@fayz-ai/db 0.24.2 → 0.25.0

package/migrations/210_the_service_speaks_as_the_caller.sql

@@ -0,0 +1,32 @@
+-- ============================================================================
+-- 210_the_service_speaks_as_the_caller — the integration service (ADR 0003,
+-- phase 2) reaches the cluster the way PostgREST does, never with a
+-- service-role key.
+--
+-- PostgREST connects as `authenticator`, a NOINHERIT role that is a member of
+-- anon and authenticated: it holds no privilege of its own and, per request,
+-- `SET LOCAL ROLE`s into the caller's role with the caller's JWT claims, so
+-- RLS and app.has_permission decide exactly as they do for the browser.
+--
+-- fayz_integration becomes the same kind of role. It stays NOINHERIT, so
+-- membership grants nothing until the service switches role inside a
+-- transaction for a request whose JWT it has verified. Machine work (webhooks,
+-- jobs) keeps going through named SECURITY DEFINER functions granted to
+-- fayz_integration directly; service_role is never granted.
+--
+-- Guarded: the role is an operator step and may not exist on a fresh cluster.
+-- Replay-safe: GRANT of an existing membership is a no-op.
+-- ============================================================================
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'fayz_integration') THEN
+    ALTER ROLE fayz_integration NOINHERIT;
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated') THEN
+      GRANT authenticated TO fayz_integration;
+    END IF;
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'anon') THEN
+      GRANT anon TO fayz_integration;
+    END IF;
+  END IF;
+END $$;

package/migrations/211_the_service_door_for_places_and_connections.sql

@@ -0,0 +1,77 @@
+-- ============================================================================
+-- 211_the_service_door_for_places_and_connections — named functions the
+-- integration service (ADR 0003 phase 2) calls for machine work that touches
+-- core tables: the postcode cache and a tenant's connector row.
+--
+--   postal_area_get(code)            the cached address for a CEP, or null
+--   postal_area_remember(...)        caches a looked-up CEP (keys via area_key)
+--   connection_get(tenant, connector, instance)
+--                                    {id, active, status, settings} or null
+--   connection_settings_merge(id, patch)
+--                                    merges keys into settings (the provider's
+--                                    own bookkeeping, e.g. a webhook endpoint id)
+--
+-- SECURITY DEFINER, closed to anon/authenticated, granted to service_role and,
+-- when it exists, fayz_integration. Replay-safe: CREATE OR REPLACE.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.postal_area_get(p_code text) RETURNS jsonb
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO ''
+AS $function$
+  SELECT jsonb_build_object(
+           'postal_code', a.postal_code, 'street', a.street, 'district', a.district,
+           'city', a.city, 'city_code', a.city_code, 'state', a.state)
+    FROM public.postal_areas a
+   WHERE a.postal_code = regexp_replace(coalesce(p_code, ''), '\D', '', 'g');
+$function$;
+
+CREATE OR REPLACE FUNCTION public.postal_area_remember(
+  p_code text, p_street text, p_district text, p_city text, p_city_code text, p_state text, p_source text
+) RETURNS void
+LANGUAGE sql SECURITY DEFINER SET search_path TO ''
+AS $function$
+  INSERT INTO public.postal_areas (postal_code, street, district, district_key, city, city_key, city_code, state, source, fetched_at)
+  VALUES (
+    regexp_replace(p_code, '\D', '', 'g'), nullif(p_street, ''), nullif(p_district, ''),
+    public.area_key(nullif(p_district, '')), p_city, public.area_key(p_city),
+    nullif(p_city_code, ''), nullif(upper(p_state), ''), coalesce(p_source, 'viacep'), now())
+  ON CONFLICT (postal_code) DO UPDATE
+     SET street = excluded.street, district = excluded.district, district_key = excluded.district_key,
+         city = excluded.city, city_key = excluded.city_key, city_code = excluded.city_code,
+         state = excluded.state, source = excluded.source, fetched_at = excluded.fetched_at;
+$function$;
+
+CREATE OR REPLACE FUNCTION public.connection_get(p_tenant uuid, p_connector text, p_instance text DEFAULT '')
+RETURNS jsonb
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO ''
+AS $function$
+  SELECT jsonb_build_object('id', c.id, 'active', c.active, 'status', c.status, 'settings', coalesce(c.settings, '{}'::jsonb))
+    FROM public.connections c
+   WHERE c.tenant_id = p_tenant AND c.connector_id = p_connector AND c.instance_key = coalesce(p_instance, '');
+$function$;
+
+CREATE OR REPLACE FUNCTION public.connection_settings_merge(p_connection uuid, p_patch jsonb) RETURNS void
+LANGUAGE sql SECURITY DEFINER SET search_path TO ''
+AS $function$
+  UPDATE public.connections
+     SET settings = coalesce(settings, '{}'::jsonb) || coalesce(p_patch, '{}'::jsonb), updated_at = now()
+   WHERE id = p_connection;
+$function$;
+
+DO $$
+DECLARE
+  f text;
+BEGIN
+  FOREACH f IN ARRAY ARRAY[
+    'public.postal_area_get(text)',
+    'public.postal_area_remember(text, text, text, text, text, text, text)',
+    'public.connection_get(uuid, text, text)',
+    'public.connection_settings_merge(uuid, jsonb)'
+  ] LOOP
+    EXECUTE format('REVOKE ALL ON FUNCTION %s FROM PUBLIC', f);
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'anon') THEN EXECUTE format('REVOKE ALL ON FUNCTION %s FROM anon', f); END IF;
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated') THEN EXECUTE format('REVOKE ALL ON FUNCTION %s FROM authenticated', f); END IF;
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'service_role') THEN EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO service_role', f); END IF;
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'fayz_integration') THEN EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO fayz_integration', f); END IF;
+  END LOOP;
+END $$;

