@fayz-ai/db 0.13.0 → 0.14.0

package/migrations/015_agent_guard.sql

@@ -1,108 +0,0 @@
--- ============================================================================
--- 015_agent_guard.sql — the role→plan→limit gate for agent_* RPCs.
---
--- Every server-plane agent write RPC (agent_<domain>_<verb>) calls this FIRST.
--- It is the SQL mirror of the shared TS engine (@fayz-ai/core/access
--- resolveAccess/resolveLimit): role first (owner bypasses role, NOT plan;
--- `manage` satisfies any action; tenant_role_overrides win over role grants),
--- then plan feature gate (only explicit false denies), then the plan cap for
--- p_limit_key (absent / -1 = unlimited). The RPC counts its own domain rows
--- and passes p_used — the guard never runs dynamic SQL.
---
--- Returns NULL when allowed, or the AgentDenial jsonb mirror when denied:
---   {"allowed":false,"reason":"role"|"plan"|"limit",
---    "limit":{"key":..,"max":..,"used":..},"upgradeUrl":"/settings/subscription"}
--- A parity test on the app side runs the same scenarios through the TS engine
--- and through this function — divergence is a bug.
---
--- Permission ids use the `category.action` catalog form; grants live in
--- role_permissions (+ per-tenant tenant_role_overrides with granted boolean).
--- ============================================================================
-
-CREATE OR REPLACE FUNCTION public.agent_guard(
-  p_tenant_id uuid,
-  p_actor_user_id uuid,
-  p_feature text,
-  p_action text,
-  p_limit_key text DEFAULT NULL,
-  p_used integer DEFAULT NULL,
-  p_n integer DEFAULT 1
-) RETURNS jsonb
-LANGUAGE plpgsql STABLE SECURITY DEFINER
-SET search_path = public
-AS $$
-DECLARE
-  v_role text;
-  v_has boolean;
-  v_override boolean;
-  v_plan_id text;
-  v_ent jsonb;
-  v_feature_flag jsonb;
-  v_cap numeric;
-BEGIN
-  -- ── membership + role ────────────────────────────────────────────────────
-  SELECT tm.role INTO v_role
-  FROM tenant_members tm
-  WHERE tm.tenant_id = p_tenant_id AND tm.user_id = p_actor_user_id;
-  IF v_role IS NULL THEN
-    RETURN jsonb_build_object('allowed', false, 'reason', 'role',
-                              'upgradeUrl', '/settings/subscription');
-  END IF;
-
-  IF v_role <> 'owner' THEN
-    -- per-tenant override wins in BOTH directions (grant or deny)
-    SELECT tro.granted INTO v_override
-    FROM tenant_role_overrides tro
-    WHERE tro.tenant_id = p_tenant_id AND tro.role = v_role
-      AND tro.permission_id IN (p_feature || '.' || p_action, p_feature || '.manage')
-    ORDER BY (tro.permission_id = p_feature || '.' || p_action) DESC
-    LIMIT 1;
-
-    IF v_override IS NOT NULL THEN
-      v_has := v_override;
-    ELSE
-      SELECT EXISTS (
-        SELECT 1 FROM role_permissions rp
-        WHERE rp.role = v_role
-          AND rp.permission_id IN (p_feature || '.' || p_action, p_feature || '.manage')
-      ) INTO v_has;
-    END IF;
-
-    IF NOT v_has THEN
-      RETURN jsonb_build_object('allowed', false, 'reason', 'role',
-                                'upgradeUrl', '/settings/subscription');
-    END IF;
-  END IF;
-
-  -- ── plan feature gate (owner does NOT bypass) ────────────────────────────
-  SELECT t.plan INTO v_plan_id FROM tenants t WHERE t.id = p_tenant_id;
-  SELECT p.entitlements INTO v_ent FROM plans p WHERE p.id = v_plan_id;
-
-  IF v_ent IS NOT NULL THEN
-    v_feature_flag := v_ent->'features'->p_feature;
-    -- only an EXPLICIT false denies (additive plans — mirror isEntitledByPlan)
-    IF v_feature_flag IS NOT NULL AND v_feature_flag = to_jsonb(false) THEN
-      RETURN jsonb_build_object('allowed', false, 'reason', 'plan',
