@fayz-ai/db 0.12.0 → 0.14.0

package/migrations/004_the_projections_get_a_successor.sql

@@ -0,0 +1,312 @@
+-- ============================================================================
+-- 004_the_projections_get_a_successor — what replaces locations,
+-- location_members and tenant_members (#214 / #352).
+--
+-- #134 moved tenancy into app.* and left three COMPAT PROJECTIONS in public so
+-- the screens kept answering. They are real tables kept in step by triggers,
+-- and their comments have said "Removal: Phase 1" since 2026-08-18.
+--
+-- They could not simply be dropped, for a reason worth writing down: PostgREST
+-- cannot reach the `app` schema, so "read app.* directly" was never available
+-- to a caller. The projection was not laziness — it was the only door.
+--
+-- A security_invoker VIEW is the door that should have been built. RLS on
+-- app.* still decides every row (the policies are already there:
+-- membership_units_write wants members.manage), the shape stays what the 41
+-- callers already expect, and nothing is a second copy of anything.
+--
+-- So the three views below are DROP-IN: same column names, same derivation as
+-- the trigger that maintained the table. app.compat_sync_unit is where the
+-- unit mapping comes from, expression for expression, which is why this reads
+-- like it was copied — it was, deliberately, so the two cannot disagree.
+--
+-- TWO THINGS A VIEW CANNOT DO, and what happens instead:
+--
+--   · app.membership_units has no `id` column; the projection synthesised one.
+--     Here it is derived from (tenant, user, unit), which is the key that was
+--     already unique — so it is stable across reads rather than a fresh uuid
+--     each time, which is what a React key needs it to be.
+--   · PostgREST's upsert needs a unique CONSTRAINT, and a view has none. The
+--     two call sites that upserted a unit membership get an RPC instead, which
+--     is better anyway: assigning somebody to a unit is a verb, and it now
+--     checks members.manage in one place instead of trusting the policy to
+--     catch a malformed write.
+-- ============================================================================
+
+CREATE OR REPLACE VIEW public.v_team_members WITH (security_invoker='true') AS
+ SELECT m.id, m.tenant_id, m.user_id, r.key AS role, m.created_at, m.person_id
+   FROM app.memberships m
+   LEFT JOIN app.roles r ON r.id = m.role_id
+  WHERE m.active;
+
+COMMENT ON VIEW public.v_team_members IS
+  'Active memberships with the role KEY (#214). Drop-in successor to public.tenant_members: same columns, security_invoker, so app.memberships RLS decides the rows.';
+
+CREATE OR REPLACE VIEW public.v_units WITH (security_invoker='true') AS
+ SELECT u.id,
+        u.tenant_id,
+        coalesce(u.metadata ->> 'legacy_kind', u.kind) AS kind,
+        u.name,
+        u.metadata ->> 'email'         AS email,
+        u.metadata ->> 'phone'         AS phone,
+        u.metadata ->> 'address'       AS address,
+        u.metadata ->> 'city'          AS city,
+        u.metadata ->> 'state'         AS state,
+        coalesce(u.metadata ->> 'country', 'BR') AS country,
+        u.metadata ->> 'postal_code'   AS postal_code,
+        (u.kind = 'hq')                AS is_headquarters,
+        u.active                       AS is_active,
+        coalesce((SELECT array_agg(t) FROM jsonb_array_elements_text(
+                   CASE WHEN jsonb_typeof(u.metadata -> 'tags') = 'array'
+                        THEN u.metadata -> 'tags' ELSE '[]'::jsonb END) t), '{}'::text[]) AS tags,
+        u.metadata ->> 'notes'         AS notes,
+        u.metadata,
+        CASE WHEN jsonb_typeof(u.metadata -> 'custom_fields') = 'object'
+             THEN u.metadata -> 'custom_fields' ELSE '{}'::jsonb END AS custom_fields,
+        -- app.compat_uuid inlined: it is a guarded cast, and calling it here
+        -- would make every reader of this view need EXECUTE on an app.* function
+        -- as well as SELECT on the view. A view should not carry a second grant.
+        CASE WHEN u.metadata ->> 'created_by' ~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
+             THEN (u.metadata ->> 'created_by')::uuid END AS created_by,
+        u.created_at,
+        u.updated_at,
+        u.parent_unit_id               AS parent_id,
+        u.metadata ->> 'code'          AS code,
+        -- Guarded casts: metadata is merchant-writable, and a view that throws
+        -- on one bad string takes the whole units screen down with it.
