@fayz-ai/db 0.13.0 → 0.14.0

package/migrations/050_authz_core.sql

@@ -1,230 +0,0 @@
--- ============================================================================
--- 050_authz_core.sql — the authz core (ADR 0006 / PRD 01 / #133): schema §3.
---
--- Tenancy, RBAC catalog, membership, the precomputed unit scope and the generic
--- relation tuples of the Multi-Tenant Authorization & Data Scoping
--- Architecture v2. Exactly two authorization surfaces (user_unit_access,
--- resource_grants) plus the RBAC catalog; business tables carry tenant_id /
--- unit_id / owner_id and one RLS template (043) — nothing else decides access.
---
--- Where it lives (DECISIONS 2026-08-18): schema `app`, per the spec and the
--- issue's default until the platform session rules otherwise. `public.tenants`
--- stays the tenant table — every FK in the fleet already points at it — and
--- gains `kind`. Reads for UI go through public.v_authz_* (043); writes through
--- the RLS write policies below or the RPCs of #134.
---
--- Idempotent and replay-safe: IF NOT EXISTS / guarded DO blocks throughout;
--- policies are DROP IF EXISTS + CREATE. Nothing here touches tenant_members
--- or locations — retiring them is #134's migration, on top of this.
--- ============================================================================
-
-CREATE SCHEMA IF NOT EXISTS app;
-GRANT USAGE ON SCHEMA app TO authenticated, service_role;
--- anon deliberately gets nothing: the authz core has no anonymous surface.
-
--- ─────────────────────────────── Tenancy ───────────────────────────────
--- tenants(kind network|business): a network groups units under franchisee /
--- regional parent units; a business is one company. ADR 0002 maps V1's licence
--- to a tenant and V1's franchise mode to kind='network'.
-ALTER TABLE public.tenants ADD COLUMN IF NOT EXISTS kind text NOT NULL DEFAULT 'business';
-DO $$
-BEGIN
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'tenants_kind_check' AND conrelid = 'public.tenants'::regclass) THEN
-    ALTER TABLE public.tenants ADD CONSTRAINT tenants_kind_check CHECK (kind IN ('network', 'business'));
-  END IF;
-END $$;
-
-CREATE TABLE IF NOT EXISTS app.units (
-  tenant_id      uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
-  id             uuid NOT NULL DEFAULT gen_random_uuid(),
-  kind           text NOT NULL CHECK (kind IN ('hq', 'branch')),
-  parent_unit_id uuid,                       -- grouping: franchisee, region (subtree propagation)
-  name           text NOT NULL,
-  slug           text,
-  active         boolean NOT NULL DEFAULT true,
-  company_legal_entity_id uuid,               -- Empresa: public.company_legal_entities (CNPJ/CPF); FK added by 065 (#138)
-  metadata       jsonb NOT NULL DEFAULT '{}'::jsonb,
-  created_at     timestamptz NOT NULL DEFAULT now(),
-  updated_at     timestamptz NOT NULL DEFAULT now(),
-  PRIMARY KEY (id),
-  UNIQUE (tenant_id, id),
-  UNIQUE (tenant_id, slug),
-  FOREIGN KEY (tenant_id, parent_unit_id) REFERENCES app.units(tenant_id, id) ON DELETE SET NULL,
-  CHECK (parent_unit_id IS DISTINCT FROM id)
-);
-CREATE INDEX IF NOT EXISTS units_tenant_parent_idx ON app.units (tenant_id, parent_unit_id);
-CREATE UNIQUE INDEX IF NOT EXISTS units_one_hq_per_tenant ON app.units (tenant_id) WHERE kind = 'hq';
-DROP TRIGGER IF EXISTS units_updated_at ON app.units;
-CREATE TRIGGER units_updated_at BEFORE UPDATE ON app.units
-  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
-
--- ─────────────────────────────── RBAC catalog ──────────────────────────
--- Global catalog: keys are '{plugin}.{action}', seeded by the platform and by
--- each plugin's declaredFeatures (#136). A key is a row, never DDL.
