@fayz-ai/db 0.22.2 → 0.23.1

package/migrations/173_cada_unidade_alcancada_uma_vez.sql

@@ -0,0 +1,25 @@
+-- The reach walk UNIONs (id, depth): a branch the person reaches directly AND
+-- through its HQ came back twice, and every unit picker listed it twice.
+-- Same body as 017, deduplicated on the way out.
+
+CREATE OR REPLACE FUNCTION app.user_unit_ids_in(p_tenant uuid)
+  RETURNS SETOF uuid
+  LANGUAGE sql STABLE SECURITY DEFINER
+  SET search_path TO ''
+  AS $$
+  WITH RECURSIVE seed AS (
+    SELECT a.unit_id AS id, 0 AS depth
+      FROM app.user_unit_access a
+     WHERE a.user_id = (SELECT auth.uid())
+       AND a.tenant_id = p_tenant
+  ),
+  tree AS (
+    SELECT id, depth FROM seed
+    UNION
+    SELECT u.id, t.depth + 1
+      FROM app.units u
+      JOIN tree t ON u.parent_unit_id = t.id
+     WHERE u.tenant_id = p_tenant AND t.depth < 8
+  )
+  SELECT DISTINCT id FROM tree;
+$$;

package/migrations/174_a_conta_de_quem_recebe_e_dado_do_financeiro.sql

@@ -0,0 +1,87 @@
+-- ---------------------------------------------------------------------------
+-- 174 — a conta de quem recebe é dado do financeiro.
+--
+-- Three permissive policies that let any member of a tenant do what the gated
+-- policies next to them refuse. Postgres ORs permissive policies, so a
+-- tenant-only policy beside an `app.has_permission` one wins every time.
+--
+--   · payee_accounts (149): bank/PIX of whoever the house pays. Any member,
+--     viewer and SDR included, could rewrite where a payout lands. Now read
+--     needs financial.read; insert/update financial.edit; delete
+--     financial.delete (financial.manage satisfies all three).
+--   · fulfillments: `fulfillments_member_all` (FOR ALL) shadowed the
+--     fulfillments_authz_* write policies. The write side goes; a tenant-wide
+--     SELECT stays so shop screens and plg_shop_rep_orders keep reading as today.
+--     Every writer outside the authz policies is SECURITY DEFINER or the
+--     service role.
+--   · audit_logs: any member could insert any action, backdate it, stamp
+--     before/after and pick a unit. The CRUD trail (admin stores/audit.ts) is
+--     the only client writer and only writes `record.*`; server namespaces are
+--     written by SECURITY DEFINER functions owned by postgres, which bypass RLS.
+--     audit_log() leaves the client surface for the same reason.
+--
+-- Additive and replay-safe: DROP POLICY IF EXISTS + CREATE POLICY.
+-- ---------------------------------------------------------------------------
+
+-- ── payee_accounts ──────────────────────────────────────────────────────
+DROP POLICY IF EXISTS payee_accounts_member_all ON public.payee_accounts;
+
+DROP POLICY IF EXISTS payee_accounts_authz_select ON public.payee_accounts;
+CREATE POLICY payee_accounts_authz_select ON public.payee_accounts
+  FOR SELECT TO authenticated
+  USING (tenant_id = (SELECT app.current_tenant_id())
+         AND (SELECT app.has_permission('financial.read')));
+
+DROP POLICY IF EXISTS payee_accounts_authz_insert ON public.payee_accounts;
+CREATE POLICY payee_accounts_authz_insert ON public.payee_accounts
+  FOR INSERT TO authenticated
+  WITH CHECK (tenant_id = (SELECT app.current_tenant_id())
+              AND (SELECT app.has_permission('financial.edit')));
+
+-- trg_payee_accounts_one_default is SECURITY INVOKER: its demote-the-old-default
+-- UPDATE runs under this policy too, which is why insert also asks for edit.