+        CASE WHEN u.metadata ->> 'latitude'  ~ '^-?[0-9]+(\.[0-9]+)?$'
+             THEN (u.metadata ->> 'latitude')::numeric  END AS latitude,
+        CASE WHEN u.metadata ->> 'longitude' ~ '^-?[0-9]+(\.[0-9]+)?$'
+             THEN (u.metadata ->> 'longitude')::numeric END AS longitude
+   FROM app.units u;
+
+COMMENT ON VIEW public.v_units IS
+  'Units in the shape the units screen reads (#214). Drop-in successor to public.locations, deriving the same columns from app.units + metadata as app.compat_sync_unit did.';
+
+CREATE OR REPLACE VIEW public.v_unit_members WITH (security_invoker='true') AS
+ SELECT md5(mu.tenant_id::text || ':' || mu.user_id::text || ':' || mu.unit_id::text)::uuid AS id,
+        mu.unit_id AS location_id,
+        mu.user_id,
+        coalesce(ro.key, r.key) AS role,
+        mu.tenant_id,
+        mu.created_at
+   FROM app.membership_units mu
+   LEFT JOIN app.roles ro ON ro.id = mu.role_override_id
+   LEFT JOIN app.memberships m ON m.tenant_id = mu.tenant_id AND m.user_id = mu.user_id
+   LEFT JOIN app.roles r ON r.id = m.role_id;
+
+COMMENT ON VIEW public.v_unit_members IS
+  'Who is bound to which unit, with the EFFECTIVE role key — the per-unit override when there is one, otherwise the membership role (#214). Drop-in successor to public.location_members; `id` is derived from (tenant, user, unit) because app.membership_units has none and that triple was already the key.';
+
+REVOKE ALL ON public.v_team_members, public.v_units, public.v_unit_members FROM PUBLIC;
+GRANT SELECT ON public.v_team_members, public.v_units, public.v_unit_members TO authenticated, service_role;
+
+-- ── the two verbs a view cannot carry ──────────────────────────────────────
+
+CREATE OR REPLACE FUNCTION public.unit_member_set(p_unit uuid, p_user uuid, p_role text DEFAULT NULL)
+ RETURNS void
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO ''
+AS $function$
+DECLARE
+  v_tenant uuid := app.current_tenant_id();
+  v_role   uuid;
+BEGIN
+  IF auth.uid() IS NULL OR v_tenant IS NULL THEN
+    RAISE EXCEPTION 'unit_member_set: no active tenant for this session' USING ERRCODE = '42501';
+  END IF;
+  IF NOT app.has_permission('members.manage') THEN
+    RAISE EXCEPTION 'unit_member_set: members.manage is required' USING ERRCODE = '42501';
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM app.units u WHERE u.tenant_id = v_tenant AND u.id = p_unit) THEN
+    RAISE EXCEPTION 'unit_member_set: no unit % in the active tenant', p_unit USING ERRCODE = 'P0002';
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM app.memberships m WHERE m.tenant_id = v_tenant AND m.user_id = p_user) THEN
+    RAISE EXCEPTION 'unit_member_set: % is not a member of this tenant', p_user USING ERRCODE = '23503';
+  END IF;
+
+  -- NULL role = bound to the unit with no override, which is not the same as
+  -- "no role": the membership's own role still applies. Only a NAMED role is
+  -- an override, and an unknown one is refused rather than silently ignored.
