@fayz-ai/db 0.12.0 → 0.13.0

package/migrations/053_authz_catalog_templates.sql

@@ -0,0 +1,402 @@
+-- ============================================================================
+-- 053_authz_catalog_templates.sql — the platform permission catalog, the owner
+-- role that never lags the catalog, vertical role templates, and the business
+-- table scaffold (§4/§7 template as one idempotent function).
+--
+-- A new access rule is a row, not a migration (C6): permissions are seeded by
+-- app.seed_permissions(jsonb) — the platform here, each plugin from its
+-- declaredFeatures (#136) — and role templates are rows in app.role_templates
+-- that app.seed_role_template(tenant, template) instantiates as system roles.
+-- ============================================================================
+
+-- ── seed_permissions(jsonb) ─────────────────────────────────────────────
+-- [{key, plugin, description}] upserted. Called by the platform (below) and by
+-- plugin migrations. Idempotent; never removes a key (removal is a decision).
+CREATE OR REPLACE FUNCTION app.seed_permissions(p_rows jsonb)
+RETURNS integer
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $$
+DECLARE v_n integer;
+BEGIN
+  WITH ins AS (
+    INSERT INTO app.permissions (key, plugin, description)
+    SELECT r->>'key', r->>'plugin', r->>'description'
+      FROM jsonb_array_elements(p_rows) r
+    ON CONFLICT (key) DO UPDATE SET plugin = EXCLUDED.plugin, description = coalesce(EXCLUDED.description, app.permissions.description)
+    RETURNING 1
+  ) SELECT count(*) INTO v_n FROM ins;
+  RETURN v_n;
+END $$;
+REVOKE ALL ON FUNCTION app.seed_permissions(jsonb) FROM public, anon, authenticated;
+GRANT EXECUTE ON FUNCTION app.seed_permissions(jsonb) TO service_role;
+
+-- ── the owner role never lags the catalog ───────────────────────────────
+-- "Owner" is a role with a permission set, not a bypass. So that a plugin
+-- installed tomorrow does not leave every owner without its keys, a new catalog
+-- key is granted to every tenant's system `owner` role on insert.
+CREATE OR REPLACE FUNCTION app.trg_permissions_grant_owner()
+RETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
+BEGIN
+  INSERT INTO app.role_permissions (tenant_id, role_id, permission)
+  SELECT r.tenant_id, r.id, NEW.key
+    FROM app.roles r
+   WHERE r.is_system AND r.key = 'owner'
+  ON CONFLICT DO NOTHING;
+  RETURN NULL;
+END $$;
+DROP TRIGGER IF EXISTS permissions_grant_owner ON app.permissions;
+CREATE TRIGGER permissions_grant_owner
+  AFTER INSERT ON app.permissions
+  FOR EACH ROW EXECUTE FUNCTION app.trg_permissions_grant_owner();
+
+-- ── platform catalog (core-A keys) ──────────────────────────────────────
+-- '{feature}.{action}' with actions read/create/edit/delete/manage(+read_all
+-- where owner scoping exists). Plugins add theirs (#136 seeds declaredFeatures).
+SELECT app.seed_permissions('[
+  {"key":"tenant.read","plugin":"platform","description":"See the tenant"},
+  {"key":"tenant.manage","plugin":"platform","description":"Change tenant settings, name, plan"},
+  {"key":"units.read","plugin":"platform","description":"List units"},
+  {"key":"units.manage","plugin":"platform","description":"Create, move, deactivate units"},
+  {"key":"members.read","plugin":"platform","description":"See who is a member and where"},
+  {"key":"members.manage","plugin":"platform","description":"Invite, change role/units, deactivate members"},
+  {"key":"roles.read","plugin":"platform","description":"See roles and their permissions"},
+  {"key":"roles.manage","plugin":"platform","description":"Create and edit tenant roles"},
+  {"key":"authz.grants.manage","plugin":"platform","description":"Write resource grants for any resource type"},
