@fayz-ai/db 0.12.0 → 0.13.0

package/canonical-schema.json

@@ -0,0 +1,49 @@
+{
+  "$comment": "The canonical schema (#279, ADR 0022). ONE schema on every cluster: the spine plus every plugin that has passed the capability gate. The pool profiles in cli/pool-profiles/ stop deciding what a cluster HAS and become activation defaults — what a new tenant of that industry gets turned on, which is configuration and lives in the database (ADR 0023, migration 150). What varies per cluster is data, never DDL. A plugin joins `plugins` below when its gate is green; until then it is in `pending`, with the reason, and it exists in no cluster at all.",
+  "version": 1,
+  "plugins": [
+    {
+      "id": "financial",
+      "dir": "plugins/plugin-financial/src/migrations",
+      "gate": "capability",
+      "$note": "core-A. In three of the four live pools already."
+    },
+    {
+      "id": "inventory",
+      "dir": "plugins/plugin-inventory/src/migrations",
+      "gate": "capability",
+      "$note": "core-A. Sole writer of the stock archetype since #276."
+    },
+    {
+      "id": "tasks",
+      "dir": "plugins/plugin-tasks/src/migrations",
+      "gate": "enforced",
+      "$note": "The only plugin at ENFORCED — the reference implementation."
+    }
+  ],
+  "pending": [
+    { "id": "agenda", "reason": "Owns the species of the Compromisso archetype; the Google Calendar integration inside it has to come out as an addon first (#285's rule, ADR 0024)." },
+    { "id": "crm", "reason": "Installed in three pools; capability gate not green (seed + capability tests missing)." },
+    { "id": "forms", "reason": "Creates public.documents, which the base owns since 152 — the guarded CREATE has to go (#282)." },
+    { "id": "marketing", "reason": "Capability gate not green." },
+    { "id": "menu", "reason": "Nine tables of its own and no capability suite yet." },
+    { "id": "shop", "reason": "Its data lives in packages/shop, not in the plugin, and it still keeps a second stock book (#276's remaining half)." },
+    { "id": "courses", "reason": "Its data lives in packages/courses, not in the plugin (#285)." },
+    { "id": "conversations", "reason": "Capability gate not green." },
+    { "id": "automations", "reason": "Creates public.event_log, which the base owns; the copy is a guarded no-op that should go." },
+    { "id": "blog", "reason": "Capability gate not green." },
+    { "id": "reputation", "reason": "Capability gate not green." },
+    { "id": "scribe", "reason": "Capability gate not green." },
+    { "id": "banking-br", "reason": "Addon of financial; capability gate not green." },
+    { "id": "admin", "reason": "No data of its own — the base absorbed what it was for (#274 rule 1)." },
+    { "id": "auth", "reason": "No data of its own — same." },
+    { "id": "orders", "reason": "The Venda is a base archetype; nothing is left for a plugin to own." },
+    { "id": "dashboard", "reason": "A mechanism other plugins feed; no capability suite yet." },
+    { "id": "reports", "reason": "Same." },
+    { "id": "payments", "reason": "Never built." },
+    { "id": "sites", "reason": "Never built." },
+    { "id": "linkinbio", "reason": "Never built." },
+    { "id": "tables", "reason": "Never built; will own the restaurant floor when it is." },
+    { "id": "agent-runtime", "reason": "A library, not a plugin — it is base (rodada 3 Q1)." }
+  ]
+}

package/migrations/010_migration_ledger.sql

@@ -33,4 +33,14 @@ ALTER TABLE public._migrations ENABLE ROW LEVEL SECURITY;
 -- service_role (which bypasses RLS anyway). No policies = no anon/authenticated access.
 REVOKE ALL ON public._migrations FROM anon, authenticated;
 GRANT ALL ON public._migrations TO service_role;
-GRANT USAGE, SELECT ON SEQUENCE public._migrations_id_seq TO service_role;
+-- The sequence, WHATEVER IT IS CALLED. A legacy pool whose table was renamed
+-- ahead of 012 still owns fayz_migration_ledger_id_seq, and naming the new one
+-- here would stop the chain twelve files before the migration that renames it.
+-- pg_get_serial_sequence asks the column instead of guessing.
+DO $$
+DECLARE v_seq text := pg_get_serial_sequence('public._migrations', 'id');
+BEGIN
+  IF v_seq IS NOT NULL THEN
+    EXECUTE format('GRANT USAGE, SELECT ON SEQUENCE %s TO service_role', v_seq);
+  END IF;
+END $$;