-CREATE TABLE IF NOT EXISTS app.permissions (
-  key         text PRIMARY KEY,
-  plugin      text NOT NULL,
-  description text,
-  created_at  timestamptz NOT NULL DEFAULT now(),
-  CHECK (key ~ '^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_-]*)+$')
-);
-CREATE INDEX IF NOT EXISTS permissions_plugin_idx ON app.permissions (plugin);
-
--- Roles per tenant. is_system rows come from the vertical template (owner,
--- manager, reception, professional, …) and cannot be deleted; a tenant may add
--- its own ("kit por cargo" of a network is a tenant role, not a system one).
-CREATE TABLE IF NOT EXISTS app.roles (
-  tenant_id  uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
-  id         uuid NOT NULL DEFAULT gen_random_uuid(),
-  key        text NOT NULL,
-  name       text NOT NULL,
-  description text,
-  is_system  boolean NOT NULL DEFAULT false,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now(),
-  PRIMARY KEY (tenant_id, id),
-  UNIQUE (id),
-  UNIQUE (tenant_id, key),
-  CHECK (key ~ '^[a-z][a-z0-9_-]*$')
-);
-DROP TRIGGER IF EXISTS roles_updated_at ON app.roles;
-CREATE TRIGGER roles_updated_at BEFORE UPDATE ON app.roles
-  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
-
-CREATE TABLE IF NOT EXISTS app.role_permissions (
-  tenant_id  uuid NOT NULL,
-  role_id    uuid NOT NULL,
-  permission text NOT NULL REFERENCES app.permissions(key) ON DELETE CASCADE,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  PRIMARY KEY (tenant_id, role_id, permission),
-  FOREIGN KEY (tenant_id, role_id) REFERENCES app.roles(tenant_id, id) ON DELETE CASCADE
-);
-CREATE INDEX IF NOT EXISTS role_permissions_perm_idx ON app.role_permissions (tenant_id, permission);
-
--- ─────────────────────────────── Membership ────────────────────────────
--- One membership per (tenant, user): the base role, whether the user sees every
--- unit (franchisor / network owner), and whether it is active. person_id links
--- the login to the one Person of that human in the tenant (#137).
-CREATE TABLE IF NOT EXISTS app.memberships (
-  tenant_id  uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
-  user_id    uuid NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
-  id         uuid NOT NULL DEFAULT gen_random_uuid(),
-  role_id    uuid NOT NULL,
-  all_units  boolean NOT NULL DEFAULT false,
-  active     boolean NOT NULL DEFAULT true,
-  person_id  uuid,
-  invited_by uuid,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  updated_at timestamptz NOT NULL DEFAULT now(),
-  PRIMARY KEY (tenant_id, user_id),
-  UNIQUE (id),
-  FOREIGN KEY (tenant_id, role_id) REFERENCES app.roles(tenant_id, id)
-);
-CREATE INDEX IF NOT EXISTS memberships_user_idx ON app.memberships (user_id) WHERE active;
-CREATE INDEX IF NOT EXISTS memberships_role_idx ON app.memberships (tenant_id, role_id);
-DROP TRIGGER IF EXISTS memberships_updated_at ON app.memberships;
-CREATE TRIGGER memberships_updated_at BEFORE UPDATE ON app.memberships
-  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
-
--- Explicit units of a member (Toast/Square style) with an optional per-unit
--- role override — the effective role in that unit (§8).
-CREATE TABLE IF NOT EXISTS app.membership_units (
-  tenant_id        uuid NOT NULL,
-  user_id          uuid NOT NULL,
-  unit_id          uuid NOT NULL,
-  role_override_id uuid,
-  created_at       timestamptz NOT NULL DEFAULT now(),
-  PRIMARY KEY (tenant_id, user_id, unit_id),
-  FOREIGN KEY (tenant_id, user_id) REFERENCES app.memberships(tenant_id, user_id) ON DELETE CASCADE,
-  FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE CASCADE,
-  FOREIGN KEY (tenant_id, role_override_id) REFERENCES app.roles(tenant_id, id)
-);
-CREATE INDEX IF NOT EXISTS membership_units_unit_idx ON app.membership_units (tenant_id, unit_id);
-
--- ─────────────── Precomputed scope (Salesforce-style share table) ───────
--- DERIVED. Maintained by the fan-out triggers (042) and the reconciliation job.
