@fayz-ai/db 0.13.0 → 0.14.0

package/migrations/096_audit_append_only.sql

@@ -1,256 +0,0 @@
--- ============================================================================
--- 096_audit_append_only.sql — the audit log is append-only and its actor and
--- tenant are derived on the server (PRD 07 R2 / #144, Contexto §9.2 P1
--- "audit log pode preservar ator informado pelo cliente").
---
--- public.audit_logs exists since 001; 026 made the actor default to auth.uid()
--- and closed the INSERT policy. What was still open, and closes here:
---
---   actor     a signed-in caller who SENDS a user_id different from auth.uid()
---             is refused (42501) — before, COALESCE kept the client's value.
---             Without a JWT (service_role, migration, definer job) an explicit
---             author is still allowed: a backfill must be able to say who did it.
---   tenant    filled from app.current_tenant_id() when absent; a tenant the
---             caller is not a member of is refused (42501).
---   reason    a destructive action (delete/cancel/remove/void, bare or as the
---             last segment of a dotted action) requires a reason (23514) —
---             jornadas invariant 4: "ação destrutiva deixa rastro: autor,
---             motivo e hora".
---   shape     unit_id, before/after (minimal snapshots) and reason columns.
---   immutable no UPDATE/DELETE grant for the API roles AND a trigger that
---             refuses both for everyone — the retention job is the one path
---             (audit_logs_prune, service-only, per-tenant keep_days).
---   read      audit.read within the tenant (043 catalog key), replacing 001's
---             "every member reads".
---
--- Idempotent and replay-safe.
--- ============================================================================
-
-ALTER TABLE public.audit_logs ADD COLUMN IF NOT EXISTS unit_id uuid;
-ALTER TABLE public.audit_logs ADD COLUMN IF NOT EXISTS reason text;
-ALTER TABLE public.audit_logs ADD COLUMN IF NOT EXISTS before jsonb;
-ALTER TABLE public.audit_logs ADD COLUMN IF NOT EXISTS after jsonb;
--- unit_id is a historical reference on purpose (no FK): a unit that is deleted
--- later must not rewrite the trail.
-CREATE INDEX IF NOT EXISTS idx_audit_logs_unit ON public.audit_logs (tenant_id, unit_id, created_at DESC) WHERE unit_id IS NOT NULL;
-
--- ── which actions are destructive ───────────────────────────────────────
-CREATE OR REPLACE FUNCTION public.audit_action_is_destructive(p_action text)
-RETURNS boolean LANGUAGE sql IMMUTABLE AS $$
-  SELECT p_action IS NOT NULL AND (
-           lower(p_action) IN ('delete', 'cancel', 'remove', 'void', 'deleted', 'cancelled', 'removed', 'voided')
-        OR lower(p_action) ~ '\.(delete|cancel|remove|void|deleted|cancelled|removed|voided)$'
-        OR lower(p_action) ~ '^(delete|cancel|remove|void)\.'
-  );
-$$;
-GRANT EXECUTE ON FUNCTION public.audit_action_is_destructive(text) TO authenticated, service_role;
-
--- ── the actor/tenant/reason gate — BEFORE INSERT ────────────────────────
--- Same trigger name as 026 (audit_logs_actor) so a replay converges on one.
