@fayz-ai/db 0.24.1 → 0.24.3

package/migrations/209_the_store_gets_its_rail_group.sql

@@ -0,0 +1,37 @@
+-- ============================================================================
+-- 209 — the store gets a "Loja" group in the ChefControl and GoControl rails
+--
+-- A tenant's rail is its FIRST app's preset (app_config orders trades first).
+-- Artorius runs ChefControl + StoreControl + GoControl, so it draws the
+-- ChefControl rail, which has no group for the shop's screens: Descontos and
+-- Conteúdo fell loose at the bottom, and nothing said "Loja". StoreControl's
+-- own rail has the group; the trades that also sell online did not.
+--
+-- The group only collects routes that exist: a tenant without the shop sees
+-- no empty heading. /products and /orders stay where these rails already put
+-- them (Estoque, Operação).
+--
+-- Placed right after the Estoque group. Idempotent: skipped where a "Loja"
+-- group is already present.
+-- ============================================================================
+
+UPDATE app.apps a
+   SET preset = jsonb_set(
+         a.preset,
+         '{rail}',
+         jsonb_insert(
+           a.preset -> 'rail',
+           ARRAY[(
+             SELECT (e.ord)::text
+               FROM jsonb_array_elements(a.preset -> 'rail') WITH ORDINALITY AS e(item, ord)
+              WHERE e.item ->> 'label' = 'Estoque'
+              LIMIT 1
+           )],
+           '{"icon":"ShoppingBag","label":"Loja","under":["/discounts","/content","/shop"]}'::jsonb
+         )
+       ),
+       updated_at = now()
+ WHERE a.id IN ('resto', 'full')
+   AND jsonb_typeof(a.preset -> 'rail') = 'array'
+   AND EXISTS (SELECT 1 FROM jsonb_array_elements(a.preset -> 'rail') e WHERE e ->> 'label' = 'Estoque')
+   AND NOT EXISTS (SELECT 1 FROM jsonb_array_elements(a.preset -> 'rail') e WHERE e ->> 'label' = 'Loja');

package/migrations/210_the_service_speaks_as_the_caller.sql

@@ -0,0 +1,32 @@
+-- ============================================================================
+-- 210_the_service_speaks_as_the_caller — the integration service (ADR 0003,
+-- phase 2) reaches the cluster the way PostgREST does, never with a
+-- service-role key.
+--
+-- PostgREST connects as `authenticator`, a NOINHERIT role that is a member of
+-- anon and authenticated: it holds no privilege of its own and, per request,
+-- `SET LOCAL ROLE`s into the caller's role with the caller's JWT claims, so
+-- RLS and app.has_permission decide exactly as they do for the browser.
+--
+-- fayz_integration becomes the same kind of role. It stays NOINHERIT, so
+-- membership grants nothing until the service switches role inside a
+-- transaction for a request whose JWT it has verified. Machine work (webhooks,
+-- jobs) keeps going through named SECURITY DEFINER functions granted to
+-- fayz_integration directly; service_role is never granted.
+--
+-- Guarded: the role is an operator step and may not exist on a fresh cluster.
+-- Replay-safe: GRANT of an existing membership is a no-op.
+-- ============================================================================
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'fayz_integration') THEN
+    ALTER ROLE fayz_integration NOINHERIT;
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated') THEN
+      GRANT authenticated TO fayz_integration;
+    END IF;
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'anon') THEN
+      GRANT anon TO fayz_integration;
+    END IF;
+  END IF;
+END $$;