--- Never written by app code: no INSERT/UPDATE/DELETE grant to any API role.
-CREATE TABLE IF NOT EXISTS app.user_unit_access (
-  tenant_id uuid NOT NULL,
-  user_id   uuid NOT NULL,
-  unit_id   uuid NOT NULL,
-  via       text NOT NULL CHECK (via IN ('all_units', 'explicit', 'subtree')),
-  PRIMARY KEY (tenant_id, user_id, unit_id),
-  FOREIGN KEY (tenant_id, user_id) REFERENCES app.memberships(tenant_id, user_id) ON DELETE CASCADE,
-  FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE CASCADE
-);
-CREATE INDEX IF NOT EXISTS user_unit_access_unit_idx ON app.user_unit_access (tenant_id, unit_id);
-
--- Diff-log of every reconciliation run (§6). diff <> 0 outside a migration is
--- an incident, not a perf issue: v_authz_reconciliation_alerts (043) lists them.
-CREATE TABLE IF NOT EXISTS app.authz_reconciliation_log (
-  id         bigserial PRIMARY KEY,
-  tenant_id  uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
-  run_at     timestamptz NOT NULL DEFAULT now(),
-  source     text NOT NULL CHECK (source IN ('migration', 'scheduled', 'manual', 'test')),
-  added      integer NOT NULL DEFAULT 0,
-  removed    integer NOT NULL DEFAULT 0,
-  details    jsonb NOT NULL DEFAULT '[]'::jsonb
-);
-CREATE INDEX IF NOT EXISTS authz_reconciliation_log_tenant_idx ON app.authz_reconciliation_log (tenant_id, run_at DESC);
-
--- ─────────────── Generic relation tuples (ERPNext UserPermission / Zanzibar) ───
-CREATE TABLE IF NOT EXISTS app.resource_grants (
-  tenant_id     uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
-  resource_type text NOT NULL,   -- plugin-namespaced: 'catalog.product', 'people.person', …
-  resource_id   uuid NOT NULL,
-  relation      text NOT NULL,   -- 'available_in', 'owner', 'shared_with', 'visible_to', …
-  subject_type  text NOT NULL CHECK (subject_type IN ('user', 'unit', 'role')),
-  subject_id    uuid NOT NULL,
-  created_by    uuid,
-  created_at    timestamptz NOT NULL DEFAULT now(),
-  PRIMARY KEY (tenant_id, resource_type, resource_id, relation, subject_type, subject_id),
-  CHECK (resource_type ~ '^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)*$'),
-  CHECK (relation ~ '^[a-z][a-z0-9_]*$')
-);
--- Reverse lookup: "what can this subject access?"
-CREATE INDEX IF NOT EXISTS resource_grants_subject_idx
-  ON app.resource_grants (tenant_id, subject_type, subject_id, relation, resource_type);
-
--- ─────────────────────────────── Grants ────────────────────────────────
--- Reads for every API role that has a session; RLS (below) narrows to the
--- caller's tenant. Writes only where a policy exists to gate them.
-GRANT SELECT ON app.units, app.permissions, app.roles, app.role_permissions,
-                app.memberships, app.membership_units, app.user_unit_access,
-                app.resource_grants, app.authz_reconciliation_log TO authenticated;
-GRANT INSERT, UPDATE, DELETE ON app.units, app.roles, app.role_permissions,
-                app.memberships, app.membership_units, app.resource_grants TO authenticated;
-GRANT ALL ON ALL TABLES IN SCHEMA app TO service_role;
-GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA app TO service_role;
--- user_unit_access is derived: no API role may write it (the trigger functions
--- are SECURITY DEFINER and owned by the migration role).