+  {"key":"settings.read","plugin":"platform","description":"Read tenant settings"},
+  {"key":"settings.manage","plugin":"platform","description":"Change tenant settings"},
+  {"key":"billing.manage","plugin":"platform","description":"Plans and payment"},
+  {"key":"audit.read","plugin":"platform","description":"Read the audit log"},
+  {"key":"reports.read","plugin":"reports","description":"Read reports"},
+
+  {"key":"people.read","plugin":"people","description":"Read people in scope"},
+  {"key":"people.read_all","plugin":"people","description":"Read every person of the unit regardless of owner"},
+  {"key":"people.create","plugin":"people"},{"key":"people.edit","plugin":"people"},{"key":"people.delete","plugin":"people"},{"key":"people.manage","plugin":"people"},
+
+  {"key":"catalog.read","plugin":"catalog"},{"key":"catalog.create","plugin":"catalog"},{"key":"catalog.edit","plugin":"catalog"},{"key":"catalog.delete","plugin":"catalog"},{"key":"catalog.manage","plugin":"catalog"},
+
+  {"key":"orders.read","plugin":"orders"},{"key":"orders.read_all","plugin":"orders"},{"key":"orders.create","plugin":"orders"},{"key":"orders.edit","plugin":"orders"},{"key":"orders.delete","plugin":"orders"},{"key":"orders.manage","plugin":"orders"},
+
+  {"key":"agenda.read","plugin":"agenda"},{"key":"agenda.read_all","plugin":"agenda"},{"key":"agenda.create","plugin":"agenda"},{"key":"agenda.edit","plugin":"agenda"},{"key":"agenda.delete","plugin":"agenda"},{"key":"agenda.manage","plugin":"agenda"},
+
+  {"key":"financial.read","plugin":"financial"},{"key":"financial.read_all","plugin":"financial"},{"key":"financial.create","plugin":"financial"},{"key":"financial.edit","plugin":"financial"},{"key":"financial.delete","plugin":"financial"},{"key":"financial.manage","plugin":"financial"},
+  {"key":"financial.cash_session","plugin":"financial","description":"Open/close a cash session (caixinha)"},
+
+  {"key":"inventory.read","plugin":"inventory"},{"key":"inventory.create","plugin":"inventory"},{"key":"inventory.edit","plugin":"inventory"},{"key":"inventory.delete","plugin":"inventory"},{"key":"inventory.manage","plugin":"inventory"}
+]'::jsonb);
+
+-- ── role templates (system roles per vertical) ──────────────────────────
+-- Rows, not code: (template, role_key, role_name, permission). The `owner`
+-- role of every template holds the whole catalog (granted at seed time and kept
+-- current by the trigger above), so it needs no rows here.
+CREATE TABLE IF NOT EXISTS app.role_templates (
+  template   text NOT NULL,
+  role_key   text NOT NULL,
+  role_name  text NOT NULL,
+  sort_order integer NOT NULL DEFAULT 0,
+  permission text NOT NULL REFERENCES app.permissions(key) ON DELETE CASCADE,
+  PRIMARY KEY (template, role_key, permission)
+);
+ALTER TABLE app.role_templates ENABLE ROW LEVEL SECURITY;
+GRANT SELECT ON app.role_templates TO authenticated;
+DROP POLICY IF EXISTS role_templates_select ON app.role_templates;
+CREATE POLICY role_templates_select ON app.role_templates FOR SELECT TO authenticated USING (true);
+
+CREATE OR REPLACE FUNCTION app.seed_role_template_rows(p_template text, p_role_key text, p_role_name text, p_sort integer, p_perms text[])
+RETURNS void LANGUAGE sql SECURITY DEFINER SET search_path = '' AS $$
+  INSERT INTO app.role_templates (template, role_key, role_name, sort_order, permission)
+  SELECT p_template, p_role_key, p_role_name, p_sort, unnest(p_perms)
+  ON CONFLICT DO NOTHING;
+$$;
+REVOKE ALL ON FUNCTION app.seed_role_template_rows(text, text, text, integer, text[]) FROM public, anon, authenticated;
+
+-- generic — the SDK's historical five (owner/admin/manager/staff/viewer), the
+-- target of the tenant_members role mapping in #134.