+DROP POLICY IF EXISTS payee_accounts_authz_update ON public.payee_accounts;
+CREATE POLICY payee_accounts_authz_update ON public.payee_accounts
+  FOR UPDATE TO authenticated
+  USING (tenant_id = (SELECT app.current_tenant_id())
+         AND (SELECT app.has_permission('financial.edit')))
+  WITH CHECK (tenant_id = (SELECT app.current_tenant_id())
+              AND (SELECT app.has_permission('financial.edit')));
+
+DROP POLICY IF EXISTS payee_accounts_authz_delete ON public.payee_accounts;
+CREATE POLICY payee_accounts_authz_delete ON public.payee_accounts
+  FOR DELETE TO authenticated
+  USING (tenant_id = (SELECT app.current_tenant_id())
+         AND (SELECT app.has_permission('financial.delete')));
+
+-- ── fulfillments ────────────────────────────────────────────────────────
+DROP POLICY IF EXISTS fulfillments_member_all ON public.fulfillments;
+
+DROP POLICY IF EXISTS fulfillments_member_read ON public.fulfillments;
+CREATE POLICY fulfillments_member_read ON public.fulfillments
+  FOR SELECT TO authenticated
+  USING (tenant_id = (SELECT app.current_tenant_id()));
+
+-- ── audit_logs ──────────────────────────────────────────────────────────
+-- Checked after the BEFORE trigger (handle_audit_actor), so user_id and
+-- tenant_id are already the session's here.
+DROP POLICY IF EXISTS audit_insert ON public.audit_logs;
+CREATE POLICY audit_insert ON public.audit_logs
+  FOR INSERT TO authenticated
+  WITH CHECK (
+    tenant_id = (SELECT app.current_tenant_id())
+    AND user_id = (SELECT auth.uid())
+    AND action LIKE 'record.%'
+    AND before IS NULL
+    AND after IS NULL
+    AND (unit_id IS NULL OR (SELECT app.has_unit(unit_id)))
+    AND created_at BETWEEN now() - interval '1 minute' AND now() + interval '1 minute'
+  );
+
+-- audit_log() is SECURITY DEFINER and takes any action, before/after and unit:
+-- open to members it is the same forgery by another door. Nothing calls it
+-- from a client or another function; server code keeps it via service_role.
+REVOKE EXECUTE ON FUNCTION public.audit_log(text, text, uuid, text, jsonb, jsonb, uuid, jsonb, uuid)
+  FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.audit_log(text, text, uuid, text, jsonb, jsonb, uuid, jsonb, uuid)
+  TO service_role;

package/migrations/187_a_liberacao_por_unidade_tambem_pergunta_uma_vez.sql

@@ -0,0 +1,80 @@
+-- The unit release on people asks once per statement, also for the person who HAS a tuple.
+--
+-- 121 made "does this person have a release tuple?" a hashed SubPlan, which is cheap only while
+-- few people have one: the expensive `available_in_my_units` ran just for them. On 2026-10-01 the
+-- Espaço Facial got 130,091 `available_in` tuples (one per client, to the V1 home unit), so the
+-- NOT IN now excludes almost everyone and the per-row resolution — every unit of the reader times
+-- a recursive walk up the unit tree — runs ~120k times. Any people search timed out (57014 after
+-- 8s), which left the agenda unable to find a client.
+--
+-- When the tenant has no `unavailable_in` tuple, the resolution collapses to a set question: the
+-- person is visible iff an `available_in` tuple names me, one of my roles, or a unit on the chain
+-- (self + ancestors) of one of the units I reach. Those three sets do not depend on the row, so
+-- they become InitPlans and the tuple lookup a hashed SubPlan. With an `unavailable_in` anywhere
+-- in the tenant the old resolution still answers, unchanged — nearest-ancestor deny needs it.
+--
+-- Same answer as `available_in_my_units` by construction (see its `direct`/`mine`/`verdicts`);
+-- checked on the cluster by comparing both over the whole tenant before applying.
+--
+-- Idempotent.