package/migrations/040_resource_grants.sql

@@ -1,5 +1,5 @@
 -- ============================================================================
--- 040_resource_grants.sql — the exception to the default, written down.
+-- 050_resource_grants.sql — the exception to the default, written down.
 --
 -- Unit scoping (039) answers "which units do I reach". It cannot answer the two
 -- questions the product actually asks:
@@ -201,7 +201,7 @@ ALTER TABLE public.resource_grants ENABLE ROW LEVEL SECURITY;
 
 -- ── Helpers ─────────────────────────────────────────────────────────────────
 -- Same discipline as 039: one argument at most, and it is a CONSTANT baked into
--- the policy text by 042's generator, never a column. A helper taking the row's
+-- the policy text by 052's generator, never a column. A helper taking the row's
 -- own values would be correlated and re-run per row.
 --
 -- SECURITY DEFINER because they read `resource_grants`, whose own policies

package/migrations/041_scoped_columns.sql

@@ -1,5 +1,5 @@
 -- ============================================================================
--- 041_scoped_columns.sql — the signature every record starts carrying.
+-- 051_scoped_columns.sql — the signature every record starts carrying.
 --
 -- 025 gave every core table a `created_by`, because "who registered this?" had
 -- no answer anywhere. This file adds the other two halves of the same question:
@@ -170,7 +170,7 @@ END $$;
 -- that actually turned unit scoping on, because that is the only set 042 ever
 -- asks about — and it keeps this set small enough to hash once per query.
 --
--- Two arguments, both constants baked into the policy text by 042's generator,
+-- Two arguments, both constants baked into the policy text by 052's generator,
 -- so it stays uncorrelated: one InitPlan per query, not one call per row.
 CREATE OR REPLACE FUNCTION public.resource_mode_tenants(p_table text, p_mode text)
 RETURNS SETOF uuid

package/migrations/042_unit_scope_policies.sql

@@ -1,5 +1,5 @@
 -- ============================================================================
--- 042_unit_scope_policies.sql — the only file here that changes an answer.
+-- 052_unit_scope_policies.sql — the only file here that changes an answer.
 --
 -- WHY A RESTRICTIVE POLICY AND NOT A REWRITE. The obvious move is to extend the
 -- canonical predicate — `tenant_id IN (SELECT public.user_tenant_ids()) AND …`

package/migrations/043_view_invoker.sql

@@ -1,8 +1,8 @@
 -- ============================================================================
--- 043_view_invoker.sql — the views that were never anybody's tenant.
+-- 053_view_invoker.sql — the views that were never anybody's tenant.
 --
 -- THIS IS NOT PART OF UNIT SCOPING. It is a cross-tenant hole that predates it,
--- found while auditing what 042's predicate would and would not reach, and it
+-- found while auditing what 052's predicate would and would not reach, and it
 -- has to close first or "the guarantee is the API's" is false on the day it
 -- ships.
 --
@@ -31,7 +31,16 @@
 --
 -- WHAT IS DELIBERATELY LEFT ALONE — the three anon-facing views:
 --
---     public.plg_shop_catalog       the storefront's product list
+--     public.plg_shop_catalog       built for the storefront, but NOT what it
+--                                   reads: the anon path goes at
+--                                   plg_shop_products under the
+--                                   `storefront_public_read` policy, which
+--                                   demands the store header (0019/0020). This
+--                                   view has no TypeScript caller at all. Kept
+--                                   definer because that is what it would need
+--                                   if anyone ever adopted it — and adopting it
+--                                   would TRADE AWAY that policy, so it is not
+--                                   the upgrade its shape suggests.
 --     public.v_public_services      public booking
 --     public.v_public_blog_posts    the public blog
 --

package/migrations/044_unit_member_facts.sql

@@ -1,5 +1,5 @@
 -- ============================================================================
--- 044_unit_member_facts.sql — the two facts a unit roster is asked for.
+-- 054_unit_member_facts.sql — the two facts a unit roster is asked for.
 --
 -- "Quem trabalha aqui" is never only a list of names. The two questions that
 -- follow it are always the same: since when, and are they actually using it.