+  IF p_role IS NOT NULL THEN
+    SELECT r.id INTO v_role FROM app.roles r WHERE r.tenant_id = v_tenant AND r.key = p_role;
+    IF v_role IS NULL THEN
+      RAISE EXCEPTION 'unit_member_set: no role % in this tenant', p_role USING ERRCODE = '23503';
+    END IF;
+  END IF;
+
+  INSERT INTO app.membership_units (tenant_id, user_id, unit_id, role_override_id)
+  VALUES (v_tenant, p_user, p_unit, v_role)
+  ON CONFLICT (tenant_id, user_id, unit_id) DO UPDATE SET role_override_id = EXCLUDED.role_override_id;
+END $function$;
+
+CREATE OR REPLACE FUNCTION public.unit_member_remove(p_unit uuid, p_user uuid)
+ RETURNS void
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO ''
+AS $function$
+DECLARE v_tenant uuid := app.current_tenant_id();
+BEGIN
+  IF auth.uid() IS NULL OR v_tenant IS NULL THEN
+    RAISE EXCEPTION 'unit_member_remove: no active tenant for this session' USING ERRCODE = '42501';
+  END IF;
+  IF NOT app.has_permission('members.manage') THEN
+    RAISE EXCEPTION 'unit_member_remove: members.manage is required' USING ERRCODE = '42501';
+  END IF;
+  DELETE FROM app.membership_units
+   WHERE tenant_id = v_tenant AND user_id = p_user AND unit_id = p_unit;
+END $function$;
+
+REVOKE ALL ON FUNCTION public.unit_member_set(uuid, uuid, text) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.unit_member_remove(uuid, uuid) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.unit_member_set(uuid, uuid, text) TO authenticated, service_role;
+GRANT EXECUTE ON FUNCTION public.unit_member_remove(uuid, uuid) TO authenticated, service_role;
+
+COMMENT ON FUNCTION public.unit_member_set(uuid, uuid, text) IS
+  'Bind a member to a unit, optionally with a role override (#214). Replaces the upsert the location_members projection accepted.';
+COMMENT ON FUNCTION public.unit_member_remove(uuid, uuid) IS
+  'Unbind a member from a unit (#214).';
+
+-- ── the team-membership verbs the projection used to accept as writes ──────
+-- The Team screen updated a role, removed a member and created a unit by
+-- writing the projection and letting a trigger forward it. A joined view
+-- cannot accept those, and should not: each is a verb with a rule attached.
+
+CREATE OR REPLACE FUNCTION public.member_set_role(p_membership uuid, p_role text)
+ RETURNS void
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO ''
+AS $function$
+DECLARE
+  v_tenant uuid := app.current_tenant_id();
+  v_role   uuid;
+  v_owners integer;
+  v_was    uuid;
+BEGIN
+  IF auth.uid() IS NULL OR v_tenant IS NULL THEN
+    RAISE EXCEPTION 'member_set_role: no active tenant for this session' USING ERRCODE = '42501';
+  END IF;
+  IF NOT app.has_permission('members.manage') THEN
+    RAISE EXCEPTION 'member_set_role: members.manage is required' USING ERRCODE = '42501';
+  END IF;
+
+  SELECT r.id INTO v_role FROM app.roles r WHERE r.tenant_id = v_tenant AND r.key = p_role;
+  IF v_role IS NULL THEN
+    RAISE EXCEPTION 'member_set_role: no role % in this tenant', p_role USING ERRCODE = '23503';
+  END IF;
+
+  SELECT m.role_id INTO v_was FROM app.memberships m WHERE m.tenant_id = v_tenant AND m.id = p_membership;
+  IF v_was IS NULL THEN
+    RAISE EXCEPTION 'member_set_role: membership not found in the active tenant' USING ERRCODE = 'P0002';
+  END IF;
+
+  -- Demoting the last owner locks everybody out of the tenant, and the screen
+  -- that does it has no way to know it was the last one. Refuse here, where
+  -- the count is cheap and correct.
