@fayz-ai/db 0.12.0 → 0.13.0

package/migrations/159_the_plan_catalogue_gets_its_first_rows.sql

@@ -0,0 +1,132 @@
+-- ---------------------------------------------------------------------------
+-- 159_the_plan_catalogue_gets_its_first_rows.sql — the ceiling stops being an
+-- empty mechanism (#281, ADR 0025).
+--
+-- 154 built the ceiling and deliberately left it un-seeded: `app.plan_grants`
+-- empty means every tenant is planless, and a planless tenant is unrestricted.
+-- That was the right way to land it — a gate whose first act is to lock every
+-- existing customer out gets reverted within the hour, not adopted.
+--
+-- This is the second step: three plans, and what each permits, at the FACET
+-- grain the plugins now declare (#281). Nothing here changes what any existing
+-- tenant can do, because the ceiling only binds a tenant that has been ASSIGNED
+-- a plan, and this file assigns none. What it does is make the ceiling
+-- assignable — `tenant_apply_plan(tenant, 'pro')` now has something to mean.
+--
+-- ── Why the plans are named and not numbered ────────────────────────────────
+-- `essential` / `pro` / `scale` are ids, not prices. What a customer pays and
+-- what a plan is called in a given market are billing's business and change
+-- without a migration; what a plan PERMITS is a structural fact about the
+-- product and belongs where the enforcement reads it.
+--
+-- ── included vs optional ────────────────────────────────────────────────────
+-- `included` comes on the moment the plan is applied. `optional` is permitted
+-- but stays off until somebody turns it on — which is how a plan can allow ten
+-- plugins without imposing ten menus on a customer who wanted two. 154's
+-- `tenant_apply_plan` reads exactly this distinction.
+-- ---------------------------------------------------------------------------
+
+DO $$
+BEGIN
+  IF to_regprocedure('public.register_plan_grant(text, text, text, text, text)') IS NULL THEN
+    RAISE NOTICE '159: register_plan_grant missing (spine < 154) — skipped';
+    RETURN;
+  END IF;
+
+  -- ── essential — one business, running ─────────────────────────────────
+  -- Everything needed to take money and know what happened. The free halves of
+  -- each module, and nothing that assumes a second person in the office.
+  PERFORM public.register_plan_grant('essential', 'financial', 'ledger',      'included', 'Lançamentos e o razão — sem isto o plano não é nada.');
+  PERFORM public.register_plan_grant('essential', 'inventory', 'stock',       'included', 'Saldo e movimentos.');
+  PERFORM public.register_plan_grant('essential', 'crm',       'contacts',    'included', 'A lista de clientes.');
+  PERFORM public.register_plan_grant('essential', 'agenda',    'scheduling',  'included', 'A agenda interna.');
+  PERFORM public.register_plan_grant('essential', 'tasks',     '',            'optional', 'Permitido, desligado por padrão: nem toda operação quer uma lista de tarefas no menu.');
+
+  -- ── pro — the paid halves, one team ───────────────────────────────────
+  PERFORM public.register_plan_grant('pro', 'financial', 'ledger',         'included');
+  PERFORM public.register_plan_grant('pro', 'financial', 'reconciliation', 'included', 'A metade paga do financeiro — a razão de o facet existir (ADR 0025).');
+  PERFORM public.register_plan_grant('pro', 'financial', 'dre',            'optional');
+  PERFORM public.register_plan_grant('pro', 'inventory', 'stock',          'included');
+  PERFORM public.register_plan_grant('pro', 'inventory', 'costing',        'included');
+  PERFORM public.register_plan_grant('pro', 'inventory', 'purchasing',     'optional');
+  PERFORM public.register_plan_grant('pro', 'crm',       'contacts',       'included');
+  PERFORM public.register_plan_grant('pro', 'crm',       'pipeline',       'included');
+  PERFORM public.register_plan_grant('pro', 'agenda',    'scheduling',     'included');
+  PERFORM public.register_plan_grant('pro', 'agenda',    'public_booking', 'included');
+  PERFORM public.register_plan_grant('pro', 'tasks',     '',               'optional');
+  PERFORM public.register_plan_grant('pro', 'forms',     '',               'optional');
+
+  -- ── scale — everything, including what we host ────────────────────────
+  -- `smart_fit` is the entitlement ADR 0018's service door checks: the agenda
+  -- ships open with the button, and whether the intelligence answers is this row.
