@fayz-ai/db 0.22.0 → 0.22.3

package/migrations/141_o_endereco_da_unidade_mora_na_tabela_de_enderecos.sql

@@ -69,6 +69,22 @@ SELECT u.tenant_id, 'unit', u.id, 'main',
    AND (p.street <> '' OR p.city <> '');
 
 -- ── 2. a view lê o endereço de onde ele mora ────────────────────────────────
+-- Replay guard. 168 widened v_units with the company columns and rewrote its
+-- writer. Re-running this file over that shape fails (CREATE OR REPLACE VIEW
+-- cannot drop columns) and, if it did not, would put this file's older writer
+-- back over 168's. So once the view carries `legal_entity_id`, the view and
+-- the writer below are history and are skipped; what sits above this block is
+-- idempotent and still runs.
+DO $guard$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_attribute
+              WHERE attrelid = 'public.v_units'::regclass
+                AND attname = 'legal_entity_id' AND NOT attisdropped) THEN
+    RAISE NOTICE '141: v_units already has the 168 shape; view and writer left as they are';
+    RETURN;
+  END IF;
+
+  EXECUTE $s1$
 CREATE OR REPLACE VIEW public.v_units WITH (security_invoker='true') AS
  SELECT u.id,
         u.tenant_id,
@@ -112,12 +128,16 @@ CREATE OR REPLACE VIEW public.v_units WITH (security_invoker='true') AS
       WHERE x.owner_type = 'unit' AND x.owner_id = u.id
       ORDER BY x.is_default DESC, x.created_at
       LIMIT 1
-   ) a ON true;
+   ) a ON true
+  $s1$;
 
+  EXECUTE $s2$
 COMMENT ON VIEW public.v_units IS
-  'Units in the shape the units screen reads (#214), com o endereço vindo de public.addresses (141).';
+  'Units in the shape the units screen reads (#214), com o endereço vindo de public.addresses (141).'
+  $s2$;
 
--- ── 3. quem escreve o endereço é a tabela de endereços ──────────────────────
+  -- ── 3. quem escreve o endereço é a tabela de endereços ──────────────────────
+  EXECUTE $s3$
 CREATE OR REPLACE FUNCTION app.trg_v_units_write() RETURNS trigger
   LANGUAGE plpgsql
   SET search_path TO ''
@@ -197,7 +217,11 @@ BEGIN
 
   SELECT * INTO NEW FROM public.v_units WHERE id = v_id;
   RETURN NEW;
-END $$;
+END $$
+  $s3$;
 
+  EXECUTE $s4$
 COMMENT ON FUNCTION app.trg_v_units_write() IS
-  'Escreve v_units em app.units; o endereço é de public.addresses e não passa por aqui (141).';
+  'Escreve v_units em app.units; o endereço é de public.addresses e não passa por aqui (141).'
+  $s4$;
+END $guard$;

package/migrations/142_a_coordenada_e_do_endereco_nao_da_unidade.sql

@@ -35,6 +35,22 @@ UPDATE app.units u
    SET metadata = u.metadata - 'latitude' - 'longitude'
  WHERE u.metadata ? 'latitude' OR u.metadata ? 'longitude';
 
+-- Replay guard. 168 widened v_units with the company columns and rewrote its
+-- writer. Re-running this file over that shape fails (CREATE OR REPLACE VIEW
+-- cannot drop columns) and, if it did not, would put this file's older writer
+-- back over 168's. So once the view carries `legal_entity_id`, the view and
+-- the writer below are history and are skipped; what sits above this block is
+-- idempotent and still runs.
+DO $guard$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_attribute
+              WHERE attrelid = 'public.v_units'::regclass
+                AND attname = 'legal_entity_id' AND NOT attisdropped) THEN
+    RAISE NOTICE '142: v_units already has the 168 shape; view and writer left as they are';
+    RETURN;
+  END IF;
+
+  EXECUTE $s1$
 CREATE OR REPLACE VIEW public.v_units WITH (security_invoker='true') AS
  SELECT u.id,
         u.tenant_id,
@@ -72,11 +88,15 @@ CREATE OR REPLACE VIEW public.v_units WITH (security_invoker='true') AS
       WHERE x.owner_type = 'unit' AND x.owner_id = u.id
       ORDER BY x.is_default DESC, x.created_at
       LIMIT 1
-   ) a ON true;
+   ) a ON true
+  $s1$;
 