+  IF EXISTS (SELECT 1 FROM app.roles r WHERE r.id = v_was AND r.key = 'owner')
+     AND NOT EXISTS (SELECT 1 FROM app.roles r WHERE r.id = v_role AND r.key = 'owner') THEN
+    SELECT count(*) INTO v_owners
+      FROM app.memberships m JOIN app.roles r ON r.id = m.role_id
+     WHERE m.tenant_id = v_tenant AND m.active AND r.key = 'owner';
+    IF v_owners <= 1 THEN
+      RAISE EXCEPTION 'member_set_role: this is the last owner — promote somebody else first'
+        USING ERRCODE = '23503';
+    END IF;
+  END IF;
+
+  UPDATE app.memberships SET role_id = v_role, updated_at = now()
+   WHERE tenant_id = v_tenant AND id = p_membership;
+END $function$;
+
+CREATE OR REPLACE FUNCTION public.member_remove(p_membership uuid)
+ RETURNS void
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO ''
+AS $function$
+DECLARE
+  v_tenant uuid := app.current_tenant_id();
+  v_owner  boolean;
+  v_owners integer;
+BEGIN
+  IF auth.uid() IS NULL OR v_tenant IS NULL THEN
+    RAISE EXCEPTION 'member_remove: no active tenant for this session' USING ERRCODE = '42501';
+  END IF;
+  IF NOT app.has_permission('members.manage') THEN
+    RAISE EXCEPTION 'member_remove: members.manage is required' USING ERRCODE = '42501';
+  END IF;
+
+  SELECT EXISTS (SELECT 1 FROM app.roles r WHERE r.id = m.role_id AND r.key = 'owner')
+    INTO v_owner FROM app.memberships m WHERE m.tenant_id = v_tenant AND m.id = p_membership;
+  IF v_owner IS NULL THEN
+    RAISE EXCEPTION 'member_remove: membership not found in the active tenant' USING ERRCODE = 'P0002';
+  END IF;
+  IF v_owner THEN
+    SELECT count(*) INTO v_owners
+      FROM app.memberships m JOIN app.roles r ON r.id = m.role_id
+     WHERE m.tenant_id = v_tenant AND m.active AND r.key = 'owner';
+    IF v_owners <= 1 THEN
+      RAISE EXCEPTION 'member_remove: this is the last owner — a tenant nobody owns cannot be administered'
+        USING ERRCODE = '23503';
+    END IF;
+  END IF;
+
+  -- DEACTIVATE, not delete. The projection's DELETE was forwarded to an UPDATE
+  -- that set active = false, and the history is the point: who was on the team
+  -- in March is a question an audit asks. v_team_members filters on active, so
+  -- the row disappears from every screen either way.
+  UPDATE app.memberships SET active = false, updated_at = now()
+   WHERE tenant_id = v_tenant AND id = p_membership;
+END $function$;
+
+CREATE OR REPLACE FUNCTION public.unit_create(p_name text, p_kind text DEFAULT 'branch',
+                                              p_parent_unit uuid DEFAULT NULL, p_metadata jsonb DEFAULT '{}'::jsonb)
+ RETURNS uuid
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO ''
+AS $function$
+DECLARE
+  v_tenant uuid := app.current_tenant_id();
+  v_id     uuid;
+BEGIN
+  IF auth.uid() IS NULL OR v_tenant IS NULL THEN
+    RAISE EXCEPTION 'unit_create: no active tenant for this session' USING ERRCODE = '42501';
+  END IF;
+  IF NOT app.has_permission('units.manage') THEN
+    RAISE EXCEPTION 'unit_create: units.manage is required' USING ERRCODE = '42501';
+  END IF;
+  IF p_name IS NULL OR btrim(p_name) = '' THEN
+    RAISE EXCEPTION 'unit_create: a name is required' USING ERRCODE = '22023';
+  END IF;
+  IF p_kind NOT IN ('hq', 'branch') THEN
+    RAISE EXCEPTION 'unit_create: kind must be hq or branch (got %)', p_kind USING ERRCODE = '22023';
+  END IF;
+  IF p_parent_unit IS NOT NULL
+     AND NOT EXISTS (SELECT 1 FROM app.units u WHERE u.tenant_id = v_tenant AND u.id = p_parent_unit) THEN
+    RAISE EXCEPTION 'unit_create: no parent unit % in this tenant', p_parent_unit USING ERRCODE = 'P0002';
+  END IF;
+
+  INSERT INTO app.units (tenant_id, kind, name, parent_unit_id, active, metadata)
+  VALUES (v_tenant, p_kind, btrim(p_name), p_parent_unit, true, coalesce(p_metadata, '{}'::jsonb))
+  RETURNING id INTO v_id;
+
+  RETURN v_id;
+END $function$;
+
+REVOKE ALL ON FUNCTION public.member_set_role(uuid, text) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.member_remove(uuid) FROM PUBLIC;
+REVOKE ALL ON FUNCTION public.unit_create(text, text, uuid, jsonb) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.member_set_role(uuid, text) TO authenticated, service_role;
+GRANT EXECUTE ON FUNCTION public.member_remove(uuid) TO authenticated, service_role;
+GRANT EXECUTE ON FUNCTION public.unit_create(text, text, uuid, jsonb) TO authenticated, service_role;
+
+COMMENT ON FUNCTION public.member_set_role(uuid, text) IS
+  'Change a member''s role (#214). Refuses to demote the last owner — the screen doing it cannot know it was the last.';
+COMMENT ON FUNCTION public.member_remove(uuid) IS
+  'Deactivate a membership (#214). Refuses the last owner. Deactivates rather than deletes: the projection it replaces did the same, and who was on the team last month is a question an audit asks.';
+COMMENT ON FUNCTION public.unit_create(text, text, uuid, jsonb) IS
+  'Create a unit (#214). Replaces the INSERT the locations projection accepted; the address lives in metadata, which is where app.units keeps it.';

package/migrations/005_the_archetypes_anchor_to_the_unit.sql

@@ -0,0 +1,90 @@
+-- ============================================================================
+-- 005_the_archetypes_anchor_to_the_unit — eight foreign keys stop pointing at
+-- a projection (#214 / #352).