+
+CREATE OR REPLACE FUNCTION app.my_release_units()
+RETURNS uuid[]
+LANGUAGE sql
+STABLE SECURITY DEFINER
+SET search_path TO ''
+AS $function$
+  -- `mine` of available_in_my_units, walked up: a tuple on any ancestor releases to me.
+  SELECT coalesce(array_agg(DISTINCT c.unit_id), '{}'::uuid[])
+    FROM app.user_unit_access a
+    CROSS JOIN LATERAL app.unit_chain(a.unit_id) c
+   WHERE a.tenant_id = app.current_tenant_id()
+     AND a.user_id = auth.uid()
+     AND (nullif(app.current_unit_id(), '00000000-0000-0000-0000-000000000000'::uuid) IS NULL
+          OR a.unit_id = nullif(app.current_unit_id(), '00000000-0000-0000-0000-000000000000'::uuid));
+$function$;
+
+CREATE OR REPLACE FUNCTION app.my_release_roles()
+RETURNS uuid[]
+LANGUAGE sql
+STABLE SECURITY DEFINER
+SET search_path TO ''
+AS $function$
+  SELECT coalesce(array_agg(DISTINCT r), '{}'::uuid[]) FROM (
+    SELECT m.role_id AS r FROM app.memberships m
+     WHERE m.tenant_id = app.current_tenant_id() AND m.user_id = auth.uid() AND m.active
+    UNION
+    SELECT mu.role_override_id FROM app.membership_units mu
+     WHERE mu.tenant_id = app.current_tenant_id() AND mu.user_id = auth.uid()
+       AND mu.role_override_id IS NOT NULL
+  ) x WHERE r IS NOT NULL;
+$function$;
+
+REVOKE ALL ON FUNCTION app.my_release_units() FROM PUBLIC, anon;
+REVOKE ALL ON FUNCTION app.my_release_roles() FROM PUBLIC, anon;
+GRANT EXECUTE ON FUNCTION app.my_release_units() TO authenticated, service_role;
+GRANT EXECUTE ON FUNCTION app.my_release_roles() TO authenticated, service_role;
+
+ALTER POLICY people_available_in ON public.people USING (
+  (NOT (SELECT app.grants_exist('people.person', ARRAY['available_in', 'unavailable_in'])))
+  OR (unit_id IS NOT NULL)
+  OR (people.id NOT IN (
+        SELECT g.resource_id
+          FROM app.resource_grants g
+         WHERE g.tenant_id = (SELECT app.current_tenant_id())
+           AND g.resource_type = 'people.person'
+           AND g.relation IN ('available_in', 'unavailable_in')
+           AND g.resource_id IS NOT NULL))
+  OR ((NOT (SELECT app.grants_exist('people.person', ARRAY['unavailable_in'])))
+      AND people.id IN (
+        SELECT g.resource_id
+          FROM app.resource_grants g
+         WHERE g.tenant_id = (SELECT app.current_tenant_id())
+           AND g.resource_type = 'people.person'
+           AND g.relation = 'available_in'
+           AND g.resource_id IS NOT NULL
+           AND (   (g.subject_type = 'unit' AND g.subject_id IN (SELECT unnest(app.my_release_units())))
+                OR (g.subject_type = 'user' AND g.subject_id = (SELECT auth.uid()))
+                OR (g.subject_type = 'role' AND g.subject_id IN (SELECT unnest(app.my_release_roles()))))))
+  OR ((SELECT app.grants_exist('people.person', ARRAY['unavailable_in']))
+      AND (SELECT app.available_in_my_units('people.person', people.id))));

package/migrations/188_a_busca_de_pessoas_passa_pelo_indice.sql

@@ -0,0 +1,126 @@
+-- People search finds candidates through the index first, then lets RLS judge only those.
+--
+-- `people?name=ilike.*x*` never uses the trigram index under RLS: `~~*` is not leakproof, so it
+-- cannot move below the security barrier and every row of the tenant pays the policies before
+-- the name is even looked at (121 says the same). With 120k people in the Espaço Facial a client
+-- search took 1–8 s and often hit the 8 s statement_timeout; the agenda's company search over
+-- `v_leads` (two LATERALs per row) always did.