+SELECT app.seed_role_template_rows('generic', 'admin', 'Administrator', 1, ARRAY[
+  'tenant.read','units.read','units.manage','members.read','members.manage','roles.read','roles.manage','settings.read','settings.manage','audit.read','reports.read',
+  'people.manage','catalog.manage','orders.manage','agenda.manage','financial.manage','inventory.manage']);
+SELECT app.seed_role_template_rows('generic', 'manager', 'Manager', 2, ARRAY[
+  'tenant.read','units.read','members.read','roles.read','settings.read','reports.read',
+  'people.manage','catalog.manage','orders.manage','agenda.manage','financial.manage','inventory.manage']);
+SELECT app.seed_role_template_rows('generic', 'staff', 'Staff', 3, ARRAY[
+  'tenant.read','units.read','people.read','people.create','people.edit','catalog.read','orders.read','orders.create','orders.edit','agenda.read','agenda.create','agenda.edit','inventory.read']);
+SELECT app.seed_role_template_rows('generic', 'viewer', 'Viewer', 4, ARRAY[
+  'tenant.read','units.read','people.read','catalog.read','orders.read','agenda.read','inventory.read','financial.read']);
+
+-- salon (owner_id off in the vertical template)
+SELECT app.seed_role_template_rows('salon', 'manager', 'Gerente', 1, ARRAY[
+  'tenant.read','units.read','members.read','members.manage','roles.read','settings.read','reports.read','audit.read',
+  'people.manage','catalog.manage','orders.manage','agenda.manage','financial.manage','inventory.manage']);
+SELECT app.seed_role_template_rows('salon', 'reception', 'Recepção', 2, ARRAY[
+  'tenant.read','units.read','people.read','people.create','people.edit','catalog.read','orders.read','orders.create','orders.edit','agenda.read','agenda.create','agenda.edit']);
+SELECT app.seed_role_template_rows('salon', 'professional', 'Profissional', 3, ARRAY[
+  'tenant.read','units.read','people.read','catalog.read','orders.read','agenda.read','agenda.edit']);
+SELECT app.seed_role_template_rows('salon', 'financial', 'Financeiro', 4, ARRAY[
+  'tenant.read','units.read','people.read','orders.read','reports.read','financial.manage']);
+
+-- clinic (owner_id on: professionals see their own patients; manager read_all)
+SELECT app.seed_role_template_rows('clinic', 'manager', 'Coordenação', 1, ARRAY[
+  'tenant.read','units.read','members.read','members.manage','roles.read','settings.read','reports.read','audit.read',
+  'people.manage','catalog.manage','orders.manage','agenda.manage','financial.manage','inventory.manage']);
+SELECT app.seed_role_template_rows('clinic', 'reception', 'Recepção', 2, ARRAY[
+  'tenant.read','units.read','people.read','people.create','people.edit','catalog.read','orders.read','orders.create','orders.edit','agenda.read','agenda.create','agenda.edit']);
+SELECT app.seed_role_template_rows('clinic', 'professional', 'Profissional', 3, ARRAY[
+  'tenant.read','units.read','people.read','people.edit','catalog.read','orders.read','agenda.read','agenda.edit']);
+SELECT app.seed_role_template_rows('clinic', 'financial', 'Financeiro', 4, ARRAY[
+  'tenant.read','units.read','people.read','orders.read','reports.read','financial.manage']);
+
+-- restaurant
+SELECT app.seed_role_template_rows('restaurant', 'manager', 'Gerente', 1, ARRAY[
+  'tenant.read','units.read','members.read','members.manage','roles.read','settings.read','reports.read','audit.read',
+  'people.manage','catalog.manage','orders.manage','financial.manage','inventory.manage']);
+SELECT app.seed_role_template_rows('restaurant', 'cashier', 'Caixa', 2, ARRAY[
+  'tenant.read','units.read','people.read','catalog.read','orders.read','orders.edit','financial.read','financial.create','financial.cash_session']);
+SELECT app.seed_role_template_rows('restaurant', 'waiter', 'Garçom', 3, ARRAY[
+  'tenant.read','units.read','people.read','people.create','catalog.read','orders.read','orders.create','orders.edit']);
+SELECT app.seed_role_template_rows('restaurant', 'kitchen', 'Cozinha', 4, ARRAY[
+  'tenant.read','units.read','catalog.read','orders.read','orders.edit','inventory.read']);
+
+-- ── seed_role_template(tenant, template) ────────────────────────────────
+-- Instantiates the template's system roles for a tenant (owner + the rows
+-- above). Idempotent: existing roles are kept, missing permissions added,
+-- nothing removed (a tenant may have tightened a system role on purpose).
+-- Returns the tenant's owner role id.