+  PERFORM public.register_plan_grant('scale', 'financial', 'ledger',         'included');
+  PERFORM public.register_plan_grant('scale', 'financial', 'reconciliation', 'included');
+  PERFORM public.register_plan_grant('scale', 'financial', 'dre',            'included');
+  PERFORM public.register_plan_grant('scale', 'inventory', 'stock',          'included');
+  PERFORM public.register_plan_grant('scale', 'inventory', 'costing',        'included');
+  PERFORM public.register_plan_grant('scale', 'inventory', 'purchasing',     'included');
+  PERFORM public.register_plan_grant('scale', 'crm',       'contacts',       'included');
+  PERFORM public.register_plan_grant('scale', 'crm',       'pipeline',       'included');
+  PERFORM public.register_plan_grant('scale', 'crm',       'automation',     'included');
+  PERFORM public.register_plan_grant('scale', 'agenda',    'scheduling',     'included');
+  PERFORM public.register_plan_grant('scale', 'agenda',    'public_booking', 'included');
+  PERFORM public.register_plan_grant('scale', 'agenda',    'smart_fit',      'included', 'O serviço que hospedamos (ADR 0018) — o service_authorize lê exatamente esta linha.');
+  PERFORM public.register_plan_grant('scale', 'tasks',     '',               'optional');
+  PERFORM public.register_plan_grant('scale', 'forms',     '',               'optional');
+  PERFORM public.register_plan_grant('scale', 'marketing', '',               'optional');
+END $$;
+
+-- ─────────────────────────────────────────────────────────────────────────
+-- What a plan is worth, in one read
+--
+-- The upgrade prompt's question — "what would I get?" — answered without the
+-- screen having to know the shape of the grants table.
+-- ─────────────────────────────────────────────────────────────────────────
+
+CREATE OR REPLACE VIEW public.v_plan_catalogue
+WITH (security_invoker = true) AS
+  SELECT g.plan_id,
+         g.plugin_id,
+         nullif(g.facet, '') AS facet,
+         g.mode,
+         g.note,
+         -- What THIS tenant would gain by moving to that plan: permitted there
+         -- and not permitted now. NULL tenant (no session) simply shows all.
+         NOT public.plan_permits(g.plugin_id, g.facet) AS is_upgrade
+    FROM app.plan_grants g
+   ORDER BY g.plan_id, g.plugin_id, g.facet;
+
+COMMENT ON VIEW public.v_plan_catalogue IS
+  'Every plan and what it permits, with `is_upgrade` marking what the CURRENT tenant does not have yet (159). What an upgrade prompt reads so it can name the thing rather than say "upgrade for more".';
+
+GRANT SELECT ON public.v_plan_catalogue TO authenticated, service_role;
+
+-- ─────────────────────────────────────────────────────────────────────────
+-- A plan change must be visible immediately
+--
+-- 154's `tenant_apply_plan` syncs the activations. What was missing is the part
+-- a screen can act on: a stamp that changes when the tenant's entitlements do,
+-- so the shell knows its config is stale without polling the whole thing.
+--
+-- `app_config()` already returns `generated_at`; this makes it move for a plan
+-- change too, which is what turns "the config is cached" from a bug into a
+-- cache with an invalidation.
+-- ─────────────────────────────────────────────────────────────────────────
+
+CREATE OR REPLACE FUNCTION public.tenant_config_version(p_tenant uuid DEFAULT NULL)
+RETURNS timestamptz
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path = ''
+AS $$
+  SELECT greatest(
+           coalesce(max(tp.updated_at), 'epoch'::timestamptz),
+           coalesce(max(tn.updated_at), 'epoch'::timestamptz)
+         )
+    FROM app.tenant_plugins tp
+    FULL JOIN app.tenant_nav tn ON tn.tenant_id = tp.tenant_id
+   WHERE coalesce(tp.tenant_id, tn.tenant_id) = coalesce(p_tenant, app.current_tenant_id());
+$$;
+
+COMMENT ON FUNCTION public.tenant_config_version(uuid) IS
+  'When this tenant''s configuration last changed (159). A screen polls this — one number — instead of re-reading app_config(), and re-reads only when it moves. What makes "screens change immediately" cheap enough to actually do.';
+
+GRANT EXECUTE ON FUNCTION public.tenant_config_version(uuid) TO authenticated, service_role;

package/migrations/160_the_vertical_decides_what_starts_on.sql

@@ -0,0 +1,246 @@
+-- ---------------------------------------------------------------------------
+-- 160_the_vertical_decides_what_starts_on.sql — the last thing the pool profiles
+-- were still doing, moved to where it belongs (#279, ADR 0022 + ADR 0023).