+--
+-- The split: `app.people_match_ids` runs as definer, scoped to the caller's tenant, so the
+-- trigram indexes answer which ids match; `public.people_search` runs as the caller and reads
+-- those ids from `people` under its normal RLS. Only rows the caller may see come back — the
+-- definer half never leaves the database (the `app` schema is not exposed by PostgREST).
+--
+-- It matches what the lookup matched before (name, phone digits, document) plus the CRM company
+-- the person belongs to, which is what the agenda's second query over `v_leads` existed for.
+--
+-- Idempotent.
+
+CREATE OR REPLACE FUNCTION app.people_match_ids(p_query text, p_kinds text[] DEFAULT NULL, p_cap integer DEFAULT 500)
+RETURNS SETOF uuid
+LANGUAGE plpgsql
+STABLE SECURITY DEFINER
+-- The default estimate (1000) makes the caller walk `people` in name order instead of joining.
+ROWS 50
+SET search_path TO ''
+AS $function$
+DECLARE
+  v_tenant uuid := app.current_tenant_id();
+  v_q      text := btrim(coalesce(p_query, ''));
+  v_like   text;
+  v_digits text := regexp_replace(coalesce(p_query, ''), '\D', '', 'g');
+  v_cap    integer := least(greatest(coalesce(p_cap, 500), 1), 1000);
+  -- The unit release of 187, applied here too: with a unit in focus most matches are invisible,
+  -- and capping before dropping them would hide visible people behind invisible ones. Only a
+  -- narrowing — the caller's RLS still decides every row.
+  v_scoped boolean;
+  v_units  uuid[];
+  v_roles  uuid[];
+  v_uid    uuid := auth.uid();
+BEGIN
+  IF v_tenant IS NULL OR v_q = '' THEN
+    RETURN;
+  END IF;
+  v_like := '%' || replace(replace(replace(v_q, '\', '\\'), '%', '\%'), '_', '\_') || '%';
+  v_scoped := app.grants_exist('people.person', ARRAY['available_in', 'unavailable_in'])
+              AND NOT app.grants_exist('people.person', ARRAY['unavailable_in']);
+  IF v_scoped THEN
+    v_units := app.my_release_units();
+    v_roles := app.my_release_roles();
+  END IF;
+
+  -- One indexed branch per field (a single OR across them falls back to a sequential scan).
+  RETURN QUERY
+    SELECT p.id FROM public.people p
+     WHERE p.tenant_id = v_tenant AND p.is_active
+       AND (p_kinds IS NULL OR p.kind = ANY (p_kinds))
+       AND p.name ILIKE v_like
+       AND (NOT v_scoped OR p.unit_id IS NOT NULL
+            OR NOT EXISTS (SELECT 1 FROM app.resource_grants g
+                            WHERE g.tenant_id = v_tenant AND g.resource_type = 'people.person' AND g.resource_id = p.id)
+            OR EXISTS (SELECT 1 FROM app.resource_grants g
+                        WHERE g.tenant_id = v_tenant AND g.resource_type = 'people.person' AND g.resource_id = p.id
+                          AND g.relation = 'available_in'
+                          AND (   (g.subject_type = 'unit' AND g.subject_id = ANY (v_units))
+                               OR (g.subject_type = 'user' AND g.subject_id = v_uid)
+                               OR (g.subject_type = 'role' AND g.subject_id = ANY (v_roles)))))
+     LIMIT v_cap;
+
+  IF length(v_digits) >= 3 THEN
+    RETURN QUERY
+      SELECT p.id FROM public.people p
+       WHERE p.tenant_id = v_tenant AND p.is_active
+         AND (p_kinds IS NULL OR p.kind = ANY (p_kinds))
+         AND (p.phone_digits LIKE '%' || v_digits || '%' OR p.document_number LIKE '%' || v_digits || '%')
+         AND (NOT v_scoped OR p.unit_id IS NOT NULL
+              OR NOT EXISTS (SELECT 1 FROM app.resource_grants g
+                              WHERE g.tenant_id = v_tenant AND g.resource_type = 'people.person' AND g.resource_id = p.id)
+              OR EXISTS (SELECT 1 FROM app.resource_grants g
+                          WHERE g.tenant_id = v_tenant AND g.resource_type = 'people.person' AND g.resource_id = p.id
+                            AND g.relation = 'available_in'
+                            AND (   (g.subject_type = 'unit' AND g.subject_id = ANY (v_units))
+                                 OR (g.subject_type = 'user' AND g.subject_id = v_uid)
+                                 OR (g.subject_type = 'role' AND g.subject_id = ANY (v_roles)))))
+       LIMIT v_cap;
+  END IF;
+
+  -- The company a person is linked to, when the CRM tables exist in this pool.