+  EXECUTE $s2$
 COMMENT ON VIEW public.v_units IS
-  'Units in the shape the units screen reads (#214); endereço e coordenada vêm de public.addresses (141, 142).';
+  'Units in the shape the units screen reads (#214); endereço e coordenada vêm de public.addresses (141, 142).'
+  $s2$;
 
+  EXECUTE $s3$
 CREATE OR REPLACE FUNCTION app.trg_v_units_write() RETURNS trigger
   LANGUAGE plpgsql
   SET search_path TO ''
@@ -151,7 +171,11 @@ BEGIN
 
   SELECT * INTO NEW FROM public.v_units WHERE id = v_id;
   RETURN NEW;
-END $$;
+END $$
+  $s3$;
 
+  EXECUTE $s4$
 COMMENT ON FUNCTION app.trg_v_units_write() IS
-  'Escreve v_units em app.units; endereço e coordenada são de public.addresses (141, 142).';
+  'Escreve v_units em app.units; endereço e coordenada são de public.addresses (141, 142).'
+  $s4$;
+END $guard$;

package/migrations/172_o_pacote_pode_repetir_o_servico.sql

@@ -0,0 +1,23 @@
+-- ---------------------------------------------------------------------------
+-- 172 — o pacote pode repetir o mesmo serviço em linhas diferentes.
+--
+-- `service_package_items_unique (package_id, product_id)` veio do porte e
+-- barrava o que a grade do pacote precisa fazer: duplicar uma linha (o mesmo
+-- serviço com outro valor no pacote — a primeira sessão cheia, as demais com
+-- desconto) e trocar o serviço de uma linha para um que já está em outra.
+-- O erro chegava cru na tela: «duplicate key value violates unique constraint».
+--
+-- Nada lia a unicidade: nenhum ON CONFLICT, e quem consome o pacote (venda,
+-- saldo de sessões) itera as linhas. A soma da 166 já é por linha.
+--
+-- O índice da constraint era o único que começava por `package_id`; a lista
+-- do pacote filtra por ele, então um índice simples entra no lugar.
+--
+-- Idempotente e sem tocar em dado.
+-- ---------------------------------------------------------------------------
+
+ALTER TABLE public.service_package_items
+  DROP CONSTRAINT IF EXISTS service_package_items_unique;
+
+CREATE INDEX IF NOT EXISTS service_package_items_package_idx
+  ON public.service_package_items (tenant_id, package_id);

package/migrations/173_cada_unidade_alcancada_uma_vez.sql

@@ -0,0 +1,25 @@
+-- The reach walk UNIONs (id, depth): a branch the person reaches directly AND
+-- through its HQ came back twice, and every unit picker listed it twice.
+-- Same body as 017, deduplicated on the way out.
+
+CREATE OR REPLACE FUNCTION app.user_unit_ids_in(p_tenant uuid)
+  RETURNS SETOF uuid
+  LANGUAGE sql STABLE SECURITY DEFINER
+  SET search_path TO ''
+  AS $$
+  WITH RECURSIVE seed AS (
+    SELECT a.unit_id AS id, 0 AS depth
+      FROM app.user_unit_access a
+     WHERE a.user_id = (SELECT auth.uid())
+       AND a.tenant_id = p_tenant
+  ),
+  tree AS (
+    SELECT id, depth FROM seed
+    UNION
+    SELECT u.id, t.depth + 1
+      FROM app.units u
+      JOIN tree t ON u.parent_unit_id = t.id
+     WHERE u.tenant_id = p_tenant AND t.depth < 8
+  )
+  SELECT DISTINCT id FROM tree;
+$$;