-                                'upgradeUrl', '/settings/subscription');
-    END IF;
-
-    -- ── plan cap (mirror resolveLimit: absent / -1 = unlimited) ────────────
-    IF p_limit_key IS NOT NULL AND p_used IS NOT NULL THEN
-      v_cap := (v_ent->'limits'->>p_limit_key)::numeric;
-      IF v_cap IS NOT NULL AND v_cap <> -1 AND (p_used + COALESCE(p_n, 1)) > v_cap THEN
-        RETURN jsonb_build_object('allowed', false, 'reason', 'limit',
-                                  'limit', jsonb_build_object('key', p_limit_key,
-                                                              'max', v_cap,
-                                                              'used', p_used),
-                                  'upgradeUrl', '/settings/subscription');
-      END IF;
-    END IF;
-  END IF;
-
-  RETURN NULL; -- allowed
-END;
-$$;
-
-REVOKE ALL ON FUNCTION public.agent_guard(uuid, uuid, text, text, text, integer, integer) FROM public;
-GRANT EXECUTE ON FUNCTION public.agent_guard(uuid, uuid, text, text, text, integer, integer)
-  TO authenticated, service_role;

package/migrations/016_agent_guard_actor.sql

@@ -1,102 +0,0 @@
--- ============================================================================
--- 016_agent_guard_actor.sql — the actor cannot be spoofed by a signed-in caller.
---
--- agent_* RPCs receive p_actor_user_id explicitly because the Fayz broker
--- (service_role, no JWT) injects the verified actor server-side. But the same
--- functions are EXECUTE-granted to `authenticated` so the surface can call
--- them client-plane before S4 — and there, p_actor comes from the client. A
--- signed-in user passing SOMEONE ELSE's id would borrow their role.
---
--- Rule added at the top of agent_guard (every write RPC's first call): when
--- the caller carries a JWT identity (auth.uid() not null), p_actor MUST be
--- that identity. Service-role/broker calls (auth.uid() null) are unaffected.
--- New file rather than editing 015 — applied migrations are never edited
--- (ledger rule); CREATE OR REPLACE supersedes the body.
--- ============================================================================
-
-CREATE OR REPLACE FUNCTION public.agent_guard(
-  p_tenant_id uuid,
-  p_actor_user_id uuid,
-  p_feature text,
-  p_action text,
-  p_limit_key text DEFAULT NULL,
-  p_used integer DEFAULT NULL,
-  p_n integer DEFAULT 1
-) RETURNS jsonb
-LANGUAGE plpgsql STABLE SECURITY DEFINER
-SET search_path = public
-AS $$
-DECLARE
-  v_role text;
-  v_has boolean;
-  v_override boolean;
-  v_plan_id text;
-  v_ent jsonb;
-  v_feature_flag jsonb;
-  v_cap numeric;
-BEGIN
-  -- ── actor integrity: a JWT caller can only act as themselves ─────────────
-  IF auth.uid() IS NOT NULL AND auth.uid() IS DISTINCT FROM p_actor_user_id THEN
-    RETURN jsonb_build_object('allowed', false, 'reason', 'role',
-                              'upgradeUrl', '/settings/subscription');
-  END IF;
-
-  -- ── membership + role ────────────────────────────────────────────────────
-  SELECT tm.role INTO v_role
-  FROM tenant_members tm
-  WHERE tm.tenant_id = p_tenant_id AND tm.user_id = p_actor_user_id;
-  IF v_role IS NULL THEN
-    RETURN jsonb_build_object('allowed', false, 'reason', 'role',
-                              'upgradeUrl', '/settings/subscription');
-  END IF;
-
-  IF v_role <> 'owner' THEN
-    SELECT tro.granted INTO v_override
-    FROM tenant_role_overrides tro
-    WHERE tro.tenant_id = p_tenant_id AND tro.role = v_role
-      AND tro.permission_id IN (p_feature || '.' || p_action, p_feature || '.manage')
-    ORDER BY (tro.permission_id = p_feature || '.' || p_action) DESC
-    LIMIT 1;
-