+CREATE OR REPLACE FUNCTION app.seed_role_template(p_tenant uuid, p_template text DEFAULT 'generic')
+RETURNS uuid
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $$
+DECLARE v_owner uuid;
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM app.role_templates WHERE template = p_template) THEN
+    RAISE EXCEPTION 'seed_role_template: unknown template %', p_template;
+  END IF;
+
+  INSERT INTO app.roles (tenant_id, key, name, is_system)
+  VALUES (p_tenant, 'owner', 'Owner', true)
+  ON CONFLICT (tenant_id, key) DO NOTHING;
+  SELECT id INTO v_owner FROM app.roles WHERE tenant_id = p_tenant AND key = 'owner';
+
+  INSERT INTO app.role_permissions (tenant_id, role_id, permission)
+  SELECT p_tenant, v_owner, p.key FROM app.permissions p
+  ON CONFLICT DO NOTHING;
+
+  INSERT INTO app.roles (tenant_id, key, name, is_system)
+  SELECT DISTINCT ON (t.role_key) p_tenant, t.role_key, t.role_name, true
+    FROM app.role_templates t WHERE t.template = p_template
+   ORDER BY t.role_key
+  ON CONFLICT (tenant_id, key) DO NOTHING;
+
+  INSERT INTO app.role_permissions (tenant_id, role_id, permission)
+  SELECT p_tenant, r.id, t.permission
+    FROM app.role_templates t
+    JOIN app.roles r ON r.tenant_id = p_tenant AND r.key = t.role_key
+   WHERE t.template = p_template
+  ON CONFLICT DO NOTHING;
+
+  RETURN v_owner;
+END $$;
+REVOKE ALL ON FUNCTION app.seed_role_template(uuid, text) FROM public, anon, authenticated;
+GRANT EXECUTE ON FUNCTION app.seed_role_template(uuid, text) TO service_role;
+
+-- ═════════════════════ business-table scaffold (§4 + §7) ═════════════════
+-- app.scaffold_table(table, resource_type, plugin, owner_scoping, mode)
+--
+-- Stamps a table with the three structural columns, unique(tenant_id, id),
+-- the composite FKs, tenant-first indexes, enable+force RLS, the updated_at
+-- trigger and the ONE policy template every business table gets:
+--
+--   select  tenant = current ∧ (unit null ∨ has_unit) ∧ (owner null ∨ owner = me ∨
+--           shared_with grant ∨ {plugin}.read_all) ∧ {plugin}.read
+--   insert  tenant/unit as above ∧ {plugin}.create
+--   update  select-scope ∧ {plugin}.edit (using + with check)
+--   delete  select-scope ∧ {plugin}.delete
+--
+-- Vertical differences are configuration: the policy text is identical whether
+-- the vertical fills owner_id (clinic) or leaves it null (salon); owner_scoping
+-- is recorded so a template can say which. mode='enforce' replaces every
+-- pre-existing policy on the table with the template; mode='shadow' keeps them
+-- and adds the template ones (permissive policies OR together, so shadow adds no
+-- restriction) — app.shadow_report (#135) then compares old vs new decisions.
+CREATE TABLE IF NOT EXISTS app.scaffold_registry (
+  table_schema  text NOT NULL,
+  table_name    text NOT NULL,
+  resource_type text NOT NULL,
+  plugin        text NOT NULL,
+  owner_scoping boolean NOT NULL DEFAULT true,
+  mode          text NOT NULL CHECK (mode IN ('shadow', 'enforce')),
+  previous_policies text[] NOT NULL DEFAULT '{}',
+  applied_at    timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (table_schema, table_name)
+);
+ALTER TABLE app.scaffold_registry ENABLE ROW LEVEL SECURITY;
+GRANT SELECT ON app.scaffold_registry TO authenticated;
+DROP POLICY IF EXISTS scaffold_registry_select ON app.scaffold_registry;
+CREATE POLICY scaffold_registry_select ON app.scaffold_registry FOR SELECT TO authenticated USING (true);
+
+CREATE OR REPLACE FUNCTION app.scaffold_table(
+  p_table regclass,
+  p_resource_type text,
+  p_plugin text,
+  p_owner_scoping boolean DEFAULT true,
+  p_mode text DEFAULT 'enforce'
+)
+RETURNS void
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $$
+DECLARE
+  v_schema text;
+  v_name   text;
+  v_q      text;   -- quoted qualified name
+  v_prev   text[] := '{}';
+  v_rows   bigint;
+  r        record;
+  v_scope  text;   -- the row-scope predicate shared by every policy
+BEGIN
+  IF p_mode NOT IN ('shadow', 'enforce') THEN
+    RAISE EXCEPTION 'scaffold_table: mode must be shadow|enforce';
+  END IF;
+  SELECT n.nspname, c.relname INTO v_schema, v_name
+    FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace WHERE c.oid = p_table;
+  v_q := format('%I.%I', v_schema, v_name);