package/migrations/045_unit_entry.sql

@@ -1,5 +1,5 @@
 -- ============================================================================
--- 045_unit_entry.sql — entrar no sistema já na unidade certa.
+-- 055_unit_entry.sql — entrar no sistema já na unidade certa.
 --
 -- A fronteira de unidade existe desde a 039. O que faltava era a pergunta que
 -- todo funcionário de rede responde toda manhã: "em qual loja eu estou?".

package/migrations/046_membership_visible_to_members.sql

@@ -1,5 +1,5 @@
 -- ============================================================================
--- 046_membership_visible_to_members.sql — a tela de equipe consegue ler a
+-- 056_membership_visible_to_members.sql — a tela de equipe consegue ler a
 -- própria equipe.
 --
 -- `members_select` da 001 é `user_id = auth.uid()`: cada pessoa enxerga **só a

package/migrations/047_tasks.sql

@@ -1,5 +1,5 @@
 -- ============================================================================
--- 047_tasks.sql — public.tasks: the one table admin work lives in.
+-- 057_tasks.sql — public.tasks: the one table admin work lives in.
 --
 -- WHY THIS IS SPINE AND NOT A PLUGIN TABLE. plugin-tasks has carried
 -- plg_tasks_tasks since its first release, with almost exactly these columns.
@@ -105,9 +105,9 @@ END $$;
 -- 041 generates one of these per table it knows about, but it is applied and
 -- checksum-frozen: it only ever iterates the list it shipped with. A table
 -- added afterwards brings its own copy. Keep this body in step with the
--- generator in 041_scoped_columns.sql — including the fact that IT MUST NEVER
+-- generator in 051_scoped_columns.sql — including the fact that IT MUST NEVER
 -- RAISE (SECURITY DEFINER RPCs insert here and a complaining BEFORE INSERT
--- trigger would take them down; validation is 042's WITH CHECK).
+-- trigger would take them down; validation is 052's WITH CHECK).
 CREATE OR REPLACE FUNCTION public.stamp_scope_tasks() RETURNS trigger
 LANGUAGE plpgsql SECURITY DEFINER SET search_path = public, pg_temp AS $body$
 BEGIN
@@ -195,7 +195,7 @@ BEGIN
   -- the factory setting, and re-running must not walk back an operator's choice.
 END $$;
 
--- The restrictive policy, from 042's generator. Same reason as the trigger
+-- The restrictive policy, from 052's generator. Same reason as the trigger
 -- above: 042 is frozen and only saw the registry as it stood then. The predicate
 -- text is read straight out of the registry so the two stay identical in shape;
 -- if 042 is ever superseded, this block must be revisited with it.

package/migrations/048_every_login_is_a_person.sql

@@ -1,5 +1,5 @@
 -- ============================================================================
--- 048_every_login_is_a_person.sql — quem entra no sistema é uma pessoa.
+-- 058_every_login_is_a_person.sql — quem entra no sistema é uma pessoa.
 --
 -- A 019 deixou o vínculo opcional nos dois sentidos, e documentou o porquê:
 -- "login-only account (e.g. the owner who signed up) -> person_id NULL". Na

package/migrations/049_bookable_people.sql

@@ -1,5 +1,5 @@
 -- ============================================================================
--- 049_bookable_people.sql — trabalhar aqui não é atender cliente.
+-- 059_bookable_people.sql — trabalhar aqui não é atender cliente.
 --
 -- A 048 passou a criar uma ficha para todo login, e a agenda lista como
 -- profissional toda pessoa de `kind = staff` que esteja ativa. O resultado