-CREATE OR REPLACE FUNCTION public.handle_audit_actor()
-RETURNS trigger
-LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
-AS $fn$
-DECLARE
-  v_uid uuid := auth.uid();
-BEGIN
-  -- actor: derived from the session; a signed-in caller cannot sign as someone else
-  IF v_uid IS NOT NULL THEN
-    IF NEW.user_id IS NOT NULL AND NEW.user_id <> v_uid THEN
-      RAISE EXCEPTION 'audit_logs: the actor is derived server-side (user_id must be omitted or equal to auth.uid())'
-        USING ERRCODE = '42501';
-    END IF;
-    NEW.user_id := v_uid;
-  END IF;
-
-  -- tenant: derived when absent; must be one the actor belongs to
-  IF NEW.tenant_id IS NULL THEN
-    NEW.tenant_id := app.current_tenant_id();
-  END IF;
-  IF v_uid IS NOT NULL THEN
-    IF NEW.tenant_id IS NULL THEN
-      RAISE EXCEPTION 'audit_logs: no tenant in scope for this session' USING ERRCODE = '42501';
-    END IF;
-    IF NOT app.is_member(NEW.tenant_id) THEN
-      RAISE EXCEPTION 'audit_logs: tenant % is not one the actor is a member of', NEW.tenant_id
-        USING ERRCODE = '42501';
-    END IF;
-  END IF;
-
-  -- reason: mandatory for destructive actions
-  IF public.audit_action_is_destructive(NEW.action) AND nullif(btrim(coalesce(NEW.reason, '')), '') IS NULL THEN
-    RAISE EXCEPTION 'audit_logs: a destructive action (%) requires a reason', NEW.action
-      USING ERRCODE = '23514', HINT = 'Informe o motivo da ação.';
-  END IF;
-
-  RETURN NEW;
-END;
-$fn$;
-REVOKE ALL ON FUNCTION public.handle_audit_actor() FROM public, anon, authenticated;
-
-DROP TRIGGER IF EXISTS audit_logs_actor ON public.audit_logs;
-CREATE TRIGGER audit_logs_actor BEFORE INSERT ON public.audit_logs
-  FOR EACH ROW EXECUTE FUNCTION public.handle_audit_actor();
-
--- ── append-only: nobody updates, only the retention job deletes ─────────
-CREATE OR REPLACE FUNCTION public.audit_logs_append_only()
-RETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
-AS $fn$
-BEGIN
-  IF TG_OP = 'DELETE' AND coalesce(current_setting('fayz.audit_logs.prune', true), 'off') = 'on' THEN
-    RETURN OLD;
-  END IF;
-  RAISE EXCEPTION 'audit_logs is append-only (% refused)', TG_OP USING ERRCODE = '42501';
-END;
-$fn$;
-REVOKE ALL ON FUNCTION public.audit_logs_append_only() FROM public, anon, authenticated;
-DROP TRIGGER IF EXISTS audit_logs_append_only ON public.audit_logs;
-CREATE TRIGGER audit_logs_append_only BEFORE UPDATE OR DELETE ON public.audit_logs
-  FOR EACH ROW EXECUTE FUNCTION public.audit_logs_append_only();
-
-REVOKE UPDATE, DELETE, TRUNCATE ON public.audit_logs FROM anon, authenticated;
-GRANT SELECT, INSERT ON public.audit_logs TO authenticated;
-GRANT ALL ON public.audit_logs TO service_role;
-
--- ── policies: audit.read within the tenant; insert for members ──────────
-ALTER TABLE public.audit_logs ENABLE ROW LEVEL SECURITY;
-DROP POLICY IF EXISTS "audit_select" ON public.audit_logs;
-CREATE POLICY "audit_select" ON public.audit_logs FOR SELECT TO authenticated
-  USING (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('audit.read')));
--- The trigger has already derived/validated tenant_id when this runs
--- (WITH CHECK sees the row as it will be stored).
-DROP POLICY IF EXISTS "audit_insert" ON public.audit_logs;
-CREATE POLICY "audit_insert" ON public.audit_logs FOR INSERT TO authenticated
-  WITH CHECK ((select app.is_member(tenant_id)));
-
--- ── the helper every RPC calls ──────────────────────────────────────────
--- Actor = auth.uid(); tenant = the session's (p_tenant is honoured only when
--- there is no JWT — a service job must name the tenant it acts for). Returns
--- the audit row id.