+  IF to_regclass('public.plg_crm_company_people') IS NOT NULL
+     AND to_regclass('public.plg_crm_companies') IS NOT NULL THEN
+    RETURN QUERY EXECUTE
+      'SELECT DISTINCT cp.person_id
+         FROM public.plg_crm_company_people cp
+         JOIN public.plg_crm_companies c ON c.id = cp.company_id
+         JOIN public.people p ON p.id = cp.person_id
+        WHERE cp.tenant_id = $1 AND c.name ILIKE $2 AND p.is_active
+          AND ($3::text[] IS NULL OR p.kind = ANY ($3))
+        LIMIT $4'
+      USING v_tenant, v_like, p_kinds, v_cap;
+  END IF;
+END
+$function$;
+
+REVOKE ALL ON FUNCTION app.people_match_ids(text, text[], integer) FROM PUBLIC, anon;
+GRANT EXECUTE ON FUNCTION app.people_match_ids(text, text[], integer) TO authenticated, service_role;
+
+CREATE OR REPLACE FUNCTION public.people_search(p_query text, p_kinds text[] DEFAULT NULL, p_limit integer DEFAULT 20)
+RETURNS SETOF public.people
+LANGUAGE sql
+STABLE SECURITY INVOKER
+SET search_path TO ''
+AS $function$
+  WITH m AS MATERIALIZED (
+    SELECT DISTINCT id FROM app.people_match_ids(p_query, p_kinds, 500) AS id
+  )
+  SELECT p.*
+    FROM m
+    JOIN public.people p ON p.id = m.id
+   ORDER BY p.name
+   LIMIT least(greatest(coalesce(p_limit, 20), 1), 100);
+$function$;
+
+REVOKE ALL ON FUNCTION public.people_search(text, text[], integer) FROM PUBLIC, anon;
+GRANT EXECUTE ON FUNCTION public.people_search(text, text[], integer) TO authenticated, service_role;
+
+COMMENT ON FUNCTION public.people_search(text, text[], integer) IS
+  'Person search for pickers: candidates by index (app.people_match_ids, definer, tenant-scoped), rows under the caller''s RLS (188).';

package/migrations/189_aparece_na_agenda_atravessa_o_espelho.sql

@@ -0,0 +1,117 @@
+-- "Aparece na agenda" crosses the services ↔ products mirror.
+--
+-- 120 gave both tables `is_bookable`; the two mirror triggers (archive 085/191) predate it and copy
+-- every other column but this one. The Serviços screen writes `services`, the agenda reads
+-- `products`: switching "Aparece na agenda" on the screen never reached the agenda, and a flag
+-- changed on `products` was shown wrong on the screen (FAY-1613, Espaço Facial: six services
+-- unbookable in products, bookable in services).
+--
+-- Same bodies, plus `is_bookable`. The services side only exists in pools where `services` is still
+-- a table; there the column exists since 120.
+--
+-- Idempotent.
+
+-- Only where the mirror still runs. Pools that took archive 191 have no
+-- `public.services` table and no triggers calling these; creating the bodies
+-- there would bring back two orphan functions the retirement removed (the
+-- catalog suite asserts they are gone). Same condition as the backfill below.