+--
+-- Found by applying the chain and then trying to drop public.locations: eight
+-- core tables have a FOREIGN KEY into it.
+--
+--     appointments.location_id     orders.location_id     schedules.location_id
+--     categories.unit_id           people.unit_id         products.unit_id
+--     tasks.unit_id                user_unit_prefs.unit_id
+--
+-- That is not merely why the projection could not be dropped. It is a defect on
+-- its own terms: public.locations is a COMPAT PROJECTION of app.units, kept in
+-- step by a trigger (app.compat_sync_unit), and referential integrity for the
+-- whole unit-scoping layer was resting on a DERIVED table. If the trigger ever
+-- fell behind, the constraint would be enforcing against a copy.
+--
+-- Repointed to app.units(id), which is the real thing and already has the
+-- primary key to be referenced by. ON DELETE is preserved exactly — SET NULL
+-- everywhere except user_unit_prefs, which CASCADEs, because a preference for
+-- a unit that no longer exists is not a preference.
+--
+-- SAFE BECAUSE THE IDS ARE THE SAME. The projection's own comment says so
+-- ("same ids"), and the guard below proves it per pool before touching
+-- anything: if a single row names a unit that app.units does not have, the
+-- migration says so and changes nothing, rather than dropping a constraint and
+-- failing to re-add it.
+--
+-- locations_parent_same_tenant is deliberately not moved: it is locations' own
+-- self-reference and leaves with the table. Neither is location_members', for
+-- the same reason.
+--
+-- DISCOVERED, NOT NAMED. The first version of this file listed the eight
+-- constraints it had seen. Then a real pool turned out to have NINE — it
+-- predates #351, so public.services still exists and still carries
+-- services_unit_id_fkey. A hardcoded list is a photograph of one database, and
+-- the fleet is not one database. So this reads pg_constraint and moves whatever
+-- it finds, which is also what makes it correct on a pool nobody has looked at.
+-- ============================================================================
+
+DO $fk$
+DECLARE
+  r       record;
+  v_orph  bigint;
+  v_moved integer := 0;
+BEGIN
+  IF to_regclass('app.units') IS NULL OR to_regclass('public.locations') IS NULL THEN RETURN; END IF;
+
+  FOR r IN
+    SELECT c.conname,
+           src.relname             AS src_table,
+           a.attname               AS src_col,
+           CASE c.confdeltype WHEN 'c' THEN 'CASCADE' WHEN 'n' THEN 'SET NULL'
+                              WHEN 'd' THEN 'SET DEFAULT' WHEN 'r' THEN 'RESTRICT'
+                              ELSE 'NO ACTION' END AS on_delete
+      FROM pg_constraint c
+      JOIN pg_class src      ON src.oid = c.conrelid
+      JOIN pg_class tgt      ON tgt.oid = c.confrelid
+      JOIN pg_namespace tn   ON tn.oid = tgt.relnamespace
+      JOIN pg_namespace sn   ON sn.oid = src.relnamespace
+      JOIN pg_attribute a    ON a.attrelid = src.oid AND a.attnum = c.conkey[1]
+     WHERE c.contype = 'f'
+       AND tn.nspname = 'public' AND tgt.relname = 'locations'
+       AND sn.nspname = 'public'
+       -- Single-column only. The one multi-column FK here is locations' own
+       -- (parent_id, tenant_id) self-reference, which leaves with the table.
+       AND array_length(c.conkey, 1) = 1
+       -- Anything whose own table is going away in the same wave: its FK goes
+       -- with it, and repointing it first would be work thrown away.
