@fayz-ai/db 0.22.2 → 0.22.3

package/migrations/173_cada_unidade_alcancada_uma_vez.sql

@@ -0,0 +1,25 @@
+-- The reach walk UNIONs (id, depth): a branch the person reaches directly AND
+-- through its HQ came back twice, and every unit picker listed it twice.
+-- Same body as 017, deduplicated on the way out.
+
+CREATE OR REPLACE FUNCTION app.user_unit_ids_in(p_tenant uuid)
+  RETURNS SETOF uuid
+  LANGUAGE sql STABLE SECURITY DEFINER
+  SET search_path TO ''
+  AS $$
+  WITH RECURSIVE seed AS (
+    SELECT a.unit_id AS id, 0 AS depth
+      FROM app.user_unit_access a
+     WHERE a.user_id = (SELECT auth.uid())
+       AND a.tenant_id = p_tenant
+  ),
+  tree AS (
+    SELECT id, depth FROM seed
+    UNION
+    SELECT u.id, t.depth + 1
+      FROM app.units u
+      JOIN tree t ON u.parent_unit_id = t.id
+     WHERE u.tenant_id = p_tenant AND t.depth < 8
+  )
+  SELECT DISTINCT id FROM tree;
+$$;

package/migrations/174_a_conta_de_quem_recebe_e_dado_do_financeiro.sql

@@ -0,0 +1,87 @@
+-- ---------------------------------------------------------------------------
+-- 174 — a conta de quem recebe é dado do financeiro.
+--
+-- Three permissive policies that let any member of a tenant do what the gated
+-- policies next to them refuse. Postgres ORs permissive policies, so a
+-- tenant-only policy beside an `app.has_permission` one wins every time.
+--
+--   · payee_accounts (149): bank/PIX of whoever the house pays. Any member,
+--     viewer and SDR included, could rewrite where a payout lands. Now read
+--     needs financial.read; insert/update financial.edit; delete
+--     financial.delete (financial.manage satisfies all three).
+--   · fulfillments: `fulfillments_member_all` (FOR ALL) shadowed the
+--     fulfillments_authz_* write policies. The write side goes; a tenant-wide
+--     SELECT stays so shop screens and plg_shop_rep_orders keep reading as today.
+--     Every writer outside the authz policies is SECURITY DEFINER or the
+--     service role.
+--   · audit_logs: any member could insert any action, backdate it, stamp
+--     before/after and pick a unit. The CRUD trail (admin stores/audit.ts) is
+--     the only client writer and only writes `record.*`; server namespaces are
+--     written by SECURITY DEFINER functions owned by postgres, which bypass RLS.
+--     audit_log() leaves the client surface for the same reason.
+--
+-- Additive and replay-safe: DROP POLICY IF EXISTS + CREATE POLICY.
+-- ---------------------------------------------------------------------------
+
+-- ── payee_accounts ──────────────────────────────────────────────────────
+DROP POLICY IF EXISTS payee_accounts_member_all ON public.payee_accounts;
+
+DROP POLICY IF EXISTS payee_accounts_authz_select ON public.payee_accounts;
+CREATE POLICY payee_accounts_authz_select ON public.payee_accounts
+  FOR SELECT TO authenticated
+  USING (tenant_id = (SELECT app.current_tenant_id())
+         AND (SELECT app.has_permission('financial.read')));
+
+DROP POLICY IF EXISTS payee_accounts_authz_insert ON public.payee_accounts;
+CREATE POLICY payee_accounts_authz_insert ON public.payee_accounts
+  FOR INSERT TO authenticated
+  WITH CHECK (tenant_id = (SELECT app.current_tenant_id())
+              AND (SELECT app.has_permission('financial.edit')));
+
+-- trg_payee_accounts_one_default is SECURITY INVOKER: its demote-the-old-default
+-- UPDATE runs under this policy too, which is why insert also asks for edit.
+DROP POLICY IF EXISTS payee_accounts_authz_update ON public.payee_accounts;
+CREATE POLICY payee_accounts_authz_update ON public.payee_accounts
+  FOR UPDATE TO authenticated
+  USING (tenant_id = (SELECT app.current_tenant_id())
+         AND (SELECT app.has_permission('financial.edit')))
+  WITH CHECK (tenant_id = (SELECT app.current_tenant_id())
+              AND (SELECT app.has_permission('financial.edit')));
+
+DROP POLICY IF EXISTS payee_accounts_authz_delete ON public.payee_accounts;
+CREATE POLICY payee_accounts_authz_delete ON public.payee_accounts
+  FOR DELETE TO authenticated
+  USING (tenant_id = (SELECT app.current_tenant_id())
+         AND (SELECT app.has_permission('financial.delete')));
+
+-- ── fulfillments ────────────────────────────────────────────────────────
+DROP POLICY IF EXISTS fulfillments_member_all ON public.fulfillments;
+
+DROP POLICY IF EXISTS fulfillments_member_read ON public.fulfillments;
+CREATE POLICY fulfillments_member_read ON public.fulfillments
+  FOR SELECT TO authenticated
+  USING (tenant_id = (SELECT app.current_tenant_id()));
+
+-- ── audit_logs ──────────────────────────────────────────────────────────
+-- Checked after the BEFORE trigger (handle_audit_actor), so user_id and
+-- tenant_id are already the session's here.
+DROP POLICY IF EXISTS audit_insert ON public.audit_logs;
+CREATE POLICY audit_insert ON public.audit_logs
+  FOR INSERT TO authenticated
+  WITH CHECK (
+    tenant_id = (SELECT app.current_tenant_id())
+    AND user_id = (SELECT auth.uid())
+    AND action LIKE 'record.%'
+    AND before IS NULL
+    AND after IS NULL
+    AND (unit_id IS NULL OR (SELECT app.has_unit(unit_id)))
+    AND created_at BETWEEN now() - interval '1 minute' AND now() + interval '1 minute'
+  );
+
+-- audit_log() is SECURITY DEFINER and takes any action, before/after and unit:
+-- open to members it is the same forgery by another door. Nothing calls it
+-- from a client or another function; server code keeps it via service_role.
+REVOKE EXECUTE ON FUNCTION public.audit_log(text, text, uuid, text, jsonb, jsonb, uuid, jsonb, uuid)
+  FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.audit_log(text, text, uuid, text, jsonb, jsonb, uuid, jsonb, uuid)
+  TO service_role;

package/package.json

@@ -3,7 +3,7 @@
   "fayz": {
     "status": "beta"
   },
-  "version": "0.22.2",
+  "version": "0.22.3",
   "description": "Fayz SDK database layer — Drizzle schema primitives, spine references, and migration helpers shared across plugins.",
   "type": "module",
   "sideEffects": false,