+
+  -- ── columns
+  IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema = v_schema AND table_name = v_name AND column_name = 'id') THEN
+    RAISE EXCEPTION 'scaffold_table: % has no id column', v_q;
+  END IF;
+  EXECUTE format('SELECT count(*) FROM %s', v_q) INTO v_rows;
+  IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema = v_schema AND table_name = v_name AND column_name = 'tenant_id') THEN
+    EXECUTE format('ALTER TABLE %s ADD COLUMN tenant_id uuid REFERENCES public.tenants(id) ON DELETE CASCADE', v_q);
+    IF v_rows = 0 THEN EXECUTE format('ALTER TABLE %s ALTER COLUMN tenant_id SET NOT NULL', v_q); END IF;
+  END IF;
+  EXECUTE format('ALTER TABLE %s ADD COLUMN IF NOT EXISTS unit_id uuid', v_q);
+  EXECUTE format('ALTER TABLE %s ADD COLUMN IF NOT EXISTS owner_id uuid', v_q);
+  EXECUTE format('ALTER TABLE %s ADD COLUMN IF NOT EXISTS created_at timestamptz NOT NULL DEFAULT now()', v_q);
+  EXECUTE format('ALTER TABLE %s ADD COLUMN IF NOT EXISTS updated_at timestamptz NOT NULL DEFAULT now()', v_q);
+
+  -- ── unique(tenant_id, id) — enables composite FKs from other tables
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conrelid = p_table AND conname = v_name || '_tenant_id_id_key') THEN
+    EXECUTE format('ALTER TABLE %s ADD CONSTRAINT %I UNIQUE (tenant_id, id)', v_q, v_name || '_tenant_id_id_key');
+  END IF;
+  -- ── composite FKs: unit within tenant, owner a member of the tenant
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conrelid = p_table AND conname = v_name || '_unit_fk') THEN
+    EXECUTE format('ALTER TABLE %s ADD CONSTRAINT %I FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL', v_q, v_name || '_unit_fk');
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conrelid = p_table AND conname = v_name || '_owner_fk') THEN
+    EXECUTE format('ALTER TABLE %s ADD CONSTRAINT %I FOREIGN KEY (tenant_id, owner_id) REFERENCES app.memberships(tenant_id, user_id) ON DELETE SET NULL', v_q, v_name || '_owner_fk');
+  END IF;
+
+  -- ── tenant-first indexes
+  EXECUTE format('CREATE INDEX IF NOT EXISTS %I ON %s (tenant_id, unit_id)', v_name || '_tenant_unit_idx', v_q);
+  EXECUTE format('CREATE INDEX IF NOT EXISTS %I ON %s (tenant_id, owner_id) WHERE owner_id IS NOT NULL', v_name || '_tenant_owner_idx', v_q);
+
+  -- ── updated_at
+  EXECUTE format('DROP TRIGGER IF EXISTS %I ON %s', v_name || '_updated_at', v_q);
+  EXECUTE format('CREATE TRIGGER %I BEFORE UPDATE ON %s FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at()', v_name || '_updated_at', v_q);
+
+  -- ── RLS
+  EXECUTE format('ALTER TABLE %s ENABLE ROW LEVEL SECURITY', v_q);
+  EXECUTE format('ALTER TABLE %s FORCE ROW LEVEL SECURITY', v_q);
+  IF p_mode = 'enforce' THEN
+    FOR r IN SELECT policyname FROM pg_policies WHERE schemaname = v_schema AND tablename = v_name
+             AND policyname NOT IN (v_name || '_authz_select', v_name || '_authz_insert', v_name || '_authz_update', v_name || '_authz_delete') LOOP
+      v_prev := v_prev || r.policyname;
+      EXECUTE format('DROP POLICY IF EXISTS %I ON %s', r.policyname, v_q);
+    END LOOP;
+  END IF;
+
+  v_scope := format(
+    'tenant_id = (select app.current_tenant_id())'
+    || ' AND (unit_id IS NULL OR (select app.has_unit(unit_id)))'
+    || ' AND (owner_id IS NULL OR owner_id = (select auth.uid())'
+    ||      ' OR (select app.has_grant(%L, id, ARRAY[''shared_with'']))'
+    ||      ' OR (select app.has_permission(%L, unit_id)))',
+    p_resource_type, p_plugin || '.read_all');
+
+  EXECUTE format('DROP POLICY IF EXISTS %I ON %s', v_name || '_authz_select', v_q);
+  EXECUTE format('CREATE POLICY %I ON %s FOR SELECT TO authenticated USING (%s AND (select app.has_permission(%L, unit_id)))',
+                 v_name || '_authz_select', v_q, v_scope, p_plugin || '.read');
+  EXECUTE format('DROP POLICY IF EXISTS %I ON %s', v_name || '_authz_insert', v_q);
+  EXECUTE format('CREATE POLICY %I ON %s FOR INSERT TO authenticated WITH CHECK (tenant_id = (select app.current_tenant_id()) AND (unit_id IS NULL OR (select app.has_unit(unit_id))) AND (select app.has_permission(%L, unit_id)))',
+                 v_name || '_authz_insert', v_q, p_plugin || '.create');
+  EXECUTE format('DROP POLICY IF EXISTS %I ON %s', v_name || '_authz_update', v_q);