package/migrations/050_authz_core.sql

@@ -0,0 +1,230 @@
+-- ============================================================================
+-- 050_authz_core.sql — the authz core (ADR 0006 / PRD 01 / #133): schema §3.
+--
+-- Tenancy, RBAC catalog, membership, the precomputed unit scope and the generic
+-- relation tuples of the Multi-Tenant Authorization & Data Scoping
+-- Architecture v2. Exactly two authorization surfaces (user_unit_access,
+-- resource_grants) plus the RBAC catalog; business tables carry tenant_id /
+-- unit_id / owner_id and one RLS template (043) — nothing else decides access.
+--
+-- Where it lives (DECISIONS 2026-08-18): schema `app`, per the spec and the
+-- issue's default until the platform session rules otherwise. `public.tenants`
+-- stays the tenant table — every FK in the fleet already points at it — and
+-- gains `kind`. Reads for UI go through public.v_authz_* (043); writes through
+-- the RLS write policies below or the RPCs of #134.
+--
+-- Idempotent and replay-safe: IF NOT EXISTS / guarded DO blocks throughout;
+-- policies are DROP IF EXISTS + CREATE. Nothing here touches tenant_members
+-- or locations — retiring them is #134's migration, on top of this.
+-- ============================================================================
+
+CREATE SCHEMA IF NOT EXISTS app;
+GRANT USAGE ON SCHEMA app TO authenticated, service_role;
+-- anon deliberately gets nothing: the authz core has no anonymous surface.
+
+-- ─────────────────────────────── Tenancy ───────────────────────────────
+-- tenants(kind network|business): a network groups units under franchisee /
+-- regional parent units; a business is one company. ADR 0002 maps V1's licence
+-- to a tenant and V1's franchise mode to kind='network'.
+ALTER TABLE public.tenants ADD COLUMN IF NOT EXISTS kind text NOT NULL DEFAULT 'business';
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'tenants_kind_check' AND conrelid = 'public.tenants'::regclass) THEN
+    ALTER TABLE public.tenants ADD CONSTRAINT tenants_kind_check CHECK (kind IN ('network', 'business'));
+  END IF;
+END $$;
+
+CREATE TABLE IF NOT EXISTS app.units (
+  tenant_id      uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  id             uuid NOT NULL DEFAULT gen_random_uuid(),
+  kind           text NOT NULL CHECK (kind IN ('hq', 'branch')),
+  parent_unit_id uuid,                       -- grouping: franchisee, region (subtree propagation)
+  name           text NOT NULL,
+  slug           text,
+  active         boolean NOT NULL DEFAULT true,
+  company_legal_entity_id uuid,               -- Empresa: public.company_legal_entities (CNPJ/CPF); FK added by 065 (#138)
+  metadata       jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at     timestamptz NOT NULL DEFAULT now(),
+  updated_at     timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (id),
+  UNIQUE (tenant_id, id),
+  UNIQUE (tenant_id, slug),
+  FOREIGN KEY (tenant_id, parent_unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL,
+  CHECK (parent_unit_id IS DISTINCT FROM id)
+);
+CREATE INDEX IF NOT EXISTS units_tenant_parent_idx ON app.units (tenant_id, parent_unit_id);
+CREATE UNIQUE INDEX IF NOT EXISTS units_one_hq_per_tenant ON app.units (tenant_id) WHERE kind = 'hq';
+DROP TRIGGER IF EXISTS units_updated_at ON app.units;
+CREATE TRIGGER units_updated_at BEFORE UPDATE ON app.units
+  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+-- ─────────────────────────────── RBAC catalog ──────────────────────────
+-- Global catalog: keys are '{plugin}.{action}', seeded by the platform and by
+-- each plugin's declaredFeatures (#136). A key is a row, never DDL.
+CREATE TABLE IF NOT EXISTS app.permissions (
+  key         text PRIMARY KEY,
+  plugin      text NOT NULL,
+  description text,
+  created_at  timestamptz NOT NULL DEFAULT now(),
+  CHECK (key ~ '^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_-]*)+$')
+);
+CREATE INDEX IF NOT EXISTS permissions_plugin_idx ON app.permissions (plugin);
+
+-- Roles per tenant. is_system rows come from the vertical template (owner,
+-- manager, reception, professional, …) and cannot be deleted; a tenant may add