-REVOKE INSERT, UPDATE, DELETE ON app.user_unit_access FROM authenticated, anon;
-REVOKE ALL ON app.permissions FROM anon;
-REVOKE INSERT, UPDATE, DELETE ON app.permissions FROM authenticated;
-ALTER DEFAULT PRIVILEGES IN SCHEMA app REVOKE ALL ON TABLES FROM anon;
-ALTER DEFAULT PRIVILEGES IN SCHEMA app REVOKE EXECUTE ON FUNCTIONS FROM public, anon;
-
--- ─────────────────────────────── RLS on the authz tables ────────────────
--- The helpers of 041 are needed by the policies below; 041 runs after this file,
--- so the policies are (re)created at the end of 041 where the functions exist.
-ALTER TABLE app.units ENABLE ROW LEVEL SECURITY;
-ALTER TABLE app.units FORCE ROW LEVEL SECURITY;
-ALTER TABLE app.permissions ENABLE ROW LEVEL SECURITY;
-ALTER TABLE app.roles ENABLE ROW LEVEL SECURITY;
-ALTER TABLE app.roles FORCE ROW LEVEL SECURITY;
-ALTER TABLE app.role_permissions ENABLE ROW LEVEL SECURITY;
-ALTER TABLE app.role_permissions FORCE ROW LEVEL SECURITY;
-ALTER TABLE app.memberships ENABLE ROW LEVEL SECURITY;
-ALTER TABLE app.memberships FORCE ROW LEVEL SECURITY;
-ALTER TABLE app.membership_units ENABLE ROW LEVEL SECURITY;
-ALTER TABLE app.membership_units FORCE ROW LEVEL SECURITY;
-ALTER TABLE app.user_unit_access ENABLE ROW LEVEL SECURITY;
-ALTER TABLE app.user_unit_access FORCE ROW LEVEL SECURITY;
-ALTER TABLE app.resource_grants ENABLE ROW LEVEL SECURITY;
-ALTER TABLE app.resource_grants FORCE ROW LEVEL SECURITY;
-ALTER TABLE app.authz_reconciliation_log ENABLE ROW LEVEL SECURITY;
-ALTER TABLE app.authz_reconciliation_log FORCE ROW LEVEL SECURITY;
-
--- The catalog is global and harmless to read: every signed-in user may list it.
-DROP POLICY IF EXISTS permissions_select ON app.permissions;
-CREATE POLICY permissions_select ON app.permissions FOR SELECT TO authenticated USING (true);

package/migrations/051_authz_helpers.sql

@@ -1,330 +0,0 @@
--- ============================================================================
--- 051_authz_helpers.sql — the RLS helpers (§7) and effective role (§8).
---
--- All `STABLE SECURITY DEFINER SET search_path = ''`, meant to be called wrapped
--- in `(select …)` so the planner caches them per statement (initPlan). They
--- read the authz tables with the migration role's privileges (no recursion into
--- RLS) and never raise: an RLS policy is not a place to throw, so junk resolves
--- to "no access".
---
--- Also here: the RLS policies of the authz tables themselves (040 could not
--- create them before the helpers existed).
--- ============================================================================
-
--- ── current_tenant_id() ─────────────────────────────────────────────────
--- The tenant this request acts in. Same claim semantics as public.user_tenant_ids()
--- (028): a top-level `tenant_id` JWT claim NARROWS and never widens — with a
--- signed-in session it must match an active membership; a session-less signed
--- token is scoped by the claim alone (only we can mint one). Without a claim,
--- a user with exactly one active membership acts in it; a multi-tenant user
--- without a claim acts in none (fail closed — the app sets the claim / active
--- tenant). Only tenant_id (and, later, the active unit) live in the JWT:
--- permissions and unit scope always come from tables (revocation is instant).
-CREATE OR REPLACE FUNCTION app.current_tenant_id()
-RETURNS uuid
-LANGUAGE plpgsql STABLE SECURITY DEFINER
-SET search_path = ''
-AS $$
-DECLARE
-  v_uid    uuid := auth.uid();
-  v_jwt    jsonb := coalesce(auth.jwt(), '{}'::jsonb);
-  v_raw    text;
-  v_tenant uuid;
-  v_n      integer;
-BEGIN
-  IF jsonb_exists(v_jwt, 'tenant_id') THEN
-    v_raw := v_jwt ->> 'tenant_id';
-    -- Presence expresses intent to be narrowed; an unparseable value is no tenant.