-CREATE OR REPLACE FUNCTION public.audit_log(
-  p_action      text,
-  p_entity_type text,
-  p_entity_id   uuid,
-  p_reason      text  DEFAULT NULL,
-  p_before      jsonb DEFAULT NULL,
-  p_after       jsonb DEFAULT NULL,
-  p_unit        uuid  DEFAULT NULL,
-  p_metadata    jsonb DEFAULT NULL,
-  p_tenant      uuid  DEFAULT NULL
-)
-RETURNS uuid
-LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
-AS $$
-DECLARE
-  v_uid    uuid := auth.uid();
-  v_tenant uuid;
-  v_id     uuid;
-BEGIN
-  IF nullif(btrim(coalesce(p_action, '')), '') IS NULL THEN
-    RAISE EXCEPTION 'audit_log: action is required' USING ERRCODE = '22023';
-  END IF;
-  IF v_uid IS NOT NULL THEN
-    v_tenant := app.current_tenant_id();
-    IF p_tenant IS NOT NULL AND p_tenant <> v_tenant THEN
-      RAISE EXCEPTION 'audit_log: tenant is derived server-side' USING ERRCODE = '42501';
-    END IF;
-  ELSE
-    v_tenant := coalesce(p_tenant, app.current_tenant_id());
-  END IF;
-  IF v_tenant IS NULL THEN
-    RAISE EXCEPTION 'audit_log: no tenant in scope' USING ERRCODE = '42501';
-  END IF;
-  INSERT INTO public.audit_logs (tenant_id, unit_id, user_id, action, entity_type, entity_id, reason, before, after, metadata)
-  VALUES (v_tenant, p_unit, v_uid, p_action, p_entity_type, p_entity_id::text, p_reason, p_before, p_after, coalesce(p_metadata, '{}'::jsonb))
-  RETURNING id INTO v_id;
-  RETURN v_id;
-END $$;
-REVOKE ALL ON FUNCTION public.audit_log(text, text, uuid, text, jsonb, jsonb, uuid, jsonb, uuid) FROM public, anon;
-GRANT EXECUTE ON FUNCTION public.audit_log(text, text, uuid, text, jsonb, jsonb, uuid, jsonb, uuid) TO authenticated, service_role;
-
--- ── retention: an approved policy per tenant, a service-only prune ──────
-CREATE TABLE IF NOT EXISTS public.audit_retention_policies (
-  tenant_id   uuid PRIMARY KEY REFERENCES public.tenants(id) ON DELETE CASCADE,
-  keep_days   integer NOT NULL CHECK (keep_days >= 30),
-  approved_by uuid,
-  approved_at timestamptz NOT NULL DEFAULT now(),
-  note        text,
-  created_at  timestamptz NOT NULL DEFAULT now(),
-  updated_at  timestamptz NOT NULL DEFAULT now()
-);
-DROP TRIGGER IF EXISTS audit_retention_policies_updated_at ON public.audit_retention_policies;
-CREATE TRIGGER audit_retention_policies_updated_at BEFORE UPDATE ON public.audit_retention_policies
-  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
-REVOKE ALL ON public.audit_retention_policies FROM anon, authenticated;
-GRANT SELECT, INSERT, UPDATE, DELETE ON public.audit_retention_policies TO authenticated;
-GRANT ALL ON public.audit_retention_policies TO service_role;
-ALTER TABLE public.audit_retention_policies ENABLE ROW LEVEL SECURITY;
-ALTER TABLE public.audit_retention_policies FORCE ROW LEVEL SECURITY;
--- A replay of 002 stamps generic tenant_isolation_* policies on any public
--- table with tenant_id; this table has curated ones — drop the generic set.