+  EXECUTE format('CREATE POLICY %I ON %s FOR UPDATE TO authenticated USING (%s AND (select app.has_permission(%L, unit_id))) WITH CHECK (tenant_id = (select app.current_tenant_id()) AND (unit_id IS NULL OR (select app.has_unit(unit_id))) AND (select app.has_permission(%L, unit_id)))',
+                 v_name || '_authz_update', v_q, v_scope, p_plugin || '.edit', p_plugin || '.edit');
+  EXECUTE format('DROP POLICY IF EXISTS %I ON %s', v_name || '_authz_delete', v_q);
+  EXECUTE format('CREATE POLICY %I ON %s FOR DELETE TO authenticated USING (%s AND (select app.has_permission(%L, unit_id)))',
+                 v_name || '_authz_delete', v_q, v_scope, p_plugin || '.delete');
+
+  INSERT INTO app.scaffold_registry (table_schema, table_name, resource_type, plugin, owner_scoping, mode, previous_policies)
+  VALUES (v_schema, v_name, p_resource_type, p_plugin, p_owner_scoping, p_mode, v_prev)
+  ON CONFLICT (table_schema, table_name) DO UPDATE
+    SET resource_type = EXCLUDED.resource_type, plugin = EXCLUDED.plugin, owner_scoping = EXCLUDED.owner_scoping,
+        mode = EXCLUDED.mode, applied_at = now(),
+        previous_policies = CASE WHEN EXCLUDED.mode = 'enforce' AND app.scaffold_registry.mode = 'shadow'
+                                 THEN app.scaffold_registry.previous_policies || EXCLUDED.previous_policies
+                                 ELSE EXCLUDED.previous_policies END;
+END $$;
+REVOKE ALL ON FUNCTION app.scaffold_table(regclass, text, text, boolean, text) FROM public, anon, authenticated;
+
+-- ═════════════════════ read views for the UI (public.v_authz_*) ═══════════
+-- security_invoker: the caller's RLS on the app tables decides what she sees.
+CREATE OR REPLACE VIEW public.v_authz_units WITH (security_invoker = true) AS
+  SELECT tenant_id, id, kind, parent_unit_id, name, slug, active, company_legal_entity_id, metadata, created_at, updated_at FROM app.units;
+CREATE OR REPLACE VIEW public.v_authz_roles WITH (security_invoker = true) AS
+  SELECT tenant_id, id, key, name, description, is_system, created_at, updated_at FROM app.roles;
+CREATE OR REPLACE VIEW public.v_authz_permissions WITH (security_invoker = true) AS
+  SELECT key, plugin, description FROM app.permissions;
+CREATE OR REPLACE VIEW public.v_authz_role_permissions WITH (security_invoker = true) AS
+  SELECT tenant_id, role_id, permission FROM app.role_permissions;
+CREATE OR REPLACE VIEW public.v_authz_memberships WITH (security_invoker = true) AS
+  SELECT tenant_id, user_id, id, role_id, all_units, active, person_id, invited_by, created_at, updated_at FROM app.memberships;
+CREATE OR REPLACE VIEW public.v_authz_membership_units WITH (security_invoker = true) AS
+  SELECT tenant_id, user_id, unit_id, role_override_id, created_at FROM app.membership_units;
+CREATE OR REPLACE VIEW public.v_authz_user_unit_access WITH (security_invoker = true) AS
+  SELECT tenant_id, user_id, unit_id, via FROM app.user_unit_access;
+CREATE OR REPLACE VIEW public.v_authz_resource_grants WITH (security_invoker = true) AS
+  SELECT tenant_id, resource_type, resource_id, relation, subject_type, subject_id, created_by, created_at FROM app.resource_grants;
+CREATE OR REPLACE VIEW public.v_authz_role_templates WITH (security_invoker = true) AS
+  SELECT template, role_key, role_name, sort_order, permission FROM app.role_templates;
+-- Reconciliation runs whose diff was not zero outside a migration: the alert.
+CREATE OR REPLACE VIEW public.v_authz_reconciliation_alerts WITH (security_invoker = true) AS
+  SELECT id, tenant_id, run_at, source, added, removed, details
+    FROM app.authz_reconciliation_log
+   WHERE source <> 'migration' AND (added <> 0 OR removed <> 0);
+GRANT SELECT ON public.v_authz_units, public.v_authz_roles, public.v_authz_permissions, public.v_authz_role_permissions,
+                public.v_authz_memberships, public.v_authz_membership_units, public.v_authz_user_unit_access,
+                public.v_authz_resource_grants, public.v_authz_role_templates, public.v_authz_reconciliation_alerts
+  TO authenticated, service_role;
+-- The simple views over one table are auto-updatable: writes through them hit
+-- the write policies of 041 (units/roles/role_permissions/memberships/units/grants).