-    IF v_raw IS NULL OR v_raw !~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$' THEN
-      RETURN NULL;
-    END IF;
-    v_tenant := v_raw::uuid;
-    IF v_uid IS NULL THEN
-      RETURN v_tenant;
-    END IF;
-    IF EXISTS (SELECT 1 FROM app.memberships m WHERE m.tenant_id = v_tenant AND m.user_id = v_uid AND m.active) THEN
-      RETURN v_tenant;
-    END IF;
-    RETURN NULL;
-  END IF;
-
-  IF v_uid IS NULL THEN
-    RETURN NULL;
-  END IF;
-  SELECT count(*), (array_agg(m.tenant_id))[1] INTO v_n, v_tenant
-    FROM app.memberships m WHERE m.user_id = v_uid AND m.active;
-  IF v_n = 1 THEN
-    RETURN v_tenant;
-  END IF;
-  RETURN NULL;
-END $$;
-
--- ── unit_scoping_on() — the per-account switch main already had ─────────
--- `039_unit_tree` gave every tenant a `unit_scoping_enabled`, off by default,
--- and that is a better design than the always-on this chain originally shipped:
--- a network turns it on when it is ready, and turning it off gives everything
--- back without moving a row. The policy template honours that switch instead of
--- replacing it.
---
--- Switch off ⇒ every unit of the account is yours, which is exactly the
--- behaviour from before units existed.
-CREATE OR REPLACE FUNCTION app.unit_scoping_on()
-RETURNS boolean
-LANGUAGE sql STABLE SECURITY DEFINER
-SET search_path = ''
-AS $$
-  SELECT coalesce((SELECT t.unit_scoping_enabled FROM public.tenants t
-                    WHERE t.id = app.current_tenant_id()), false);
-$$;
-REVOKE ALL ON FUNCTION app.unit_scoping_on() FROM public, anon;
-GRANT EXECUTE ON FUNCTION app.unit_scoping_on() TO authenticated, service_role;
-
--- ── has_unit(unit) ──────────────────────────────────────────────────────
--- O(1) on the share table's PK. A NULL unit is a tenant-wide resource: the
--- template checks `unit_id IS NULL OR has_unit(unit_id)` itself.
-CREATE OR REPLACE FUNCTION app.has_unit(p_unit uuid)
-RETURNS boolean
-LANGUAGE sql STABLE SECURITY DEFINER
-SET search_path = ''
-AS $$
-  SELECT p_unit IS NOT NULL
-     AND CASE WHEN app.unit_scoping_on()
-              THEN EXISTS (SELECT 1 FROM app.user_unit_access a
-                            WHERE a.tenant_id = app.current_tenant_id()
-                              AND a.user_id = auth.uid()
-                              AND a.unit_id = p_unit)
-              -- switch off: every unit of the account is yours
-              ELSE EXISTS (SELECT 1 FROM app.units u
-                            WHERE u.id = p_unit AND u.tenant_id = app.current_tenant_id())
-         END;
-$$;
-
--- ── effective_role_id(tenant, user, unit) ───────────────────────────────
--- §8: membership_units.role_override_id when present for (user, unit), else
--- memberships.role_id. Inactive membership ⇒ no role.
-CREATE OR REPLACE FUNCTION app.effective_role_id(p_tenant uuid, p_user uuid, p_unit uuid DEFAULT NULL)
-RETURNS uuid
-LANGUAGE sql STABLE SECURITY DEFINER
-SET search_path = ''
-AS $$
-  SELECT coalesce(
-    (SELECT mu.role_override_id
-       FROM app.membership_units mu
-      WHERE p_unit IS NOT NULL
-        AND mu.tenant_id = p_tenant AND mu.user_id = p_user AND mu.unit_id = p_unit
-        AND mu.role_override_id IS NOT NULL),
-    (SELECT m.role_id
-       FROM app.memberships m
-      WHERE m.tenant_id = p_tenant AND m.user_id = p_user AND m.active)
-  );
-$$;
-
--- ── has_permission(perm[, unit]) ────────────────────────────────────────
--- Resolves against the effective role for the row's unit when one is given,
--- else the base role. `{feature}.manage` implies every `{feature}.{action}`
--- (the SDK's resolveAccess semantics, mirrored — same source, no drift). No
--- owner bypass: an owner is a role whose permission set is the whole catalog.