-DROP POLICY IF EXISTS tenant_isolation_select ON public.audit_retention_policies;
-DROP POLICY IF EXISTS tenant_isolation_insert ON public.audit_retention_policies;
-DROP POLICY IF EXISTS tenant_isolation_update ON public.audit_retention_policies;
-DROP POLICY IF EXISTS tenant_isolation_delete ON public.audit_retention_policies;
-DROP POLICY IF EXISTS audit_retention_policies_select ON public.audit_retention_policies;
-CREATE POLICY audit_retention_policies_select ON public.audit_retention_policies FOR SELECT TO authenticated
-  USING (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('audit.read')));
-DROP POLICY IF EXISTS audit_retention_policies_write ON public.audit_retention_policies;
-CREATE POLICY audit_retention_policies_write ON public.audit_retention_policies FOR ALL TO authenticated
-  USING (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('settings.manage')))
-  WITH CHECK (tenant_id = (select app.current_tenant_id()) AND (select app.has_permission('settings.manage')));
-
-CREATE OR REPLACE FUNCTION public.audit_retention_stamp_actor()
-RETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$
-BEGIN
-  NEW.approved_by := coalesce(auth.uid(), NEW.approved_by);
-  RETURN NEW;
-END $$;
-REVOKE ALL ON FUNCTION public.audit_retention_stamp_actor() FROM public, anon, authenticated;
-DROP TRIGGER IF EXISTS audit_retention_policies_actor ON public.audit_retention_policies;
-CREATE TRIGGER audit_retention_policies_actor BEFORE INSERT OR UPDATE ON public.audit_retention_policies
-  FOR EACH ROW EXECUTE FUNCTION public.audit_retention_stamp_actor();
-
--- Prune: rows older than p_before (optionally one tenant), or — with no
--- p_before — each tenant's approved keep_days. Service-only: a JWT session is
--- refused even if it somehow holds EXECUTE. The trigger lets the delete through
--- only under the transaction-local flag this function sets and clears.
-CREATE OR REPLACE FUNCTION public.audit_logs_prune(p_before timestamptz DEFAULT NULL, p_tenant uuid DEFAULT NULL)
-RETURNS integer
-LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
-AS $$
-DECLARE v_n integer := 0; v_k integer;
-BEGIN
-  IF auth.uid() IS NOT NULL THEN
-    RAISE EXCEPTION 'audit_logs_prune: service-only' USING ERRCODE = '42501';
-  END IF;
-  PERFORM set_config('fayz.audit_logs.prune', 'on', true);
-  BEGIN
-    IF p_before IS NOT NULL THEN
-      DELETE FROM public.audit_logs a
-       WHERE a.created_at < p_before AND (p_tenant IS NULL OR a.tenant_id = p_tenant);
-      GET DIAGNOSTICS v_n = ROW_COUNT;
-    ELSE
-      DELETE FROM public.audit_logs a
-       USING public.audit_retention_policies p
-       WHERE p.tenant_id = a.tenant_id
-         AND (p_tenant IS NULL OR a.tenant_id = p_tenant)
-         AND a.created_at < now() - make_interval(days => p.keep_days);
-      GET DIAGNOSTICS v_k = ROW_COUNT;
-      v_n := v_k;
-    END IF;
-  EXCEPTION WHEN OTHERS THEN
-    PERFORM set_config('fayz.audit_logs.prune', 'off', true);
-    RAISE;
-  END;
-  PERFORM set_config('fayz.audit_logs.prune', 'off', true);
-  RETURN v_n;
-END $$;
-REVOKE ALL ON FUNCTION public.audit_logs_prune(timestamptz, uuid) FROM public, anon, authenticated;
-GRANT EXECUTE ON FUNCTION public.audit_logs_prune(timestamptz, uuid) TO service_role;
-
-COMMENT ON TABLE public.audit_logs IS
-  'Append-only audit trail. Actor (user_id) and tenant are derived server-side by the audit_logs_actor trigger; '
-  'destructive actions require a reason; UPDATE/DELETE are refused; retention via audit_logs_prune() (service-only). Read: audit.read.';
-COMMENT ON TABLE public.audit_retention_policies IS
-  'Approved audit retention per tenant (keep_days). audit_logs_prune() with no p_before applies it.';

package/migrations/097_sequences_authorized.sql

@@ -1,111 +0,0 @@
--- ============================================================================
--- 097_sequences_authorized.sql — sequences / next_sequence() authorized by
--- tenant (PRD 07 R3 / #144; Contexto §9.2 P1 "sequência financeira recebe
--- tenant sem autorização suficiente").