+--
+-- ── What is left of a pool profile ──────────────────────────────────────────
+-- Before ADR 0022 a profile decided what a CLUSTER contained: the salon pool
+-- had the agenda because its profile listed it, and "does this tenant have
+-- prontuário?" was a question about which database they landed in. That is
+-- gone — every cluster runs the same canonical chain.
+--
+-- What a profile still knows is worth keeping: a salon opening today wants the
+-- agenda on and the shop off, and a restaurant wants the opposite. That is not
+-- a fact about a cluster, it is a sensible STARTING POINT for a new tenant of
+-- that industry — and `tenants.vertical_id` has carried the industry since 001
+-- with nothing ever reading it.
+--
+-- So: the defaults become rows, keyed by vertical, and a new tenant is seeded
+-- from them. Same schema everywhere; different switches per tenant; and the
+-- switch is a row somebody can flip afterwards without a deploy.
+--
+-- ── Why seeding is not the same as entitling ────────────────────────────────
+-- These defaults say what to turn ON, never what is ALLOWED. The plan ceiling
+-- (154) still decides the second question, and it is checked when the seeding
+-- runs: a vertical that would switch on something the tenant's plan does not
+-- permit simply does not switch it on. A default cannot outrank a contract.
+-- ---------------------------------------------------------------------------
+
+-- ─────────────────────────────────────────────────────────────────────────
+-- §1  What a new tenant of an industry starts with
+-- ─────────────────────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS app.vertical_defaults (
+  vertical_id text NOT NULL,
+  plugin_id   text NOT NULL CHECK (plugin_id ~ '^[a-z][a-z0-9-]*$'),
+  facet       text NOT NULL DEFAULT '' CHECK (facet = '' OR facet ~ '^[a-z][a-z0-9_-]*$'),
+  note        text,
+  created_at  timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (vertical_id, plugin_id, facet)
+);
+
+COMMENT ON TABLE app.vertical_defaults IS
+  'What a NEW tenant of an industry gets switched on (160, ADR 0022). Not what a cluster contains — every cluster contains the canonical schema — and not what a plan allows, which is app.plan_grants. Just a sensible starting point that somebody can change afterwards without a deploy.';
+
+ALTER TABLE app.vertical_defaults ENABLE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS vertical_defaults_read ON app.vertical_defaults;
+CREATE POLICY vertical_defaults_read ON app.vertical_defaults FOR SELECT TO authenticated USING (true);
+GRANT SELECT ON app.vertical_defaults TO authenticated;
+GRANT ALL ON app.vertical_defaults TO service_role;
+
+CREATE OR REPLACE FUNCTION public.register_vertical_default(
+  p_vertical text, p_plugin text, p_facet text DEFAULT '', p_note text DEFAULT NULL
+) RETURNS void
+LANGUAGE sql SECURITY DEFINER SET search_path = ''
+AS $$
+  INSERT INTO app.vertical_defaults (vertical_id, plugin_id, facet, note)
+  VALUES (p_vertical, p_plugin, coalesce(p_facet, ''), p_note)
+  ON CONFLICT (vertical_id, plugin_id, facet) DO UPDATE
+    SET note = coalesce(EXCLUDED.note, app.vertical_defaults.note)
+$$;
+
+REVOKE ALL ON FUNCTION public.register_vertical_default(text, text, text, text) FROM public, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.register_vertical_default(text, text, text, text) TO service_role;
+
+-- The four industries the pool profiles describe, transcribed. Kept short on
+-- purpose: a default that switches on everything is not a default, it is a
+-- refusal to choose, and the customer pays for it in a menu they did not ask for.
