT TO authenticated
+  USING ((select app.is_member(tenant_id)));
+DROP POLICY IF EXISTS units_insert ON app.units;
+CREATE POLICY units_insert ON app.units FOR INSERT TO authenticated
+  WITH CHECK (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('units.manage')));
+DROP POLICY IF EXISTS units_update ON app.units;
+CREATE POLICY units_update ON app.units FOR UPDATE TO authenticated
+  USING (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('units.manage')))
+  WITH CHECK (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('units.manage')));
+DROP POLICY IF EXISTS units_delete ON app.units;
+CREATE POLICY units_delete ON app.units FOR DELETE TO authenticated
+  USING (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('units.manage')));
+
+-- roles
+DROP POLICY IF EXISTS roles_select ON app.roles;
+CREATE POLICY roles_select ON app.roles FOR SELECT TO authenticated
+  USING ((select app.is_member(tenant_id)));
+DROP POLICY IF EXISTS roles_insert ON app.roles;
+CREATE POLICY roles_insert ON app.roles FOR INSERT TO authenticated
+  WITH CHECK (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('roles.manage')) AND NOT is_system);
+DROP POLICY IF EXISTS roles_update ON app.roles;
+CREATE POLICY roles_update ON app.roles FOR UPDATE TO authenticated
+  USING (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('roles.manage')))
+  WITH CHECK (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('roles.manage')));
+DROP POLICY IF EXISTS roles_delete ON app.roles;
+CREATE POLICY roles_delete ON app.roles FOR DELETE TO authenticated
+  USING (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('roles.manage')) AND NOT is_system);
+
+-- role_permissions
+DROP POLICY IF EXISTS role_permissions_select ON app.role_permissions;
+CREATE POLICY role_permissions_select ON app.role_permissions FOR SELECT TO authenticated
+  USING ((select app.is_member(tenant_id)));
+DROP POLICY IF EXISTS role_permissions_write ON app.role_permissions;
+CREATE POLICY role_permissions_write ON app.role_permissions FOR ALL TO authenticated
+  USING (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('roles.manage')))
+  WITH CHECK (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('roles.manage')));
+
+-- memberships: yourself, or members.read; writes need members.manage and can
+-- never be a self-insert (the P0 of the old model) — creation of the first
+-- member is the create_tenant RPC's job (#134).
+DROP POLICY IF EXISTS memberships_select ON app.memberships;
+CREATE POLICY memberships_select ON app.memberships FOR SELECT TO authenticated
+  USING (user_id = (select auth.uid()) OR (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.read'))));
+DROP POLICY IF EXISTS memberships_insert ON app.memberships;
+CREATE POLICY memberships_insert ON app.memberships FOR INSERT TO authenticated
+  WITH CHECK (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.manage')) AND user_id <> (select auth.uid()));
+DROP POLICY IF EXISTS memberships_update ON app.memberships;
+CREATE POLICY memberships_update ON app.memberships FOR UPDATE TO authenticated
+  USING (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.manage')))
+  WITH CHECK (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.manage')));
+DROP POLICY IF EXISTS memberships_delete ON app.memberships;
+CREATE POLICY memberships_delete ON app.memberships FOR DELETE TO authenticated
+  USING (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.manage')) AND user_id <> (select auth.uid()));
+
+-- membership_units
+DROP POLICY IF EXISTS membership_units_select ON app.membership_units;
+CREATE POLICY membership_units_select ON app.membership_units FOR SELECT TO authenticated
+  USING (user_id = (select auth.uid()) OR (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.read'))));
+DROP POLICY IF EXISTS membership_units_write ON app.membership_units;
+CREATE POLICY membership_units_write ON app.membership_units FOR ALL TO authenticated
+  USING (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.manage')))
+  WITH CHECK (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.manage')));
+
+-- user_unit_access: read-only surface (the share table)
+DROP POLICY IF EXISTS user_unit_access_select ON app.user_unit_access;
+CREATE POLICY user_unit_access_select ON app.user_unit_access FOR SELECT TO authenticated
+  USING (user_id = (select auth.uid()) OR (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.read'))));
+
+-- resource_grants: members read; writing a tuple needs the platform key
+-- authz.grants.manage or the resource's own '{plugin}.manage' (§12.9 default).
+DROP POLICY IF EXISTS resource_grants_select ON app.resource_grants;
+CREATE POLICY resource_grants_select ON app.resource_grants FOR SELECT TO authenticated
+  USING ((select app.is_member(tenant_id)));
+DROP POLICY IF EXISTS resource_grants_write ON app.resource_grants;
+CREATE POLICY resource_grants_write ON app.resource_grants FOR ALL TO authenticated
+  USING (tenant_id = (select app.current_tenant_id())
+         AND ((select app.has_permission('authz.grants.manage')) OR (select app.has_permission(split_part(resource_type, '.', 1) || '.manage'))))
+  WITH CHECK (tenant_id = (select app.current_tenant_id())
+         AND ((select app.has_permission('authz.grants.manage')) OR (select app.has_permission(split_part(resource_type, '.', 1) || '.manage'))));
+
+-- reconciliation log: readable by members.read of the tenant
+DROP POLICY IF EXISTS authz_reconciliation_log_select ON app.authz_reconciliation_log;
+CREATE POLICY authz_reconciliation_log_select ON app.authz_reconciliation_log FOR SELECT TO authenticated
+  USING (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.read')));