---
--- public.sequences and next_sequence(p_tenant_id, p_kind) were born in the
--- financial plugin (plugins/plugin-financial 004_order_to_cash.sql) as a
--- SECURITY DEFINER counter with no check on p_tenant_id: any signed-in user
--- could advance any tenant's REC-/PAG- numbering. The spine now owns the table
--- and the function (same shape, so the plugin's CREATE TABLE IF NOT EXISTS is a
--- no-op) and the function is guarded:
---
---   * with a JWT, p_tenant_id must be one the caller is an active member of,
---     and — when the session is narrowed to a tenant (claim or single
---     membership) — exactly that one;
---   * without a JWT (service_role, a migration, a definer job) the caller names
---     the tenant it acts for.
---
--- next_sequence_authorized(kind[, permission]) is the tenant-derived form for
--- new callers: the tenant is the session's, optionally gated by a permission.
---
--- The plugin's 004 file re-emits its old body on a fresh chain (plugins run
--- after the spine); plugin-financial 023_sequences_authorized.sql re-asserts
--- this exact guarded body last, and the pgTAP suite asserts the guard on the
--- final state. Idempotent and replay-safe.
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS public.sequences (
-  tenant_id     uuid NOT NULL REFERENCES public.tenants(id),
-  kind          text NOT NULL,
-  current_value bigint NOT NULL DEFAULT 0,
-  PRIMARY KEY (tenant_id, kind)
-);
--- Deny-all for the API roles: written only through the definer functions.
-ALTER TABLE public.sequences ENABLE ROW LEVEL SECURITY;
-REVOKE ALL ON public.sequences FROM anon, authenticated;
-GRANT ALL ON public.sequences TO service_role;
-DROP POLICY IF EXISTS tenant_isolation_select ON public.sequences;
-DROP POLICY IF EXISTS tenant_isolation_insert ON public.sequences;
-DROP POLICY IF EXISTS tenant_isolation_update ON public.sequences;
-DROP POLICY IF EXISTS tenant_isolation_delete ON public.sequences;
-
--- The one counter (internal, no API grant).
-CREATE OR REPLACE FUNCTION app.sequence_next(p_tenant_id uuid, p_kind text)
-RETURNS bigint LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
-AS $$
-DECLARE v_next bigint;
-BEGIN
-  IF p_tenant_id IS NULL OR nullif(btrim(coalesce(p_kind, '')), '') IS NULL THEN
-    RAISE EXCEPTION 'sequence_next: tenant and kind are required' USING ERRCODE = '22023';
-  END IF;
-  INSERT INTO public.sequences (tenant_id, kind, current_value)
-  VALUES (p_tenant_id, p_kind, 1)
-  ON CONFLICT (tenant_id, kind)
-  DO UPDATE SET current_value = public.sequences.current_value + 1
-  RETURNING current_value INTO v_next;
-  RETURN v_next;
-END $$;
-REVOKE ALL ON FUNCTION app.sequence_next(uuid, text) FROM public, anon, authenticated;
-GRANT EXECUTE ON FUNCTION app.sequence_next(uuid, text) TO service_role;
-
--- Guarded, same signature the financial plugin and its clients already call.
--- Body kept self-contained (no dependency on app.sequence_next) so the plugin's
--- 023 file can carry the identical text.