+DO $$
+BEGIN
+  PERFORM public.register_vertical_default('salon',      'agenda',    'scheduling',  'A agenda é o produto de um salão.');
+  PERFORM public.register_vertical_default('salon',      'agenda',    'public_booking', 'O cliente marca sozinho — o que tira o telefone do balcão.');
+  PERFORM public.register_vertical_default('salon',      'crm',       'contacts');
+  PERFORM public.register_vertical_default('salon',      'financial', 'ledger');
+
+  PERFORM public.register_vertical_default('restaurant', 'menu',      '',            'O cardápio é o catálogo de um restaurante.');
+  PERFORM public.register_vertical_default('restaurant', 'inventory', 'stock',       'Insumo acaba, e acabar sem saber é o custo do restaurante.');
+  PERFORM public.register_vertical_default('restaurant', 'financial', 'ledger');
+
+  PERFORM public.register_vertical_default('ecommerce',  'shop',      '',            'A loja é o produto.');
+  PERFORM public.register_vertical_default('ecommerce',  'inventory', 'stock');
+  PERFORM public.register_vertical_default('ecommerce',  'financial', 'ledger');
+
+  PERFORM public.register_vertical_default('school',     'courses',   '',            'O curso é o produto de uma escola.');
+  PERFORM public.register_vertical_default('school',     'agenda',    'scheduling');
+  PERFORM public.register_vertical_default('school',     'financial', 'ledger');
+
+  PERFORM public.register_vertical_default('agency',     'crm',       'contacts',    'Uma agência vive do funil.');
+  PERFORM public.register_vertical_default('agency',     'crm',       'pipeline');
+  PERFORM public.register_vertical_default('agency',     'financial', 'ledger');
+END $$;
+
+-- ─────────────────────────────────────────────────────────────────────────
+-- §2  Seeding a tenant from its industry
+-- ─────────────────────────────────────────────────────────────────────────
+
+CREATE OR REPLACE FUNCTION public.tenant_apply_vertical_defaults(p_tenant uuid, p_vertical text DEFAULT NULL)
+RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $$
+DECLARE
+  v_vertical text;
+  v_row      record;
+  v_on       integer := 0;
+  v_skipped  text[] := ARRAY[]::text[];
+BEGIN
+  IF p_tenant IS NULL THEN
+    RAISE EXCEPTION 'tenant_apply_vertical_defaults: no tenant' USING ERRCODE = '22023';
+  END IF;
+
+  v_vertical := coalesce(p_vertical, (SELECT t.vertical_id FROM public.tenants t WHERE t.id = p_tenant));
+  IF v_vertical IS NULL THEN
+    RETURN jsonb_build_object('tenant_id', p_tenant, 'vertical', NULL, 'enabled', 0,
+                              'note', 'no vertical on this tenant — nothing to seed');
+  END IF;
+
+  FOR v_row IN
+    SELECT d.plugin_id, d.facet FROM app.vertical_defaults d WHERE d.vertical_id = v_vertical
+  LOOP
+    -- The ceiling wins over the default, always. A plan that does not permit it
+    -- means the tenant does not get it switched on — not that the seeding
+    -- fails, and not that the plan is quietly widened.
+    IF NOT public.plan_permits(v_row.plugin_id, v_row.facet, p_tenant) THEN
+      v_skipped := v_skipped || (v_row.plugin_id || coalesce(nullif('.' || v_row.facet, '.'), ''));
+      CONTINUE;
+    END IF;
+
+    INSERT INTO app.tenant_plugins (tenant_id, plugin_id, facet, status, source)
+    VALUES (p_tenant, v_row.plugin_id, v_row.facet, 'active', 'default')
+    -- Never overrides a decision somebody already made: a plugin a human turned
+    -- off stays off, even if the industry default says otherwise.
+    ON CONFLICT (tenant_id, plugin_id, facet) DO NOTHING;
+
+    IF FOUND THEN v_on := v_on + 1; END IF;
+  END LOOP;
+
+  RETURN jsonb_build_object('tenant_id', p_tenant, 'vertical', v_vertical,
+                            'enabled', v_on, 'not_permitted_by_plan', to_jsonb(v_skipped));
+END $$;
+
+COMMENT ON FUNCTION public.tenant_apply_vertical_defaults(uuid, text) IS
+  'Switches on what a new tenant of this industry starts with (160). Never overrides an existing decision, and never outranks the plan ceiling — a default that could widen a contract would not be a default.';
+
+REVOKE ALL ON FUNCTION public.tenant_apply_vertical_defaults(uuid, text) FROM public, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.tenant_apply_vertical_defaults(uuid, text) TO service_role;
+
+-- New tenants are seeded on creation. AFTER INSERT rather than BEFORE, because
+-- the defaults read the plan, and the plan is on the row that is being written.
+CREATE OR REPLACE FUNCTION public.trg_tenants_apply_vertical_defaults()
+RETURNS trigger
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $$
+BEGIN
+  IF NEW.vertical_id IS NOT NULL THEN
+    -- A failure to seed must never fail the creation of a tenant: an account
+    -- with no modules switched on is recoverable in one click, an account that
+    -- could not be created is a signup lost.