-CREATE OR REPLACE FUNCTION app.has_permission(p_perm text, p_unit uuid DEFAULT NULL)
-RETURNS boolean
-LANGUAGE sql STABLE SECURITY DEFINER
-SET search_path = ''
-AS $$
-  SELECT EXISTS (
-    SELECT 1
-      FROM app.role_permissions rp
-     WHERE rp.tenant_id = app.current_tenant_id()
-       AND rp.role_id = app.effective_role_id(app.current_tenant_id(), auth.uid(), p_unit)
-       AND rp.permission IN (p_perm, regexp_replace(p_perm, '\.[^.]+$', '.manage'))
-  );
-$$;
-
--- Does the user hold the permission in ANY of their roles (base or any unit
--- override)? For UI affordances and tenant-wide actions, not for row scope.
-CREATE OR REPLACE FUNCTION app.has_permission_anywhere(p_perm text)
-RETURNS boolean
-LANGUAGE sql STABLE SECURITY DEFINER
-SET search_path = ''
-AS $$
-  SELECT EXISTS (
-    SELECT 1
-      FROM app.role_permissions rp
-     WHERE rp.tenant_id = app.current_tenant_id()
-       AND rp.permission IN (p_perm, regexp_replace(p_perm, '\.[^.]+$', '.manage'))
-       AND rp.role_id IN (
-         SELECT m.role_id FROM app.memberships m
-          WHERE m.tenant_id = rp.tenant_id AND m.user_id = auth.uid() AND m.active
-         UNION
-         SELECT mu.role_override_id FROM app.membership_units mu
-          WHERE mu.tenant_id = rp.tenant_id AND mu.user_id = auth.uid() AND mu.role_override_id IS NOT NULL
-       )
-  );
-$$;
-
--- ── has_grant(type, id, relations[]) ────────────────────────────────────
--- resource_grants where the subject is me, one of my units, or one of my roles.
-CREATE OR REPLACE FUNCTION app.has_grant(p_type text, p_id uuid, p_relations text[])
-RETURNS boolean
-LANGUAGE sql STABLE SECURITY DEFINER
-SET search_path = ''
-AS $$
-  SELECT EXISTS (
-    SELECT 1
-      FROM app.resource_grants g
-     WHERE g.tenant_id = app.current_tenant_id()
-       AND g.resource_type = p_type
-       AND g.resource_id = p_id
-       AND g.relation = ANY (p_relations)
-       AND (
-            (g.subject_type = 'user' AND g.subject_id = auth.uid())
-         OR (g.subject_type = 'unit' AND EXISTS (
-               SELECT 1 FROM app.user_unit_access a
-                WHERE a.tenant_id = g.tenant_id AND a.user_id = auth.uid() AND a.unit_id = g.subject_id))
-         OR (g.subject_type = 'role' AND g.subject_id IN (
-               SELECT m.role_id FROM app.memberships m
-                WHERE m.tenant_id = g.tenant_id AND m.user_id = auth.uid() AND m.active
-               UNION
-               SELECT mu.role_override_id FROM app.membership_units mu
-                WHERE mu.tenant_id = g.tenant_id AND mu.user_id = auth.uid() AND mu.role_override_id IS NOT NULL))
-       )
-  );
-$$;
-
--- "No available_in tuples ⇒ available everywhere" (§9.1): a tenant-wide
--- resource is visible in a unit unless the resource has been restricted, in
--- which case the unit must be one of the granted ones.
-CREATE OR REPLACE FUNCTION app.available_in_my_units(p_type text, p_id uuid)
-RETURNS boolean
-LANGUAGE sql STABLE SECURITY DEFINER
-SET search_path = ''
-AS $$
-  SELECT NOT EXISTS (
-           SELECT 1 FROM app.resource_grants g
-            WHERE g.tenant_id = app.current_tenant_id()
-              AND g.resource_type = p_type AND g.resource_id = p_id AND g.relation = 'available_in')
-      OR app.has_grant(p_type, p_id, ARRAY['available_in']);
-$$;
-
--- ── is_member(tenant) ───────────────────────────────────────────────────
--- Plain active membership, no permission — what the authz tables' own read
--- policies need ("members see their tenant's units and roles").