+-- its own ("kit por cargo" of a network is a tenant role, not a system one).
+CREATE TABLE IF NOT EXISTS app.roles (
+  tenant_id  uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  id         uuid NOT NULL DEFAULT gen_random_uuid(),
+  key        text NOT NULL,
+  name       text NOT NULL,
+  description text,
+  is_system  boolean NOT NULL DEFAULT false,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_id, id),
+  UNIQUE (id),
+  UNIQUE (tenant_id, key),
+  CHECK (key ~ '^[a-z][a-z0-9_-]*$')
+);
+DROP TRIGGER IF EXISTS roles_updated_at ON app.roles;
+CREATE TRIGGER roles_updated_at BEFORE UPDATE ON app.roles
+  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+CREATE TABLE IF NOT EXISTS app.role_permissions (
+  tenant_id  uuid NOT NULL,
+  role_id    uuid NOT NULL,
+  permission text NOT NULL REFERENCES app.permissions(key) ON DELETE CASCADE,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_id, role_id, permission),
+  FOREIGN KEY (tenant_id, role_id) REFERENCES app.roles(tenant_id, id) ON DELETE CASCADE
+);
+CREATE INDEX IF NOT EXISTS role_permissions_perm_idx ON app.role_permissions (tenant_id, permission);
+
+-- ─────────────────────────────── Membership ────────────────────────────
+-- One membership per (tenant, user): the base role, whether the user sees every
+-- unit (franchisor / network owner), and whether it is active. person_id links
+-- the login to the one Person of that human in the tenant (#137).
+CREATE TABLE IF NOT EXISTS app.memberships (
+  tenant_id  uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  user_id    uuid NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+  id         uuid NOT NULL DEFAULT gen_random_uuid(),
+  role_id    uuid NOT NULL,
+  all_units  boolean NOT NULL DEFAULT false,
+  active     boolean NOT NULL DEFAULT true,
+  person_id  uuid,
+  invited_by uuid,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_id, user_id),
+  UNIQUE (id),
+  FOREIGN KEY (tenant_id, role_id) REFERENCES app.roles(tenant_id, id)
+);
+CREATE INDEX IF NOT EXISTS memberships_user_idx ON app.memberships (user_id) WHERE active;
+CREATE INDEX IF NOT EXISTS memberships_role_idx ON app.memberships (tenant_id, role_id);
+DROP TRIGGER IF EXISTS memberships_updated_at ON app.memberships;
+CREATE TRIGGER memberships_updated_at BEFORE UPDATE ON app.memberships
+  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+-- Explicit units of a member (Toast/Square style) with an optional per-unit
+-- role override — the effective role in that unit (§8).
+CREATE TABLE IF NOT EXISTS app.membership_units (
+  tenant_id        uuid NOT NULL,
+  user_id          uuid NOT NULL,
+  unit_id          uuid NOT NULL,
+  role_override_id uuid,
+  created_at       timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_id, user_id, unit_id),
+  FOREIGN KEY (tenant_id, user_id) REFERENCES app.memberships(tenant_id, user_id) ON DELETE CASCADE,
+  FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE CASCADE,
+  FOREIGN KEY (tenant_id, role_override_id) REFERENCES app.roles(tenant_id, id)
+);
+CREATE INDEX IF NOT EXISTS membership_units_unit_idx ON app.membership_units (tenant_id, unit_id);
+
+-- ─────────────── Precomputed scope (Salesforce-style share table) ───────
+-- DERIVED. Maintained by the fan-out triggers (042) and the reconciliation job.
+-- Never written by app code: no INSERT/UPDATE/DELETE grant to any API role.
+CREATE TABLE IF NOT EXISTS app.user_unit_access (
+  tenant_id uuid NOT NULL,
+  user_id   uuid NOT NULL,
+  unit_id   uuid NOT NULL,
+  via       text NOT NULL CHECK (via IN ('all_units', 'explicit', 'subtree')),
+  PRIMARY KEY (tenant_id, user_id, unit_id),
+  FOREIGN KEY (tenant_id, user_id) REFERENCES app.memberships(tenant_id, user_id) ON DELETE CASCADE,
+  FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE CASCADE
+);
+CREATE INDEX IF NOT EXISTS user_unit_access_unit_idx ON app.user_unit_access (tenant_id, unit_id);
+
+-- Diff-log of every reconciliation run (§6). diff <> 0 outside a migration is
+-- an incident, not a perf issue: v_authz_reconciliation_alerts (043) lists them.
+CREATE TABLE IF NOT EXISTS app.authz_reconciliation_log (
+  id         bigserial PRIMARY KEY,