+GRANT INSERT, UPDATE, DELETE ON public.v_authz_units, public.v_authz_roles, public.v_authz_role_permissions,
+                                public.v_authz_memberships, public.v_authz_membership_units, public.v_authz_resource_grants
+  TO authenticated, service_role;
+
+-- ── the session's authz context, once per session per unit (§8) ─────────
+CREATE OR REPLACE FUNCTION public.authz_my_permissions(p_unit uuid DEFAULT NULL)
+RETURNS SETOF text
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path = ''
+AS $$
+  SELECT rp.permission
+    FROM app.role_permissions rp
+   WHERE rp.tenant_id = app.current_tenant_id()
+     AND rp.role_id = app.effective_role_id(app.current_tenant_id(), auth.uid(), p_unit)
+   ORDER BY 1;
+$$;
+CREATE OR REPLACE FUNCTION public.authz_context()
+RETURNS jsonb
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path = ''
+AS $$
+  SELECT jsonb_build_object(
+    'tenant_id', app.current_tenant_id(),
+    'user_id', auth.uid(),
+    'role_key', (SELECT r.key FROM app.memberships m JOIN app.roles r ON r.tenant_id = m.tenant_id AND r.id = m.role_id
+                  WHERE m.tenant_id = app.current_tenant_id() AND m.user_id = auth.uid() AND m.active),
+    'all_units', (SELECT m.all_units FROM app.memberships m WHERE m.tenant_id = app.current_tenant_id() AND m.user_id = auth.uid() AND m.active),
+    'units', coalesce((SELECT jsonb_agg(jsonb_build_object('unit_id', a.unit_id, 'via', a.via) ORDER BY a.unit_id)
+                         FROM app.user_unit_access a WHERE a.tenant_id = app.current_tenant_id() AND a.user_id = auth.uid()), '[]'::jsonb),
+    'permissions', coalesce((SELECT jsonb_agg(p ORDER BY p) FROM public.authz_my_permissions(NULL) p), '[]'::jsonb)
+  );
+$$;
+REVOKE ALL ON FUNCTION public.authz_my_permissions(uuid) FROM public, anon;
+REVOKE ALL ON FUNCTION public.authz_context() FROM public, anon;
+GRANT EXECUTE ON FUNCTION public.authz_my_permissions(uuid) TO authenticated, service_role;
+GRANT EXECUTE ON FUNCTION public.authz_context() TO authenticated, service_role;

package/migrations/060_tenancy_seam.sql

@@ -0,0 +1,132 @@
+-- ============================================================================
+-- 060_tenancy_seam.sql — the tenancy seam moves onto the authz core (#134).
+--
+-- Three functions the whole fleet's RLS resolves through are re-authored to read
+-- app.memberships instead of the legacy public.tenant_members:
+--
+--   public.user_tenant_ids()      the seam of ~260 policies (028): same signature,
+--                                 same claim semantics, new source table.
+--   public.is_tenant_admin(uuid)  the legacy "owner|admin" bypass. It is now a
+--                                 compat shim over permissions: TRUE only when the
+--                                 caller's active membership holds `tenant.manage`.
+--                                 No role literal survives in its body. Deprecated:
+--                                 policies of 001/003/021 still call it; new code
+--                                 uses app.has_permission(...).
+--   public.shares_tenant_with(uuid) (023) profiles visibility, same rule on app.*.
+--
+-- public.tenants gains `role_template` (which vertical template seeded its system
+-- roles — needed to re-seed a tenant when a template grows keys) and loses the
+-- open `tenants_insert` policy: a tenant is created by public.create_tenant (051),
+-- never by a bare INSERT.
+--
+-- Idempotent and replay-safe: CREATE OR REPLACE keeps the functions' oids,
+-- ownership and grants (every existing policy keeps compiling); the policy is
+-- DROP IF EXISTS + CREATE. On a force replay 001/002/006/028 re-create the old
+-- bodies first and this file re-authors them again — the chain converges.
+-- ============================================================================
+
+ALTER TABLE public.tenants ADD COLUMN IF NOT EXISTS role_template text;
+-- The synthetic seed records its template in settings; real tenants created by
+-- create_tenant record it in the column. Backfill the one from the other.
+UPDATE public.tenants
+   SET role_template = settings ->> 'template'
+ WHERE role_template IS NULL
+   AND settings ->> 'template' IS NOT NULL
+   AND EXISTS (SELECT 1 FROM app.role_templates rt WHERE rt.template = public.tenants.settings ->> 'template');
+
+-- ── public.user_tenant_ids() ────────────────────────────────────────────
+-- Structure copied from 028 (read its header for the reasoning): a top-level
+-- `tenant_id` claim NARROWS and never widens; a signed-in session is intersected
+-- with real (active) membership; a session-less signed token is scoped by the
+-- claim alone; a present-but-unparseable claim resolves to nothing; no claim ⇒
+-- every active membership. Only the source table changes.