-CREATE OR REPLACE FUNCTION app.is_member(p_tenant uuid)
-RETURNS boolean
-LANGUAGE sql STABLE SECURITY DEFINER
-SET search_path = ''
-AS $$
-  SELECT EXISTS (
-    SELECT 1 FROM app.memberships m
-     WHERE m.tenant_id = p_tenant AND m.user_id = auth.uid() AND m.active
-  );
-$$;
-
-REVOKE ALL ON FUNCTION app.current_tenant_id() FROM public;
-REVOKE ALL ON FUNCTION app.has_unit(uuid) FROM public;
-REVOKE ALL ON FUNCTION app.effective_role_id(uuid, uuid, uuid) FROM public;
-REVOKE ALL ON FUNCTION app.has_permission(text, uuid) FROM public;
-REVOKE ALL ON FUNCTION app.has_permission_anywhere(text) FROM public;
-REVOKE ALL ON FUNCTION app.has_grant(text, uuid, text[]) FROM public;
-REVOKE ALL ON FUNCTION app.available_in_my_units(text, uuid) FROM public;
-REVOKE ALL ON FUNCTION app.is_member(uuid) FROM public;
-GRANT EXECUTE ON FUNCTION app.current_tenant_id() TO authenticated, service_role;
-GRANT EXECUTE ON FUNCTION app.has_unit(uuid) TO authenticated, service_role;
-GRANT EXECUTE ON FUNCTION app.effective_role_id(uuid, uuid, uuid) TO authenticated, service_role;
-GRANT EXECUTE ON FUNCTION app.has_permission(text, uuid) TO authenticated, service_role;
-GRANT EXECUTE ON FUNCTION app.has_permission_anywhere(text) TO authenticated, service_role;
-GRANT EXECUTE ON FUNCTION app.has_grant(text, uuid, text[]) TO authenticated, service_role;
-GRANT EXECUTE ON FUNCTION app.available_in_my_units(text, uuid) TO authenticated, service_role;
-GRANT EXECUTE ON FUNCTION app.is_member(uuid) TO authenticated, service_role;
-
--- ═══════════════════════ RLS on the authz tables ══════════════════════════
--- Reads: any active member of the tenant sees the tenant's units, roles and
--- role permissions (the UI needs them to render); memberships and unit rows are
--- visible to the member herself and to holders of members.read; the share table
--- to the user herself and to members.read; grants to members of the tenant.
--- Writes: platform permission keys — no owner/admin literal anywhere.
-
--- units
-DROP POLICY IF EXISTS units_select ON app.units;
-CREATE POLICY units_select ON app.units FOR SELECT TO authenticated
-  USING ((select app.is_member(tenant_id)));
-DROP POLICY IF EXISTS units_insert ON app.units;
-CREATE POLICY units_insert ON app.units FOR INSERT TO authenticated
-  WITH CHECK (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('units.manage')));
-DROP POLICY IF EXISTS units_update ON app.units;
-CREATE POLICY units_update ON app.units FOR UPDATE TO authenticated
-  USING (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('units.manage')))
-  WITH CHECK (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('units.manage')));
-DROP POLICY IF EXISTS units_delete ON app.units;
-CREATE POLICY units_delete ON app.units FOR DELETE TO authenticated
-  USING (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('units.manage')));
-
--- roles
-DROP POLICY IF EXISTS roles_select ON app.roles;
-CREATE POLICY roles_select ON app.roles FOR SELECT TO authenticated
-  USING ((select app.is_member(tenant_id)));
-DROP POLICY IF EXISTS roles_insert ON app.roles;
-CREATE POLICY roles_insert ON app.roles FOR INSERT TO authenticated
-  WITH CHECK (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('roles.manage')) AND NOT is_system);
-DROP POLICY IF EXISTS roles_update ON app.roles;
-CREATE POLICY roles_update ON app.roles FOR UPDATE TO authenticated
-  USING (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('roles.manage')))
-  WITH CHECK (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('roles.manage')));
-DROP POLICY IF EXISTS roles_delete ON app.roles;
-CREATE POLICY roles_delete ON app.roles FOR DELETE TO authenticated
-  USING (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('roles.manage')) AND NOT is_system);
-
--- role_permissions
-DROP POLICY IF EXISTS role_permissions_select ON app.role_permissions;
-CREATE POLICY role_permissions_select ON app.role_permissions FOR SELECT TO authenticated
-  USING ((select app.is_member(tenant_id)));
-DROP POLICY IF EXISTS role_permissions_write ON app.role_permissions;
-CREATE POLICY role_permissions_write ON app.role_permissions FOR ALL TO authenticated
-  USING (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('roles.manage')))
-  WITH CHECK (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('roles.manage')));
-
--- memberships: yourself, or members.read; writes need members.manage and can
--- never be a self-insert (the P0 of the old model) — creation of the first
--- member is the create_tenant RPC's job (#134).