+DO $mirror$
+BEGIN
+  IF to_regclass('public.services') IS NULL
+     OR (SELECT relkind FROM pg_class WHERE oid = to_regclass('public.services')) <> 'r' THEN
+    RETURN;
+  END IF;
+
+  EXECUTE $fn$
+CREATE OR REPLACE FUNCTION app.trg_catalog_products_mirror()
+ RETURNS trigger
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO ''
+AS $function$
+BEGIN
+  IF coalesce(current_setting('fayz.catalog_sync', true), '') = 'on' THEN
+    RETURN NULL;
+  END IF;
+  PERFORM set_config('fayz.catalog_sync', 'on', true);
+  IF TG_OP = 'DELETE' OR (TG_OP = 'UPDATE' AND NEW.kind <> 'service') THEN
+    DELETE FROM public.services s WHERE s.id = OLD.id;
+  END IF;
+  IF TG_OP IN ('INSERT', 'UPDATE') AND NEW.kind = 'service' THEN
+    INSERT INTO public.services (
+      id, tenant_id, category_id, name, description, price, cost, currency, duration_minutes, image_url,
+      status, is_active, tags, metadata, custom_fields, created_by, created_at, updated_at, unit_id, owner_id,
+      is_bookable
+    ) VALUES (
+      NEW.id, NEW.tenant_id, NEW.category_id, NEW.name, NEW.description, NEW.price, NEW.cost, NEW.currency, NEW.duration_minutes, NEW.image_url,
+      NEW.status, NEW.is_active, NEW.tags, NEW.metadata, NEW.custom_fields, NEW.created_by, NEW.created_at, NEW.updated_at, NEW.unit_id, NEW.owner_id,
+      NEW.is_bookable
+    )
+    ON CONFLICT (id) DO UPDATE SET
+      tenant_id = EXCLUDED.tenant_id, category_id = EXCLUDED.category_id, name = EXCLUDED.name,
+      description = EXCLUDED.description, price = EXCLUDED.price, cost = EXCLUDED.cost, currency = EXCLUDED.currency,
+      duration_minutes = EXCLUDED.duration_minutes, image_url = EXCLUDED.image_url, status = EXCLUDED.status,
+      is_active = EXCLUDED.is_active, tags = EXCLUDED.tags, metadata = EXCLUDED.metadata, custom_fields = EXCLUDED.custom_fields,
+      created_by = EXCLUDED.created_by, created_at = EXCLUDED.created_at, updated_at = EXCLUDED.updated_at,
+      unit_id = EXCLUDED.unit_id, owner_id = EXCLUDED.owner_id, is_bookable = EXCLUDED.is_bookable;
+  END IF;
+  PERFORM set_config('fayz.catalog_sync', '', true);
+  RETURN NULL;
+END $function$
+  $fn$;
+
+  EXECUTE $fn$
+CREATE OR REPLACE FUNCTION app.trg_catalog_services_forward()
+ RETURNS trigger
+ LANGUAGE plpgsql
+ SECURITY DEFINER
+ SET search_path TO ''
+AS $function$
+BEGIN
+  IF coalesce(current_setting('fayz.catalog_sync', true), '') = 'on' THEN
+    RETURN CASE WHEN TG_OP = 'DELETE' THEN OLD ELSE NEW END;
+  END IF;
+  IF TG_OP = 'UPDATE' AND NEW.id IS DISTINCT FROM OLD.id THEN
+    RAISE EXCEPTION 'services: changing the id of a service is not supported (compat mirror)' USING ERRCODE = '0A000';
+  END IF;
+  PERFORM set_config('fayz.catalog_sync', 'on', true);
+  IF TG_OP = 'DELETE' THEN
+    DELETE FROM public.products p WHERE p.id = OLD.id;
+  ELSE
+    INSERT INTO public.products (
+      id, tenant_id, category_id, name, description, price, cost, currency, image_url,