-    IF v_override IS NOT NULL THEN
-      v_has := v_override;
-    ELSE
-      SELECT EXISTS (
-        SELECT 1 FROM role_permissions rp
-        WHERE rp.role = v_role
-          AND rp.permission_id IN (p_feature || '.' || p_action, p_feature || '.manage')
-      ) INTO v_has;
-    END IF;
-
-    IF NOT v_has THEN
-      RETURN jsonb_build_object('allowed', false, 'reason', 'role',
-                                'upgradeUrl', '/settings/subscription');
-    END IF;
-  END IF;
-
-  -- ── plan feature gate (owner does NOT bypass) ────────────────────────────
-  SELECT t.plan INTO v_plan_id FROM tenants t WHERE t.id = p_tenant_id;
-  SELECT p.entitlements INTO v_ent FROM plans p WHERE p.id = v_plan_id;
-
-  IF v_ent IS NOT NULL THEN
-    v_feature_flag := v_ent->'features'->p_feature;
-    IF v_feature_flag IS NOT NULL AND v_feature_flag = to_jsonb(false) THEN
-      RETURN jsonb_build_object('allowed', false, 'reason', 'plan',
-                                'upgradeUrl', '/settings/subscription');
-    END IF;
-
-    IF p_limit_key IS NOT NULL AND p_used IS NOT NULL THEN
-      v_cap := (v_ent->'limits'->>p_limit_key)::numeric;
-      IF v_cap IS NOT NULL AND v_cap <> -1 AND (p_used + COALESCE(p_n, 1)) > v_cap THEN
-        RETURN jsonb_build_object('allowed', false, 'reason', 'limit',
-                                  'limit', jsonb_build_object('key', p_limit_key,
-                                                              'max', v_cap,
-                                                              'used', p_used),
-                                  'upgradeUrl', '/settings/subscription');
-      END IF;
-    END IF;
-  END IF;
-
-  RETURN NULL;
-END;
-$$;

package/migrations/017_core_addresses.sql

@@ -1,115 +0,0 @@
--- ============================================================================
--- 017_core_addresses.sql — public.addresses becomes part of the SPINE.
--- ----------------------------------------------------------------------------
--- The address book was already declared "core" by @fayz-ai/shop's 0012
--- ("move address/payment concepts OUT of the plugin, into core"), but the SQL
--- physically shipped inside the shop package. Consequence, live today: any app
--- that does not install @fayz-ai/shop has no addresses table, while the person
--- archetype's "Endereços" tab (packages/saas AddressesTab) queries it
--- unconditionally — beauty-saas, dentist-saas, agency-os and every other
--- non-shop vertical render "Could not find the table 'public.addresses'".
---
--- An address is not e-commerce. It is where a client is delivered to, where a
--- supplier is collected from, where a staff member lives, where a unit of the
--- business sits. It belongs beside `people` and `locations`, in the spine.
---
--- Replay safety (this file runs on pools that already have the table, via shop
--- 0012, AND on pools that have never seen it):
---   • CREATE TABLE IF NOT EXISTS + ADD COLUMN IF NOT EXISTS — additive only
---   • the owner_type CHECK is dropped and rebuilt WIDER, never narrower, so a
---     pool holding 'shop_customer' rows keeps them valid
---   • no DROP of data, no DROP of the shop's own policies
--- Ordering: the spine runs BEFORE plugin migrations (cli buildMigrationPlan
--- ① spine → ④ plugin), so on a fresh shop pool this file creates the table and
--- shop 0012's own CREATE ... IF NOT EXISTS degrades to a no-op.
---
--- `owner_type` stays text rather than a FK because the owner is polymorphic:
--- a core `people` row, a `locations` row, the tenant itself, or — until the
--- shop's customer table is folded into `people` — a plg_shop_customers row.