+       AND src.relname NOT IN ('locations', 'location_members')
+  LOOP
+    EXECUTE format(
+      'SELECT count(*) FROM public.%I x WHERE x.%I IS NOT NULL
+         AND NOT EXISTS (SELECT 1 FROM app.units u WHERE u.id = x.%I)',
+      r.src_table, r.src_col, r.src_col) INTO v_orph;
+    IF v_orph > 0 THEN
+      RAISE EXCEPTION '005: %.% has % row(s) naming a unit app.units does not have — reconcile before repointing',
+        r.src_table, r.src_col, v_orph USING ERRCODE = '23503';
+    END IF;
+
+    EXECUTE format('ALTER TABLE public.%I DROP CONSTRAINT %I', r.src_table, r.conname);
+    EXECUTE format('ALTER TABLE public.%I ADD CONSTRAINT %I FOREIGN KEY (%I) REFERENCES app.units(id) ON DELETE %s',
+                   r.src_table, r.conname, r.src_col, r.on_delete);
+    v_moved := v_moved + 1;
+  END LOOP;
+
+  IF v_moved > 0 THEN
+    RAISE NOTICE '005: % foreign key(s) repointed from public.locations to app.units', v_moved;
+  END IF;
+END $fk$;

package/migrations/006_the_helpers_read_the_source.sql

@@ -0,0 +1,153 @@
+-- ============================================================================
+-- 006_the_helpers_read_the_source — six SQL functions and one policy stop
+-- reading the compat projections (#214 / #352).
+--
+-- Found by applying the chain and then trying to drop the three projections.
+-- One object BLOCKED the drop — the profiles_select policy. Six others did
+-- not block it and were the real hazard:
+--
+--   is_tenant_member        user_admin_tenant_ids   user_unit_ids
+--   unit_bootstrap          tenant_member_activity  unlinked_member_count
+--
+-- All six are LANGUAGE sql, and a classic SQL function body is a string that
+-- Postgres does not resolve until it runs. So the DROP would have succeeded,
+-- and the breakage would have arrived later, at a call — and three of these
+-- are called from inside RLS across the whole database. `is_tenant_member` and
+-- `user_unit_ids` are in the N17 allowlist precisely because policies lean on
+-- them. Dropping a table under them would not have failed loudly; it would
+-- have quietly emptied every policy that asks who you are.
+--
+-- That is the argument for this file existing separately from 005: a foreign
+-- key announces itself, and a function body does not.
+--
+-- Each body is the original with the relation swapped, and nothing else:
+--
+--   public.tenant_members    -> app.memberships (active only, which is what
+--                               the projection contained)
+--   public.location_members  -> app.membership_units
+--   public.locations         -> app.units, or the successor views from 004
+--                               where the shape is what the caller wanted
+--
+-- `role` is the one place the swap is not one word: the projection carried the
+-- role KEY and app.memberships carries role_id, so the two that filtered on it
+-- join app.roles to get the key back.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.is_tenant_member(p_tenant_id uuid, p_user_id uuid)
+ RETURNS boolean LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO 'public', 'pg_temp'
+AS $function$
+  SELECT EXISTS (
+    SELECT 1 FROM app.memberships m
+     WHERE m.tenant_id = p_tenant_id AND m.user_id = p_user_id AND m.active
+  );
+$function$;
+
+CREATE OR REPLACE FUNCTION public.user_admin_tenant_ids()
+ RETURNS SETOF uuid LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO 'public', 'pg_temp'
+AS $function$
+  SELECT m.tenant_id
+    FROM app.memberships m
+    JOIN app.roles r ON r.id = m.role_id
+   WHERE m.user_id = auth.uid() AND m.active
+     AND r.key IN ('owner', 'admin');
+$function$;
+
+CREATE OR REPLACE FUNCTION public.user_unit_ids()
+ RETURNS SETOF uuid LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO 'public', 'pg_temp'
+AS $function$
+  WITH RECURSIVE seed AS (
+    SELECT mu.unit_id AS id, 0 AS depth
+      FROM app.membership_units mu
+     WHERE mu.user_id = auth.uid()
+  ),
+  tree AS (
+    SELECT id, depth FROM seed
+    UNION                                -- UNION, not UNION ALL: dedupes, and
+    SELECT u.id, t.depth + 1             -- therefore terminates on a cycle
+      FROM app.units u
+      JOIN tree t ON u.parent_unit_id = t.id
+     WHERE t.depth < 8                   -- a policy must never be able to hang
+  )
+  SELECT id FROM tree;
+$function$;
+
+CREATE OR REPLACE FUNCTION public.tenant_member_activity(p_tenant_id uuid)
+ RETURNS TABLE(user_id uuid, last_sign_in_at timestamp with time zone, signed_up_at timestamp with time zone)
+ LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO 'public', 'pg_temp'
+AS $function$
+  SELECT u.id, u.last_sign_in_at, u.created_at
+    FROM auth.users u
+    JOIN app.memberships m ON m.user_id = u.id
+   WHERE m.tenant_id = p_tenant_id AND m.active
+     -- The gate, and the only one: an admin of THIS tenant, and nobody else.