-DROP POLICY IF EXISTS memberships_select ON app.memberships;
-CREATE POLICY memberships_select ON app.memberships FOR SELECT TO authenticated
-  USING (user_id = (select auth.uid()) OR (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.read'))));
-DROP POLICY IF EXISTS memberships_insert ON app.memberships;
-CREATE POLICY memberships_insert ON app.memberships FOR INSERT TO authenticated
-  WITH CHECK (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.manage')) AND user_id <> (select auth.uid()));
-DROP POLICY IF EXISTS memberships_update ON app.memberships;
-CREATE POLICY memberships_update ON app.memberships FOR UPDATE TO authenticated
-  USING (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.manage')))
-  WITH CHECK (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.manage')));
-DROP POLICY IF EXISTS memberships_delete ON app.memberships;
-CREATE POLICY memberships_delete ON app.memberships FOR DELETE TO authenticated
-  USING (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.manage')) AND user_id <> (select auth.uid()));
-
--- membership_units
-DROP POLICY IF EXISTS membership_units_select ON app.membership_units;
-CREATE POLICY membership_units_select ON app.membership_units FOR SELECT TO authenticated
-  USING (user_id = (select auth.uid()) OR (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.read'))));
-DROP POLICY IF EXISTS membership_units_write ON app.membership_units;
-CREATE POLICY membership_units_write ON app.membership_units FOR ALL TO authenticated
-  USING (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.manage')))
-  WITH CHECK (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.manage')));
-
--- user_unit_access: read-only surface (the share table)
-DROP POLICY IF EXISTS user_unit_access_select ON app.user_unit_access;
-CREATE POLICY user_unit_access_select ON app.user_unit_access FOR SELECT TO authenticated
-  USING (user_id = (select auth.uid()) OR (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.read'))));
-
--- resource_grants: members read; writing a tuple needs the platform key
--- authz.grants.manage or the resource's own '{plugin}.manage' (§12.9 default).
-DROP POLICY IF EXISTS resource_grants_select ON app.resource_grants;
-CREATE POLICY resource_grants_select ON app.resource_grants FOR SELECT TO authenticated
-  USING ((select app.is_member(tenant_id)));
-DROP POLICY IF EXISTS resource_grants_write ON app.resource_grants;
-CREATE POLICY resource_grants_write ON app.resource_grants FOR ALL TO authenticated
-  USING (tenant_id = (select app.current_tenant_id())
-         AND ((select app.has_permission('authz.grants.manage')) OR (select app.has_permission(split_part(resource_type, '.', 1) || '.manage'))))
-  WITH CHECK (tenant_id = (select app.current_tenant_id())
-         AND ((select app.has_permission('authz.grants.manage')) OR (select app.has_permission(split_part(resource_type, '.', 1) || '.manage'))));
-
--- reconciliation log: readable by members.read of the tenant
-DROP POLICY IF EXISTS authz_reconciliation_log_select ON app.authz_reconciliation_log;
-CREATE POLICY authz_reconciliation_log_select ON app.authz_reconciliation_log FOR SELECT TO authenticated
-  USING (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('members.read')));