--- ============================================================================
-
--- ----------------------------------------------------------------------------
--- 1. The table
--- ----------------------------------------------------------------------------
-CREATE TABLE IF NOT EXISTS public.addresses (
-  id           uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  tenant_id    uuid NOT NULL,
-  owner_type   text NOT NULL DEFAULT 'person',
-  owner_id     uuid,
-  kind         text NOT NULL DEFAULT 'both',
-  label        text,          -- "Casa", "Trabalho", "Depósito"
-  recipient    text,          -- quem recebe, se não for o próprio dono
-  phone        text,
-  postal_code  text NOT NULL, -- CEP
-  street       text NOT NULL,
-  number       text,
-  complement   text,
-  district     text,          -- bairro
-  city         text NOT NULL,
-  state        text NOT NULL, -- UF
-  country      text NOT NULL DEFAULT 'BR',
-  is_default   boolean NOT NULL DEFAULT false,
-  metadata     jsonb NOT NULL DEFAULT '{}',
-  created_at   timestamptz NOT NULL DEFAULT now(),
-  updated_at   timestamptz NOT NULL DEFAULT now()
-);
-
-COMMENT ON TABLE public.addresses IS
-  'Core address book. N addresses per owner (person, location, tenant), tenant-scoped. Owned by @fayz-ai/db — plugins read it, none of them own it.';
-
--- Pools provisioned by shop 0012 predate `metadata`/'both' defaults; add what
--- is missing rather than assuming the 0012 shape.
-ALTER TABLE public.addresses
-  ADD COLUMN IF NOT EXISTS owner_type text NOT NULL DEFAULT 'person',
-  ADD COLUMN IF NOT EXISTS owner_id   uuid,
-  ADD COLUMN IF NOT EXISTS kind       text NOT NULL DEFAULT 'both',
-  ADD COLUMN IF NOT EXISTS label      text,
-  ADD COLUMN IF NOT EXISTS recipient  text,
-  ADD COLUMN IF NOT EXISTS phone      text,
-  ADD COLUMN IF NOT EXISTS number     text,
-  ADD COLUMN IF NOT EXISTS complement text,
-  ADD COLUMN IF NOT EXISTS district   text,
-  ADD COLUMN IF NOT EXISTS metadata   jsonb NOT NULL DEFAULT '{}';
-
--- ----------------------------------------------------------------------------
--- 2. Constraints — rebuilt WIDER than shop 0012's.
---    'staff' and 'partner' are person kinds and already covered by 'person';
---    what 0012 lacked is nothing — this only re-asserts the same set so a pool
---    that never ran 0012 gets it, and a pool that did is left unchanged.
--- ----------------------------------------------------------------------------
-ALTER TABLE public.addresses DROP CONSTRAINT IF EXISTS addresses_owner_type_check;
-ALTER TABLE public.addresses
-  ADD CONSTRAINT addresses_owner_type_check
-  CHECK (owner_type IN ('person', 'shop_customer', 'location', 'tenant'));
-
-ALTER TABLE public.addresses DROP CONSTRAINT IF EXISTS addresses_kind_check;
-ALTER TABLE public.addresses
-  ADD CONSTRAINT addresses_kind_check
-  CHECK (kind IN ('shipping', 'billing', 'both'));
-
-CREATE INDEX IF NOT EXISTS addresses_tenant_idx ON public.addresses (tenant_id);
-CREATE INDEX IF NOT EXISTS addresses_owner_idx  ON public.addresses (owner_type, owner_id);
--- One default per owner per kind, enforced here rather than trusting every
--- caller to clear the previous one.
-CREATE UNIQUE INDEX IF NOT EXISTS addresses_one_default_idx
-  ON public.addresses (owner_type, owner_id, kind) WHERE is_default;
-
-DROP TRIGGER IF EXISTS addresses_updated_at ON public.addresses;
-CREATE TRIGGER addresses_updated_at BEFORE UPDATE ON public.addresses
-  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
-
--- ----------------------------------------------------------------------------
--- 3. RLS — tenant members manage their tenant's rows. Anon gets nothing.
---    The shop's extra `addresses_self_read` policy (a signed-in storefront
---    customer reading their own rows) is left untouched: it is additive, and
---    shop 0012 runs after this file.
--- ----------------------------------------------------------------------------
-ALTER TABLE public.addresses ENABLE ROW LEVEL SECURITY;
-
-DROP POLICY IF EXISTS "addresses_member_all" ON public.addresses;
-CREATE POLICY "addresses_member_all" ON public.addresses FOR ALL TO authenticated
-  USING (tenant_id IN (SELECT public.user_tenant_ids()))
-  WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()));
-
-GRANT ALL ON public.addresses TO authenticated, service_role;
-REVOKE ALL ON public.addresses FROM anon;