@fayz-ai/db 0.23.2 → 0.24.1

package/migrations/204_a_module_off_in_a_unit_does_not_write_there.sql

@@ -0,0 +1,95 @@
+-- 204: a module switched off in a unit (202) stops WRITING there, not only
+-- showing. One guard, a BEFORE INSERT/UPDATE trigger on each module's
+-- operational tables: a sale, a tab, a booking, a stock move, a time entry in
+-- a unit that has the module off is refused.
+--
+-- Who it binds: a signed-in person (auth.role() = 'authenticated'), including
+-- through SECURITY DEFINER RPCs — those still carry the caller's JWT, so the
+-- sale RPCs are covered without touching them. service_role and direct SQL
+-- (no JWT: migrations, ETL, support) pass, as every other guard here does.
+-- Catalog/config tables are left alone (a price list is shared by the network),
+-- and so are rows one module writes on another's behalf — the stock move, the
+-- fiscal document and the cash line a sale produces: the sale is the act.
+-- Additive and idempotent.
+
+-- Only the UNIT switch (202). The account-level status is the runtime's call:
+-- a module the account turned off can still run because another needs it
+-- (orders keeps inventory moving), and refusing those writes would fail a sale.
+CREATE OR REPLACE FUNCTION app.module_writes_in_unit(p_tenant uuid, p_unit uuid, p_plugin text, p_facet text DEFAULT '')
+RETURNS boolean
+LANGUAGE sql STABLE SECURITY DEFINER
+SET search_path TO ''
+AS $$
+  SELECT NOT EXISTS (
+           SELECT 1 FROM app.unit_plugins u
+            WHERE u.tenant_id = p_tenant AND u.unit_id = p_unit AND u.plugin_id = p_plugin
+              AND u.facet IN ('', coalesce(p_facet, '')) AND u.status = 'disabled')
+$$;
+REVOKE ALL ON FUNCTION app.module_writes_in_unit(uuid, uuid, text, text) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION app.module_writes_in_unit(uuid, uuid, text, text) TO authenticated, service_role;
+
+-- TG_ARGV[0] = plugin, TG_ARGV[1] = facet (optional).
+CREATE OR REPLACE FUNCTION app.trg_module_unit_guard()
+RETURNS trigger
+LANGUAGE plpgsql SECURITY DEFINER
+SET search_path TO ''
+AS $$
+DECLARE
+  v_plugin text := TG_ARGV[0];
+  v_facet  text := coalesce(TG_ARGV[1], '');
+BEGIN
+  IF coalesce(auth.role(), '') <> 'authenticated' OR NEW.unit_id IS NULL THEN
+    RETURN NEW;
+  END IF;
+  -- Sales: the channel says which module sold it.
+  IF TG_TABLE_NAME = 'orders' AND TG_TABLE_SCHEMA = 'public' THEN
+    IF NEW.channel = 'shop' THEN v_plugin := 'shop';
+    ELSIF NEW.channel = 'delivery' THEN v_plugin := 'orders'; v_facet := 'delivery';
+    ELSIF NEW.channel IS NULL OR NEW.channel NOT IN ('balcao', 'dine_in', 'retirada') THEN RETURN NEW;
+    END IF;
+  END IF;
+  IF NOT app.module_writes_in_unit(NEW.tenant_id, NEW.unit_id, v_plugin, v_facet) THEN
+    RAISE EXCEPTION 'module % is switched off in this unit', v_plugin || CASE WHEN v_facet = '' THEN '' ELSE '.' || v_facet END
+      USING ERRCODE = '42501',
+            HINT = 'Ligue o módulo para esta unidade em Configurações › Módulos.';
+  END IF;
+  RETURN NEW;
+END $$;
+REVOKE ALL ON FUNCTION app.trg_module_unit_guard() FROM PUBLIC;
+
+DO $$
+DECLARE
+  r record;
+BEGIN
+  FOR r IN SELECT * FROM (VALUES
+    ('public', 'orders',                       'orders',      ''),
+    ('public', 'plg_tables_order_guests',      'tables',      ''),
+    ('public', 'plg_tables_order_payments',    'tables',      ''),
+    ('public', 'plg_tables_order_transfers',   'tables',      ''),
+    ('public', 'plg_tables_order_cancellations','tables',     ''),
+    ('public', 'plg_tables_order_extensions',  'tables',      ''),
+    ('public', 'plg_tables_order_cover_charges','tables',     ''),
+    ('public', 'plg_tables_courtesy_events',   'tables',      ''),
+    ('public', 'plg_tables_waiter_calls',      'tables',      ''),
+    ('public', 'plg_tables_waitlist',          'tables',      'waitlist'),
+    ('public', 'plg_reservations',             'reservations',''),
+    ('public', 'appointments',                 'agenda',      ''),
+    ('public', 'appointment_items',            'agenda',      ''),
+    ('public', 'plg_agenda_turn_entries',      'agenda',      ''),
+    ('public', 'plg_clinical_sessions',        'clinical',    ''),
+    ('public', 'plg_clinical_session_products','clinical',    ''),
+    ('public', 'plg_inventory_count_sessions', 'inventory',   ''),
+    ('public', 'plg_inventory_production_orders','production',''),
+    ('public', 'plg_workforce_time_entries',   'workforce',   'time_clock'),
+    ('public', 'plg_workforce_time_adjustments','workforce',  ''),
+    ('public', 'plg_workforce_schedule_assignments','workforce','')
+  ) AS t(sch, tbl, plugin, facet)
+  LOOP
+    CONTINUE WHEN to_regclass(format('%I.%I', r.sch, r.tbl)) IS NULL;
+    CONTINUE WHEN NOT EXISTS (SELECT 1 FROM information_schema.columns
+                               WHERE table_schema = r.sch AND table_name = r.tbl AND column_name = 'unit_id');
+    EXECUTE format('DROP TRIGGER IF EXISTS module_unit_guard ON %I.%I', r.sch, r.tbl);
+    EXECUTE format('CREATE TRIGGER module_unit_guard BEFORE INSERT OR UPDATE ON %I.%I
+                    FOR EACH ROW EXECUTE FUNCTION app.trg_module_unit_guard(%L, %L)', r.sch, r.tbl, r.plugin, r.facet);
+  END LOOP;
+END $$;