package/migrations/211_the_service_door_for_places_and_connections.sql

@@ -0,0 +1,77 @@
+-- ============================================================================
+-- 211_the_service_door_for_places_and_connections — named functions the
+-- integration service (ADR 0003 phase 2) calls for machine work that touches
+-- core tables: the postcode cache and a tenant's connector row.
+--
+--   postal_area_get(code)            the cached address for a CEP, or null
+--   postal_area_remember(...)        caches a looked-up CEP (keys via area_key)
+--   connection_get(tenant, connector, instance)
+--                                    {id, active, status, settings} or null
+--   connection_settings_merge(id, patch)
+--                                    merges keys into settings (the provider's
+--                                    own bookkeeping, e.g. a webhook endpoint id)
+--
+-- SECURITY DEFINER, closed to anon/authenticated, granted to service_role and,
+-- when it exists, fayz_integration. Replay-safe: CREATE OR REPLACE.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.postal_area_get(p_code text) RETURNS jsonb
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO ''
+AS $function$
+  SELECT jsonb_build_object(
+           'postal_code', a.postal_code, 'street', a.street, 'district', a.district,
+           'city', a.city, 'city_code', a.city_code, 'state', a.state)
+    FROM public.postal_areas a
+   WHERE a.postal_code = regexp_replace(coalesce(p_code, ''), '\D', '', 'g');
+$function$;
+
+CREATE OR REPLACE FUNCTION public.postal_area_remember(
+  p_code text, p_street text, p_district text, p_city text, p_city_code text, p_state text, p_source text
+) RETURNS void
+LANGUAGE sql SECURITY DEFINER SET search_path TO ''
+AS $function$
+  INSERT INTO public.postal_areas (postal_code, street, district, district_key, city, city_key, city_code, state, source, fetched_at)
+  VALUES (
+    regexp_replace(p_code, '\D', '', 'g'), nullif(p_street, ''), nullif(p_district, ''),
+    public.area_key(nullif(p_district, '')), p_city, public.area_key(p_city),
+    nullif(p_city_code, ''), nullif(upper(p_state), ''), coalesce(p_source, 'viacep'), now())
+  ON CONFLICT (postal_code) DO UPDATE
+     SET street = excluded.street, district = excluded.district, district_key = excluded.district_key,
+         city = excluded.city, city_key = excluded.city_key, city_code = excluded.city_code,
+         state = excluded.state, source = excluded.source, fetched_at = excluded.fetched_at;
+$function$;
+
+CREATE OR REPLACE FUNCTION public.connection_get(p_tenant uuid, p_connector text, p_instance text DEFAULT '')
+RETURNS jsonb
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO ''
+AS $function$
+  SELECT jsonb_build_object('id', c.id, 'active', c.active, 'status', c.status, 'settings', coalesce(c.settings, '{}'::jsonb))
+    FROM public.connections c
+   WHERE c.tenant_id = p_tenant AND c.connector_id = p_connector AND c.instance_key = coalesce(p_instance, '');
+$function$;
+
+CREATE OR REPLACE FUNCTION public.connection_settings_merge(p_connection uuid, p_patch jsonb) RETURNS void
+LANGUAGE sql SECURITY DEFINER SET search_path TO ''
+AS $function$
+  UPDATE public.connections
+     SET settings = coalesce(settings, '{}'::jsonb) || coalesce(p_patch, '{}'::jsonb), updated_at = now()
+   WHERE id = p_connection;
+$function$;
+
+DO $$
+DECLARE
+  f text;
+BEGIN
+  FOREACH f IN ARRAY ARRAY[
+    'public.postal_area_get(text)',
+    'public.postal_area_remember(text, text, text, text, text, text, text)',
+    'public.connection_get(uuid, text, text)',
+    'public.connection_settings_merge(uuid, jsonb)'
+  ] LOOP
+    EXECUTE format('REVOKE ALL ON FUNCTION %s FROM PUBLIC', f);
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'anon') THEN EXECUTE format('REVOKE ALL ON FUNCTION %s FROM anon', f); END IF;
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated') THEN EXECUTE format('REVOKE ALL ON FUNCTION %s FROM authenticated', f); END IF;
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'service_role') THEN EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO service_role', f); END IF;
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'fayz_integration') THEN EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO fayz_integration', f); END IF;
+  END LOOP;
+END $$;