+      status, is_active, tags, metadata, custom_fields, created_by, created_at, updated_at,
+      unit_id, owner_id, kind, duration_minutes, is_bookable
+    ) VALUES (
+      NEW.id, NEW.tenant_id, NEW.category_id, NEW.name, NEW.description, NEW.price, NEW.cost, NEW.currency, NEW.image_url,
+      NEW.status, NEW.is_active, NEW.tags, NEW.metadata, NEW.custom_fields, NEW.created_by, NEW.created_at, NEW.updated_at,
+      NEW.unit_id, NEW.owner_id, 'service', NEW.duration_minutes, coalesce(NEW.is_bookable, true)
+    )
+    ON CONFLICT (id) DO UPDATE SET
+      tenant_id = EXCLUDED.tenant_id, category_id = EXCLUDED.category_id, name = EXCLUDED.name,
+      description = EXCLUDED.description, price = EXCLUDED.price, cost = EXCLUDED.cost, currency = EXCLUDED.currency,
+      image_url = EXCLUDED.image_url, status = EXCLUDED.status, is_active = EXCLUDED.is_active, tags = EXCLUDED.tags,
+      metadata = EXCLUDED.metadata, custom_fields = EXCLUDED.custom_fields, created_by = EXCLUDED.created_by,
+      updated_at = EXCLUDED.updated_at, unit_id = EXCLUDED.unit_id, owner_id = EXCLUDED.owner_id,
+      kind = 'service', duration_minutes = EXCLUDED.duration_minutes, is_bookable = EXCLUDED.is_bookable;
+  END IF;
+  PERFORM set_config('fayz.catalog_sync', '', true);
+  RETURN CASE WHEN TG_OP = 'DELETE' THEN OLD ELSE NEW END;
+END $function$
+  $fn$;
+END $mirror$;
+
+-- Rows that drifted before this: products is what the agenda reads, so it wins.
+DO $$
+BEGIN
+  IF to_regclass('public.services') IS NOT NULL
+     AND (SELECT relkind FROM pg_class WHERE oid = to_regclass('public.services')) = 'r'
+     AND EXISTS (SELECT 1 FROM information_schema.columns
+                  WHERE table_schema = 'public' AND table_name = 'services' AND column_name = 'is_bookable') THEN
+    PERFORM set_config('fayz.catalog_sync', 'on', true);
+    UPDATE public.services s SET is_bookable = p.is_bookable
+      FROM public.products p
+     WHERE p.id = s.id AND s.is_bookable IS DISTINCT FROM p.is_bookable;
+    PERFORM set_config('fayz.catalog_sync', '', true);
+  END IF;
+END $$;

package/migrations/195_quem_entra_como_outra_pessoa_deixa_rastro.sql

@@ -0,0 +1,97 @@
+-- Authorises "view as this person" and writes the trail before any session is
+-- minted. Called only by the platform-admin edge function (service_role), which
+-- passes the verified actor: auth.uid() is null under the service key.
+--
+-- Two ways in:
+--   * a tenant admin (an active membership holding members.manage) entering as
+--     someone in the SAME tenant;
+--   * platform staff with platform.can(actor, 'impersonate.user'), which always
+--     requires a written reason.
+-- Never as oneself, never as an owner, never as someone without a login.
+--
+-- The platform schema is applied outside this chain, so its functions are
+-- reached dynamically: on a pool without it, only the tenant-admin path exists.