+     -- Without it the function is a directory of every last_sign_in_at in the
+     -- pool, reachable by anyone with an anon key.
+     AND p_tenant_id IN (SELECT public.user_admin_tenant_ids());
+$function$;
+
+CREATE OR REPLACE FUNCTION public.unlinked_member_count()
+ RETURNS integer LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO 'public', 'pg_temp'
+AS $function$
+  SELECT count(*)::integer FROM app.memberships WHERE person_id IS NULL AND active;
+$function$;
+
+CREATE OR REPLACE FUNCTION public.unit_bootstrap(p_tenant_id uuid, p_device_id text DEFAULT NULL::text)
+ RETURNS jsonb LANGUAGE sql STABLE SET search_path TO 'public', 'pg_temp'
+AS $function$
+  SELECT jsonb_build_object(
+    'mode', COALESCE((
+      SELECT t.unit_scoping_enabled FROM public.tenants t WHERE t.id = p_tenant_id
+    ), false),
+    -- v_units, not app.units: this shape is the one the shell already parses,
+    -- and the view exists to keep saying it after the projection is gone.
+    'units', COALESCE((
+      SELECT jsonb_agg(to_jsonb(l) ORDER BY l.is_headquarters DESC NULLS LAST, l.name)
+        FROM public.v_units l WHERE l.tenant_id = p_tenant_id
+    ), '[]'::jsonb),
+    'bindings', COALESCE((
+      SELECT jsonb_agg(jsonb_build_object('location_id', lm.location_id, 'role', lm.role))
+        FROM public.v_unit_members lm WHERE lm.user_id = (SELECT auth.uid())
+    ), '[]'::jsonb),
+    'scoped', COALESCE((
+      SELECT jsonb_object_agg(sr.resource_table, jsonb_build_object(
+               'unit_column', sr.unit_column, 'shareable', sr.shareable))
+        FROM public.scoped_resources sr
+    ), '{}'::jsonb),
+    -- O pino desta máquina ganha do pino da conta quando os dois existem: a
+    -- máquina fica na loja, a conta viaja com a pessoa.
+    'device_pin', (
+      SELECT p.unit_id FROM public.user_unit_prefs p
+       WHERE p.user_id = (SELECT auth.uid())
+         AND p.tenant_id = p_tenant_id
+         AND p.device_id = p_device_id
+    ),
+    'device_pin_set', EXISTS (
+      SELECT 1 FROM public.user_unit_prefs p
+       WHERE p.user_id = (SELECT auth.uid())
+         AND p.tenant_id = p_tenant_id
+         AND p.device_id = p_device_id
+    ),
+    'account_pin', (
+      SELECT p.unit_id FROM public.user_unit_prefs p
+       WHERE p.user_id = (SELECT auth.uid())
+         AND p.tenant_id = p_tenant_id
+       ORDER BY p.updated_at DESC
+       LIMIT 1
+    ),
+    'account_pin_set', EXISTS (
+      SELECT 1 FROM public.user_unit_prefs p
+       WHERE p.user_id = (SELECT auth.uid()) AND p.tenant_id = p_tenant_id
+    )
+  );
+$function$;
+
+-- The one hard dependency: a policy naming the table blocks the DROP outright.
+DROP POLICY IF EXISTS "profiles_select" ON public.profiles;
+CREATE POLICY "profiles_select" ON public.profiles FOR SELECT TO authenticated
+  USING (
+    id = (SELECT auth.uid())
+    OR id IN (
+      SELECT m.user_id FROM app.memberships m
+       WHERE m.active AND m.tenant_id IN (SELECT public.user_tenant_ids())
+    )
+  );

package/migrations/007_the_compat_machinery_leaves_with_the_tables.sql

@@ -0,0 +1,77 @@
+-- ============================================================================
+-- 007_the_compat_machinery_leaves_with_the_tables — what MAINTAINED the three
+-- projections goes with them (#214 / #352).