package/migrations/212_the_service_acts_for_the_store.sql

@@ -0,0 +1,65 @@
+-- ============================================================================
+-- 212_the_service_acts_for_the_store — machine work (a webhook, a scheduled
+-- sync) is done by the integration service AS THE STORE'S OWNER, under RLS,
+-- the same rule shop migration 0119 uses for a server-confirmed payment.
+--
+-- service_actor_for(tenant) answers the earliest active, all-units owner of
+-- the tenant. The service then runs the work in one transaction under
+-- SET LOCAL ROLE authenticated with that user's claims (migration 210), so
+-- policies, permissions and audit columns see a real member, and nothing
+-- bypasses RLS. A tenant with no active owner answers NULL and the service
+-- refuses the work rather than doing it as nobody.
+--
+-- Granted to fayz_integration only (and service_role). Replay-safe.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.service_actor_for(p_tenant uuid) RETURNS uuid
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO ''
+AS $function$
+  SELECT m.user_id
+    FROM app.memberships m
+    JOIN app.roles r ON r.id = m.role_id
+   WHERE m.tenant_id = p_tenant AND m.active AND m.all_units AND r.key = 'owner'
+   ORDER BY m.created_at, m.user_id
+   LIMIT 1;
+$function$;
+
+DO $$
+BEGIN
+  REVOKE ALL ON FUNCTION public.service_actor_for(uuid) FROM PUBLIC;
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'anon') THEN REVOKE ALL ON FUNCTION public.service_actor_for(uuid) FROM anon; END IF;
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated') THEN REVOKE ALL ON FUNCTION public.service_actor_for(uuid) FROM authenticated; END IF;
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'service_role') THEN GRANT EXECUTE ON FUNCTION public.service_actor_for(uuid) TO service_role; END IF;
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'fayz_integration') THEN GRANT EXECUTE ON FUNCTION public.service_actor_for(uuid) TO fayz_integration; END IF;
+END $$;
+
+-- ── sync_runs: written by machines only ─────────────────────────────────────
+-- A connector's sync log. Panels read it (SELECT policy for authenticated);
+-- only a sync writes it, and the sync now runs in the service. The service
+-- role gets exactly what service_role had here, scoped to this table.
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'fayz_integration') AND to_regclass('public.sync_runs') IS NOT NULL THEN
+    GRANT SELECT, INSERT, UPDATE ON public.sync_runs TO fayz_integration;
+    DROP POLICY IF EXISTS sync_runs_service ON public.sync_runs;
+    CREATE POLICY sync_runs_service ON public.sync_runs FOR ALL TO fayz_integration USING (true) WITH CHECK (true);
+  END IF;
+END $$;
+
+-- ── service_caller_belongs: "is this tenant yours?", asked as the caller ─────
+-- The service verifies a caller's JWT, then asks the cluster, in the caller's
+-- own role, whether the tenant they named is one of theirs. The answer comes
+-- from user_tenant_ids(), the same set RLS uses. SECURITY INVOKER on purpose:
+-- it says nothing a member could not already learn about themselves.
+CREATE OR REPLACE FUNCTION public.service_caller_belongs(p_tenant uuid) RETURNS boolean
+LANGUAGE sql STABLE SET search_path TO ''
+AS $function$
+  SELECT p_tenant IN (SELECT public.user_tenant_ids());
+$function$;
+
+DO $$
+BEGIN
+  REVOKE ALL ON FUNCTION public.service_caller_belongs(uuid) FROM PUBLIC;
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'anon') THEN REVOKE ALL ON FUNCTION public.service_caller_belongs(uuid) FROM anon; END IF;
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated') THEN GRANT EXECUTE ON FUNCTION public.service_caller_belongs(uuid) TO authenticated; END IF;
+END $$;

package/package.json

@@ -3,7 +3,7 @@
   "fayz": {
     "status": "beta"
   },
-  "version": "0.24.1",
+  "version": "0.24.3",
   "description": "Fayz SDK database layer — Drizzle schema primitives, spine references, and migration helpers shared across plugins.",
   "type": "module",
   "sideEffects": false,