package/migrations/174_a_conta_de_quem_recebe_e_dado_do_financeiro.sql

@@ -0,0 +1,87 @@
+-- ---------------------------------------------------------------------------
+-- 174 — a conta de quem recebe é dado do financeiro.
+--
+-- Three permissive policies that let any member of a tenant do what the gated
+-- policies next to them refuse. Postgres ORs permissive policies, so a
+-- tenant-only policy beside an `app.has_permission` one wins every time.
+--
+--   · payee_accounts (149): bank/PIX of whoever the house pays. Any member,
+--     viewer and SDR included, could rewrite where a payout lands. Now read
+--     needs financial.read; insert/update financial.edit; delete
+--     financial.delete (financial.manage satisfies all three).
+--   · fulfillments: `fulfillments_member_all` (FOR ALL) shadowed the
+--     fulfillments_authz_* write policies. The write side goes; a tenant-wide
+--     SELECT stays so shop screens and plg_shop_rep_orders keep reading as today.
+--     Every writer outside the authz policies is SECURITY DEFINER or the
+--     service role.
+--   · audit_logs: any member could insert any action, backdate it, stamp
+--     before/after and pick a unit. The CRUD trail (admin stores/audit.ts) is
+--     the only client writer and only writes `record.*`; server namespaces are
+--     written by SECURITY DEFINER functions owned by postgres, which bypass RLS.
+--     audit_log() leaves the client surface for the same reason.
+--
+-- Additive and replay-safe: DROP POLICY IF EXISTS + CREATE POLICY.
+-- ---------------------------------------------------------------------------
+
+-- ── payee_accounts ──────────────────────────────────────────────────────
+DROP POLICY IF EXISTS payee_accounts_member_all ON public.payee_accounts;
+
+DROP POLICY IF EXISTS payee_accounts_authz_select ON public.payee_accounts;
+CREATE POLICY payee_accounts_authz_select ON public.payee_accounts
+  FOR SELECT TO authenticated
+  USING (tenant_id = (SELECT app.current_tenant_id())
+         AND (SELECT app.has_permission('financial.read')));
+
+DROP POLICY IF EXISTS payee_accounts_authz_insert ON public.payee_accounts;
+CREATE POLICY payee_accounts_authz_insert ON public.payee_accounts
+  FOR INSERT TO authenticated
+  WITH CHECK (tenant_id = (SELECT app.current_tenant_id())
+              AND (SELECT app.has_permission('financial.edit')));
+
+-- trg_payee_accounts_one_default is SECURITY INVOKER: its demote-the-old-default
+-- UPDATE runs under this policy too, which is why insert also asks for edit.
+DROP POLICY IF EXISTS payee_accounts_authz_update ON public.payee_accounts;
+CREATE POLICY payee_accounts_authz_update ON public.payee_accounts
+  FOR UPDATE TO authenticated
+  USING (tenant_id = (SELECT app.current_tenant_id())
+         AND (SELECT app.has_permission('financial.edit')))
+  WITH CHECK (tenant_id = (SELECT app.current_tenant_id())
+              AND (SELECT app.has_permission('financial.edit')));
+
+DROP POLICY IF EXISTS payee_accounts_authz_delete ON public.payee_accounts;
+CREATE POLICY payee_accounts_authz_delete ON public.payee_accounts
+  FOR DELETE TO authenticated
+  USING (tenant_id = (SELECT app.current_tenant_id())
+         AND (SELECT app.has_permission('financial.delete')));
+
+-- ── fulfillments ────────────────────────────────────────────────────────
+DROP POLICY IF EXISTS fulfillments_member_all ON public.fulfillments;
+
+DROP POLICY IF EXISTS fulfillments_member_read ON public.fulfillments;
+CREATE POLICY fulfillments_member_read ON public.fulfillments
+  FOR SELECT TO authenticated
+  USING (tenant_id = (SELECT app.current_tenant_id()));
+
+-- ── audit_logs ──────────────────────────────────────────────────────────
+-- Checked after the BEFORE trigger (handle_audit_actor), so user_id and
+-- tenant_id are already the session's here.
+DROP POLICY IF EXISTS audit_insert ON public.audit_logs;
+CREATE POLICY audit_insert ON public.audit_logs
+  FOR INSERT TO authenticated
+  WITH CHECK (
+    tenant_id = (SELECT app.current_tenant_id())
+    AND user_id = (SELECT auth.uid())
+    AND action LIKE 'record.%'
+    AND before IS NULL
+    AND after IS NULL
+    AND (unit_id IS NULL OR (SELECT app.has_unit(unit_id)))
+    AND created_at BETWEEN now() - interval '1 minute' AND now() + interval '1 minute'
+  );
+
+-- audit_log() is SECURITY DEFINER and takes any action, before/after and unit:
+-- open to members it is the same forgery by another door. Nothing calls it
+-- from a client or another function; server code keeps it via service_role.
+REVOKE EXECUTE ON FUNCTION public.audit_log(text, text, uuid, text, jsonb, jsonb, uuid, jsonb, uuid)
+  FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.audit_log(text, text, uuid, text, jsonb, jsonb, uuid, jsonb, uuid)
+  TO service_role;

package/package.json

@@ -3,7 +3,7 @@
   "fayz": {
     "status": "beta"
   },
-  "version": "0.22.0",
+  "version": "0.22.3",
   "description": "Fayz SDK database layer — Drizzle schema primitives, spine references, and migration helpers shared across plugins.",
   "type": "module",
   "sideEffects": false,