-CREATE OR REPLACE FUNCTION public.next_sequence(p_tenant_id uuid, p_kind text)
-RETURNS bigint
-LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
-AS $$
-DECLARE
-  v_next   bigint;
-  v_scope  uuid;
-BEGIN
-  IF p_tenant_id IS NULL OR nullif(btrim(coalesce(p_kind, '')), '') IS NULL THEN
-    RAISE EXCEPTION 'next_sequence: tenant and kind are required' USING ERRCODE = '22023';
-  END IF;
-  IF auth.uid() IS NOT NULL THEN
-    v_scope := app.current_tenant_id();
-    IF (v_scope IS NOT NULL AND p_tenant_id <> v_scope) OR NOT app.is_member(p_tenant_id) THEN
-      RAISE EXCEPTION 'next_sequence: not authorized for tenant %', p_tenant_id USING ERRCODE = '42501';
-    END IF;
-  END IF;
-  INSERT INTO public.sequences (tenant_id, kind, current_value)
-  VALUES (p_tenant_id, p_kind, 1)
-  ON CONFLICT (tenant_id, kind)
-  DO UPDATE SET current_value = public.sequences.current_value + 1
-  RETURNING current_value INTO v_next;
-  RETURN v_next;
-END $$;
-REVOKE ALL ON FUNCTION public.next_sequence(uuid, text) FROM public, anon;
-GRANT EXECUTE ON FUNCTION public.next_sequence(uuid, text) TO authenticated, service_role;
-
--- Tenant derived from the session; optional permission gate.
-CREATE OR REPLACE FUNCTION public.next_sequence_authorized(p_kind text, p_permission text DEFAULT NULL)
-RETURNS bigint
-LANGUAGE plpgsql SECURITY DEFINER SET search_path = ''
-AS $$
-DECLARE v_tenant uuid := app.current_tenant_id();
-BEGIN
-  IF v_tenant IS NULL THEN
-    RAISE EXCEPTION 'next_sequence_authorized: no tenant in scope' USING ERRCODE = '42501';
-  END IF;
-  IF p_permission IS NOT NULL AND NOT app.has_permission(p_permission) THEN
-    RAISE EXCEPTION 'next_sequence_authorized: permission % denied', p_permission USING ERRCODE = '42501';
-  END IF;
-  RETURN app.sequence_next(v_tenant, p_kind);
-END $$;
-REVOKE ALL ON FUNCTION public.next_sequence_authorized(text, text) FROM public, anon;
-GRANT EXECUTE ON FUNCTION public.next_sequence_authorized(text, text) TO authenticated, service_role;
-
-COMMENT ON TABLE public.sequences IS
-  'Per-tenant numbering counters (REC-/PAG-…). Written only through next_sequence()/next_sequence_authorized(), which authorize the tenant.';

package/migrations/098_holidays.sql

@@ -1,80 +0,0 @@
--- ============================================================================
--- 098_holidays.sql — the tenant/unit holiday calendar (PRD 07 R5 / #144).
---
--- V1 had two tables: holidays (per company) and central_holidays (the network's,
--- pushed to every unit). V2 is one: a row with unit_id NULL is the tenant's
--- (network-wide, what central_holidays was); a row with a unit_id is that
--- unit's own. holidays_for_unit(unit, from, to) is the calendar the agenda
--- reads: tenant-wide rows + the unit's rows (nothing for a unit that is not
--- the tenant's), recurring ones projected onto every year of the range.
---
--- The agenda plugin already declares a registry on `holidays` (name, date,
--- recurring, description, isActive) with no SQL of its own — this table is that
--- table, so those columns are here with the same names; the registry needs no
--- change. Kind (national|state|city|company) and metadata are additions.
---
--- service_locations (V1) is a spot inside a unit (a chair, a room), not a unit —
--- it stays with the owning plugin (agenda/salon) in Phase 2; nothing here.
---
--- Idempotent and replay-safe.