+CREATE OR REPLACE FUNCTION public.user_tenant_ids()
+RETURNS SETOF uuid
+LANGUAGE sql STABLE SECURITY DEFINER
+SET search_path = ''
+AS $$
+  WITH claim AS (
+    SELECT coalesce(jsonb_exists(auth.jwt(), 'tenant_id'), false) AS present,
+           auth.jwt() ->> 'tenant_id'                             AS raw
+  ),
+  scoped AS (
+    SELECT raw::uuid AS tenant_id
+      FROM claim
+     WHERE raw ~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
+  )
+  SELECT m.tenant_id
+    FROM app.memberships m
+   WHERE m.user_id = auth.uid()
+     AND m.active
+     AND NOT (SELECT present FROM claim)
+  UNION
+  SELECT s.tenant_id
+    FROM scoped s
+   WHERE auth.uid() IS NULL
+      OR EXISTS (
+           SELECT 1 FROM app.memberships m
+            WHERE m.user_id = auth.uid() AND m.tenant_id = s.tenant_id AND m.active
+         );
+$$;
+-- Same grant set as 028 (PUBLIC keeps its default EXECUTE on purpose: RLS
+-- expressions run as the querying role and anon storefront reads must resolve
+-- to zero rows, not to "permission denied for function").
+GRANT EXECUTE ON FUNCTION public.user_tenant_ids() TO authenticated, service_role;
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'fayz_connector') THEN
+    EXECUTE 'GRANT EXECUTE ON FUNCTION public.user_tenant_ids() TO fayz_connector';
+  END IF;
+END $$;
+
+-- ── public.is_tenant_admin(uuid) — compat shim over permissions ─────────
+-- No role literal: the answer is "does the caller's active membership in that
+-- tenant hold tenant.manage" (the base role; unit overrides do not apply to a
+-- tenant-level question). Callers pass the tenant, so it is used verbatim
+-- rather than app.current_tenant_id().
+CREATE OR REPLACE FUNCTION public.is_tenant_admin(p_tenant_id uuid)
+RETURNS boolean
+LANGUAGE sql STABLE SECURITY DEFINER
+SET search_path = ''
+AS $$
+  SELECT EXISTS (
+    SELECT 1
+      FROM app.memberships m
+      JOIN app.role_permissions rp
+        ON rp.tenant_id = m.tenant_id AND rp.role_id = m.role_id
+     WHERE m.tenant_id = p_tenant_id
+       AND m.user_id = auth.uid()
+       AND m.active
+       AND rp.permission = 'tenant.manage'
+  );
+$$;
+COMMENT ON FUNCTION public.is_tenant_admin(uuid) IS
+  'DEPRECATED (#134): compat shim kept for the policies of 001/003/021. TRUE iff the caller''s active membership holds tenant.manage. New code uses app.has_permission(...). Removal: Phase 1, once no policy references it.';
+REVOKE ALL ON FUNCTION public.is_tenant_admin(uuid) FROM public, anon;
+GRANT EXECUTE ON FUNCTION public.is_tenant_admin(uuid) TO authenticated, service_role;
+
+-- ── public.shares_tenant_with(uuid) ─────────────────────────────────────
+CREATE OR REPLACE FUNCTION public.shares_tenant_with(p_user_id uuid)
+RETURNS boolean
+LANGUAGE sql STABLE SECURITY DEFINER
+SET search_path = ''
+AS $$
+  SELECT EXISTS (
+    SELECT 1
+      FROM app.memberships mine
+      JOIN app.memberships theirs ON theirs.tenant_id = mine.tenant_id
+     WHERE mine.user_id = auth.uid() AND mine.active
+       AND theirs.user_id = p_user_id AND theirs.active
+  );
+$$;
+REVOKE ALL ON FUNCTION public.shares_tenant_with(uuid) FROM public, anon;
+GRANT EXECUTE ON FUNCTION public.shares_tenant_with(uuid) TO authenticated, service_role;
+
+-- ── public.tenants policies ─────────────────────────────────────────────
+-- Read: through the seam (no detour via the legacy table). Insert: none — a
+-- bare INSERT would create a tenant with no owner membership; create_tenant
+-- (051) is the only path. Update keeps is_tenant_admin (now permission-based).
+DROP POLICY IF EXISTS "tenants_select" ON public.tenants;
+CREATE POLICY "tenants_select" ON public.tenants FOR SELECT TO authenticated
+  USING (id IN (SELECT public.user_tenant_ids()));
+DROP POLICY IF EXISTS "tenants_insert" ON public.tenants;