+--
+-- Found by `node packages/db/test/chain/run.mjs --full`, which is the run that
+-- applies the optional plugins too — so it is the only run where shop 0110
+-- actually drops the projections, and therefore the only run that could catch
+-- this. The core-A chain had been green throughout.
+--
+-- The seed failed with `relation "public.locations" does not exist`, and the
+-- cause was not the seed: FOUR TRIGGERS ON app.* still fanned every write out
+-- into the projections.
+--
+--     app.units            units_compat            -> app.compat_sync_unit
+--     app.memberships      memberships_compat      -> app.compat_sync_membership
+--     app.membership_units membership_units_compat -> app.compat_sync_membership
+--     app.roles            roles_compat            -> app.compat_sync_membership
+--
+-- So after 0110, CREATING A UNIT OR A MEMBERSHIP RAISED. A projection is two
+-- things — the copy and the machine that keeps it — and dropping only the copy
+-- leaves the machine writing to something that is not there. The `plpgsql
+-- resolves names at call time` property that made these safe to drop AROUND is
+-- exactly what stopped it being noticed at drop time.
+--
+-- ensure_member_person and backfill_member_persons are NOT dropped: linking a
+-- login to its Person is still a live concern (#137). Only the relation they
+-- read changes, taken from the pool's own body so nothing else moves with it.
+-- ============================================================================
+
+-- GUARDED, because where this runs is not where the tables go. The projections
+-- are dropped by shop 0110, and shop is an OPTIONAL plugin: on a core-A pool it
+-- never runs, and the tables are still there and still have to be maintained.
+-- Dropping the machinery here unconditionally would leave a core-A cluster with
+-- three projection tables nothing keeps in step — worse than either end state.
+--
+-- So this only fires once the tables are actually gone, which on a --full chain
+-- is shop 0111, and on a pool that already has them dropped is right here.
+DO $guard$
+BEGIN
+  IF to_regclass('public.locations') IS NOT NULL
+     OR to_regclass('public.tenant_members') IS NOT NULL
+     OR to_regclass('public.location_members') IS NOT NULL THEN
+    RAISE NOTICE '007: the projections are still present — the machinery stays with them';
+    RETURN;
+  END IF;
+
+  EXECUTE $sql$
+DROP TRIGGER IF EXISTS units_compat            ON app.units;
+DROP TRIGGER IF EXISTS memberships_compat      ON app.memberships;
+DROP TRIGGER IF EXISTS membership_units_compat ON app.membership_units;
+DROP TRIGGER IF EXISTS roles_compat            ON app.roles;
+
+DROP FUNCTION IF EXISTS app.trg_units_compat() CASCADE;
+DROP FUNCTION IF EXISTS app.trg_memberships_compat() CASCADE;
+DROP FUNCTION IF EXISTS app.trg_membership_units_compat() CASCADE;
+DROP FUNCTION IF EXISTS app.trg_roles_compat() CASCADE;
+DROP FUNCTION IF EXISTS app.compat_sync_unit(uuid) CASCADE;
+DROP FUNCTION IF EXISTS app.compat_sync_membership(uuid, uuid) CASCADE;
+DROP FUNCTION IF EXISTS app.compat_rebuild() CASCADE;
+DROP FUNCTION IF EXISTS public.handle_location_member_tenant() CASCADE;
+  $sql$;
+  RAISE NOTICE '007: the compat sync machinery is retired';
+END $guard$;
+
+DO $fix$
+DECLARE r record; v_def text; v_new text; v_n int := 0;
+BEGIN
+  FOR r IN
+    SELECT p.oid FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+     WHERE n.nspname = 'public' AND p.proname IN ('ensure_member_person','backfill_member_persons')
+  LOOP
+    v_def := pg_get_functiondef(r.oid);
+    v_new := replace(v_def, 'public.tenant_members', 'app.memberships');
+    IF v_new <> v_def THEN EXECUTE v_new; v_n := v_n + 1; END IF;
+  END LOOP;
+  RAISE NOTICE '007: % person-link function(s) moved to app.memberships', v_n;
+END $fix$;