+
+CREATE OR REPLACE FUNCTION public.impersonation_authorize(
+  p_actor uuid,
+  p_tenant uuid,
+  p_target uuid,
+  p_reason text DEFAULT NULL
+) RETURNS jsonb
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path TO ''
+AS $$
+DECLARE
+  v_reason   text := nullif(btrim(coalesce(p_reason, '')), '');
+  v_is_admin boolean;
+  v_is_staff boolean;
+  v_role_key text;
+  v_role     text;
+  v_email    text;
+  v_name     text;
+  v_action   text;
+BEGIN
+  IF p_actor IS NULL OR p_tenant IS NULL OR p_target IS NULL THEN
+    RAISE EXCEPTION 'impersonation_authorize: actor, tenant and target are required' USING ERRCODE = '22023';
+  END IF;
+  IF p_actor = p_target THEN
+    RAISE EXCEPTION 'impersonation_authorize: you are already this person' USING ERRCODE = '22023';
+  END IF;
+
+  SELECT EXISTS (
+    SELECT 1 FROM app.memberships m
+      JOIN app.role_permissions rp ON rp.role_id = m.role_id AND rp.tenant_id = m.tenant_id
+     WHERE m.tenant_id = p_tenant AND m.user_id = p_actor AND m.active
+       AND rp.permission = 'members.manage'
+  ) INTO v_is_admin;
+  v_is_staff := false;
+  IF to_regprocedure('platform.can(uuid,text)') IS NOT NULL THEN
+    EXECUTE 'SELECT platform.can($1, $2)' INTO v_is_staff USING p_actor, 'impersonate.user';
+  END IF;
+
+  IF NOT v_is_admin AND NOT v_is_staff THEN
+    RAISE EXCEPTION 'impersonation_authorize: not allowed' USING ERRCODE = '42501';
+  END IF;
+  IF NOT v_is_admin AND v_reason IS NULL THEN
+    RAISE EXCEPTION 'impersonation_authorize: informe o motivo' USING ERRCODE = '23514';
+  END IF;
+
+  SELECT r.key, r.name INTO v_role_key, v_role
+    FROM app.memberships m JOIN app.roles r ON r.id = m.role_id
+   WHERE m.tenant_id = p_tenant AND m.user_id = p_target AND m.active;
+  IF v_role_key IS NULL THEN
+    RAISE EXCEPTION 'impersonation_authorize: essa pessoa não tem acesso ativo a esta conta' USING ERRCODE = 'P0002';
+  END IF;
+  IF v_role_key = 'owner' THEN
+    RAISE EXCEPTION 'impersonation_authorize: não é possível entrar como o proprietário' USING ERRCODE = '42501';
+  END IF;
+
+  SELECT u.email, coalesce(nullif(u.raw_user_meta_data ->> 'full_name', ''), u.email)
+    INTO v_email, v_name
+    FROM auth.users u WHERE u.id = p_target;
+  IF v_email IS NULL THEN
+    RAISE EXCEPTION 'impersonation_authorize: essa pessoa não tem login' USING ERRCODE = 'P0002';
+  END IF;
+
+  v_action := CASE WHEN v_is_admin THEN 'impersonate.member' ELSE 'impersonate.user' END;
+
+  IF to_regprocedure('platform.audit_write(uuid,text,uuid,text,text,jsonb)') IS NOT NULL THEN
+    EXECUTE 'SELECT platform.audit_write($1, $2, $3, $4, $5, $6)'
+      USING p_actor, v_action, p_tenant, v_email, v_reason,
+            jsonb_build_object('target_user', p_target, 'role', v_role_key);
+  END IF;
+
+  -- The tenant's own trail, so the account owner sees who entered as whom.
+  INSERT INTO public.audit_logs (id, tenant_id, user_id, action, entity_type, entity_id, metadata, reason, created_at)
+  VALUES (gen_random_uuid(), p_tenant, p_actor, v_action, 'user', p_target::text,
+          jsonb_build_object('target_email', v_email, 'target_name', v_name, 'role', v_role_key,
+                             'by_platform_staff', NOT v_is_admin),
+          v_reason, now());
+
+  RETURN jsonb_build_object('user_id', p_target, 'email', v_email, 'name', v_name,
+                            'role', v_role, 'role_key', v_role_key, 'action', v_action);
+END $$;
+
+REVOKE ALL ON FUNCTION public.impersonation_authorize(uuid, uuid, uuid, text) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.impersonation_authorize(uuid, uuid, uuid, text) TO service_role;

package/package.json

@@ -3,7 +3,7 @@
   "fayz": {
     "status": "beta"
   },
-  "version": "0.22.2",
+  "version": "0.23.1",
   "description": "Fayz SDK database layer — Drizzle schema primitives, spine references, and migration helpers shared across plugins.",
   "type": "module",
   "sideEffects": false,