+  tenant_id  uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  run_at     timestamptz NOT NULL DEFAULT now(),
+  source     text NOT NULL CHECK (source IN ('migration', 'scheduled', 'manual', 'test')),
+  added      integer NOT NULL DEFAULT 0,
+  removed    integer NOT NULL DEFAULT 0,
+  details    jsonb NOT NULL DEFAULT '[]'::jsonb
+);
+CREATE INDEX IF NOT EXISTS authz_reconciliation_log_tenant_idx ON app.authz_reconciliation_log (tenant_id, run_at DESC);
+
+-- ─────────────── Generic relation tuples (ERPNext UserPermission / Zanzibar) ───
+CREATE TABLE IF NOT EXISTS app.resource_grants (
+  tenant_id     uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  resource_type text NOT NULL,   -- plugin-namespaced: 'catalog.product', 'people.person', …
+  resource_id   uuid NOT NULL,
+  relation      text NOT NULL,   -- 'available_in', 'owner', 'shared_with', 'visible_to', …
+  subject_type  text NOT NULL CHECK (subject_type IN ('user', 'unit', 'role')),
+  subject_id    uuid NOT NULL,
+  created_by    uuid,
+  created_at    timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_id, resource_type, resource_id, relation, subject_type, subject_id),
+  CHECK (resource_type ~ '^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)*$'),
+  CHECK (relation ~ '^[a-z][a-z0-9_]*$')
+);
+-- Reverse lookup: "what can this subject access?"
+CREATE INDEX IF NOT EXISTS resource_grants_subject_idx
+  ON app.resource_grants (tenant_id, subject_type, subject_id, relation, resource_type);
+
+-- ─────────────────────────────── Grants ────────────────────────────────
+-- Reads for every API role that has a session; RLS (below) narrows to the
+-- caller's tenant. Writes only where a policy exists to gate them.
+GRANT SELECT ON app.units, app.permissions, app.roles, app.role_permissions,
+                app.memberships, app.membership_units, app.user_unit_access,
+                app.resource_grants, app.authz_reconciliation_log TO authenticated;
+GRANT INSERT, UPDATE, DELETE ON app.units, app.roles, app.role_permissions,
+                app.memberships, app.membership_units, app.resource_grants TO authenticated;
+GRANT ALL ON ALL TABLES IN SCHEMA app TO service_role;
+GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA app TO service_role;
+-- user_unit_access is derived: no API role may write it (the trigger functions
+-- are SECURITY DEFINER and owned by the migration role).
+REVOKE INSERT, UPDATE, DELETE ON app.user_unit_access FROM authenticated, anon;
+REVOKE ALL ON app.permissions FROM anon;
+REVOKE INSERT, UPDATE, DELETE ON app.permissions FROM authenticated;
+ALTER DEFAULT PRIVILEGES IN SCHEMA app REVOKE ALL ON TABLES FROM anon;
+ALTER DEFAULT PRIVILEGES IN SCHEMA app REVOKE EXECUTE ON FUNCTIONS FROM public, anon;
+
+-- ─────────────────────────────── RLS on the authz tables ────────────────
+-- The helpers of 041 are needed by the policies below; 041 runs after this file,
+-- so the policies are (re)created at the end of 041 where the functions exist.
+ALTER TABLE app.units ENABLE ROW LEVEL SECURITY;
+ALTER TABLE app.units FORCE ROW LEVEL SECURITY;
+ALTER TABLE app.permissions ENABLE ROW LEVEL SECURITY;
+ALTER TABLE app.roles ENABLE ROW LEVEL SECURITY;
+ALTER TABLE app.roles FORCE ROW LEVEL SECURITY;
+ALTER TABLE app.role_permissions ENABLE ROW LEVEL SECURITY;
+ALTER TABLE app.role_permissions FORCE ROW LEVEL SECURITY;
+ALTER TABLE app.memberships ENABLE ROW LEVEL SECURITY;
+ALTER TABLE app.memberships FORCE ROW LEVEL SECURITY;
+ALTER TABLE app.membership_units ENABLE ROW LEVEL SECURITY;
+ALTER TABLE app.membership_units FORCE ROW LEVEL SECURITY;
+ALTER TABLE app.user_unit_access ENABLE ROW LEVEL SECURITY;
+ALTER TABLE app.user_unit_access FORCE ROW LEVEL SECURITY;
+ALTER TABLE app.resource_grants ENABLE ROW LEVEL SECURITY;
+ALTER TABLE app.resource_grants FORCE ROW LEVEL SECURITY;
+ALTER TABLE app.authz_reconciliation_log ENABLE ROW LEVEL SECURITY;
+ALTER TABLE app.authz_reconciliation_log FORCE ROW LEVEL SECURITY;
+
+-- The catalog is global and harmless to read: every signed-in user may list it.
+DROP POLICY IF EXISTS permissions_select ON app.permissions;
+CREATE POLICY permissions_select ON app.permissions FOR SELECT TO authenticated USING (true);