--- ============================================================================
-
-CREATE TABLE IF NOT EXISTS public.holidays (
-  id          uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  tenant_id   uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
-  unit_id     uuid,                                     -- NULL = tenant-wide (V1 central_holidays)
-  date        date NOT NULL,
-  name        text NOT NULL CHECK (btrim(name) <> ''),
-  kind        text NOT NULL DEFAULT 'company' CHECK (kind IN ('national', 'state', 'city', 'company')),
-  recurring   boolean NOT NULL DEFAULT false,           -- same month/day every year
-  description text,
-  is_active   boolean NOT NULL DEFAULT true,
-  metadata    jsonb NOT NULL DEFAULT '{}'::jsonb,
-  created_at  timestamptz NOT NULL DEFAULT now(),
-  updated_at  timestamptz NOT NULL DEFAULT now(),
-  CONSTRAINT holidays_unit_fk FOREIGN KEY (tenant_id, unit_id) REFERENCES app.units(tenant_id, id) ON DELETE CASCADE
-);
-CREATE UNIQUE INDEX IF NOT EXISTS holidays_one_per_scope
-  ON public.holidays (tenant_id, coalesce(unit_id, '00000000-0000-0000-0000-000000000000'::uuid), date, name);
-CREATE INDEX IF NOT EXISTS holidays_tenant_date ON public.holidays (tenant_id, date) WHERE is_active;
-
-SELECT app.scaffold_table('public.holidays', 'config.holiday', 'config', false, 'enforce');
-REVOKE ALL ON public.holidays FROM anon;
-GRANT SELECT, INSERT, UPDATE, DELETE ON public.holidays TO authenticated;
-GRANT ALL ON public.holidays TO service_role;
-
--- The calendar of one unit over a range: tenant-wide + the unit's own rows,
--- recurring rows projected onto each year of the range (Feb 29 lands on Feb 28
--- in a common year, as date + interval does). SECURITY INVOKER on purpose: the
--- caller's RLS decides what she sees (config.read + unit scope).
-CREATE OR REPLACE FUNCTION public.holidays_for_unit(p_unit uuid, p_from date, p_to date)
-RETURNS TABLE (id uuid, occurs_on date, name text, kind text, unit_id uuid, recurring boolean, description text)
-LANGUAGE sql STABLE SET search_path = ''
-AS $$
-  WITH years AS (
-    SELECT generate_series(extract(year FROM p_from)::int, extract(year FROM p_to)::int) AS y
-  ),
-  scoped AS (
-    SELECT h.* FROM public.holidays h
-     WHERE h.tenant_id = app.current_tenant_id()
-       AND h.is_active
-       AND (h.unit_id IS NULL OR h.unit_id = p_unit)
-       -- a unit that is not the tenant's yields nothing (NULL = tenant-wide only)
-       AND (p_unit IS NULL OR EXISTS (SELECT 1 FROM app.units u WHERE u.tenant_id = h.tenant_id AND u.id = p_unit))
-  )
-  SELECT s.id, s.date AS occurs_on, s.name, s.kind, s.unit_id, s.recurring, s.description
-    FROM scoped s
-   WHERE NOT s.recurring AND s.date BETWEEN p_from AND p_to
-  UNION ALL
-  SELECT s.id, (s.date + make_interval(years => (y.y - extract(year FROM s.date)::int)))::date, s.name, s.kind, s.unit_id, s.recurring, s.description
-    FROM scoped s CROSS JOIN years y
-   WHERE s.recurring
-     AND (s.date + make_interval(years => (y.y - extract(year FROM s.date)::int)))::date BETWEEN p_from AND p_to
-   ORDER BY 2, 3;
-$$;
-REVOKE ALL ON FUNCTION public.holidays_for_unit(uuid, date, date) FROM public, anon;
-GRANT EXECUTE ON FUNCTION public.holidays_for_unit(uuid, date, date) TO authenticated, service_role;
-
-COMMENT ON TABLE public.holidays IS
-  'Tenant/unit holiday calendar (PRD 07 R5). unit_id NULL = tenant-wide (V1 central_holidays); a unit row is that unit''s own (V1 holidays). '
-  'holidays_for_unit(unit, from, to) is the calendar the agenda reads.';