+    BEGIN
+      PERFORM public.tenant_apply_vertical_defaults(NEW.id, NEW.vertical_id);
+    EXCEPTION WHEN OTHERS THEN
+      RAISE WARNING 'tenant % created without vertical defaults: %', NEW.id, SQLERRM;
+    END;
+  END IF;
+  RETURN NEW;
+END $$;
+
+DROP TRIGGER IF EXISTS tenants_apply_vertical_defaults ON public.tenants;
+CREATE TRIGGER tenants_apply_vertical_defaults AFTER INSERT ON public.tenants
+  FOR EACH ROW EXECUTE FUNCTION public.trg_tenants_apply_vertical_defaults();
+
+-- ─────────────────────────────────────────────────────────────────────────
+-- §3  A dedicated cluster is the same schema with one tenant
+--
+-- The decision's own words. Worth writing down because the tempting shortcut —
+-- "it's one customer, so trim the schema" — is exactly what ADR 0022 abolished:
+-- a trimmed cluster cannot receive a second tenant, cannot be compared to any
+-- other pool, and turns every support question into "which schema is this?".
+--
+-- So a dedicated cluster differs in ONE thing: how many tenants it will ever
+-- hold. That is a property of the cluster, recorded here, and the only thing
+-- provisioning does differently.
+-- ─────────────────────────────────────────────────────────────────────────
+
+CREATE TABLE IF NOT EXISTS app.cluster_profile (
+  id           boolean PRIMARY KEY DEFAULT true CHECK (id),
+  mode         text NOT NULL DEFAULT 'shared' CHECK (mode IN ('shared', 'dedicated')),
+  vertical_id  text,
+  note         text,
+  updated_at   timestamptz NOT NULL DEFAULT now()
+);
+
+COMMENT ON TABLE app.cluster_profile IS
+  'What kind of cluster this is (160, ADR 0022). One row, by construction. `dedicated` means it holds exactly one tenant — it does NOT mean a different schema, which is the whole point: same chain everywhere, so a pool can be compared, restored and supported like any other.';
+
+ALTER TABLE app.cluster_profile ENABLE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS cluster_profile_read ON app.cluster_profile;
+CREATE POLICY cluster_profile_read ON app.cluster_profile FOR SELECT TO authenticated, service_role USING (true);
+GRANT SELECT ON app.cluster_profile TO authenticated, service_role;
+GRANT ALL ON app.cluster_profile TO service_role;
+
+INSERT INTO app.cluster_profile (id, mode, note)
+VALUES (true, 'shared', 'Default. Provisioning sets this to dedicated when a cluster is built for one customer.')
+ON CONFLICT (id) DO NOTHING;
+
+CREATE OR REPLACE FUNCTION public.set_cluster_mode(p_mode text, p_vertical text DEFAULT NULL, p_note text DEFAULT NULL)
+RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
+AS $$
+DECLARE
+  v_tenants integer;
+BEGIN
+  IF p_mode NOT IN ('shared', 'dedicated') THEN
+    RAISE EXCEPTION 'set_cluster_mode: mode must be shared or dedicated' USING ERRCODE = '22023';
+  END IF;
+
+  SELECT count(*)::int INTO v_tenants FROM public.tenants;
+  IF p_mode = 'dedicated' AND v_tenants > 1 THEN
+    RAISE EXCEPTION 'set_cluster_mode: this cluster already holds % tenants — dedicated means one', v_tenants
+      USING ERRCODE = '23514',
+            HINT = 'Move the others first, or leave it shared. Nothing about the SCHEMA changes either way.';
+  END IF;
+
+  INSERT INTO app.cluster_profile (id, mode, vertical_id, note, updated_at)
+  VALUES (true, p_mode, p_vertical, p_note, now())
+  ON CONFLICT (id) DO UPDATE
+    SET mode = EXCLUDED.mode, vertical_id = EXCLUDED.vertical_id,
+        note = coalesce(EXCLUDED.note, app.cluster_profile.note), updated_at = now();
+
+  RETURN jsonb_build_object('mode', p_mode, 'vertical', p_vertical, 'tenants', v_tenants);
+END $$;
+
+REVOKE ALL ON FUNCTION public.set_cluster_mode(text, text, text) FROM public, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.set_cluster_mode(text, text, text) TO service_role;
+
+-- A dedicated cluster that grew a second tenant is a provisioning mistake that
+-- should be visible before it becomes a support question.
+CREATE OR REPLACE VIEW public.v_cluster_posture
+WITH (security_invoker = true) AS
+  SELECT p.mode,
+         p.vertical_id,
+         (SELECT count(*) FROM public.tenants) AS tenant_count,
+         (p.mode = 'dedicated' AND (SELECT count(*) FROM public.tenants) > 1) AS violates_dedicated
+    FROM app.cluster_profile p;
+
+COMMENT ON VIEW public.v_cluster_posture IS
+  'What kind of cluster this is and whether it still matches (160). `violates_dedicated` true means a cluster built for one customer is holding somebody else''s data.';
+
+GRANT SELECT ON public.v_cluster_posture TO authenticated, service_role;