package/migrations/212_the_service_acts_for_the_store.sql

@@ -0,0 +1,65 @@
+-- ============================================================================
+-- 212_the_service_acts_for_the_store — machine work (a webhook, a scheduled
+-- sync) is done by the integration service AS THE STORE'S OWNER, under RLS,
+-- the same rule shop migration 0119 uses for a server-confirmed payment.
+--
+-- service_actor_for(tenant) answers the earliest active, all-units owner of
+-- the tenant. The service then runs the work in one transaction under
+-- SET LOCAL ROLE authenticated with that user's claims (migration 210), so
+-- policies, permissions and audit columns see a real member, and nothing
+-- bypasses RLS. A tenant with no active owner answers NULL and the service
+-- refuses the work rather than doing it as nobody.
+--
+-- Granted to fayz_integration only (and service_role). Replay-safe.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.service_actor_for(p_tenant uuid) RETURNS uuid
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path TO ''
+AS $function$
+  SELECT m.user_id
+    FROM app.memberships m
+    JOIN app.roles r ON r.id = m.role_id
+   WHERE m.tenant_id = p_tenant AND m.active AND m.all_units AND r.key = 'owner'
+   ORDER BY m.created_at, m.user_id
+   LIMIT 1;
+$function$;
+
+DO $$
+BEGIN
+  REVOKE ALL ON FUNCTION public.service_actor_for(uuid) FROM PUBLIC;
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'anon') THEN REVOKE ALL ON FUNCTION public.service_actor_for(uuid) FROM anon; END IF;
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated') THEN REVOKE ALL ON FUNCTION public.service_actor_for(uuid) FROM authenticated; END IF;
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'service_role') THEN GRANT EXECUTE ON FUNCTION public.service_actor_for(uuid) TO service_role; END IF;
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'fayz_integration') THEN GRANT EXECUTE ON FUNCTION public.service_actor_for(uuid) TO fayz_integration; END IF;
+END $$;
+
+-- ── sync_runs: written by machines only ─────────────────────────────────────
+-- A connector's sync log. Panels read it (SELECT policy for authenticated);
+-- only a sync writes it, and the sync now runs in the service. The service
+-- role gets exactly what service_role had here, scoped to this table.
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'fayz_integration') AND to_regclass('public.sync_runs') IS NOT NULL THEN
+    GRANT SELECT, INSERT, UPDATE ON public.sync_runs TO fayz_integration;
+    DROP POLICY IF EXISTS sync_runs_service ON public.sync_runs;
+    CREATE POLICY sync_runs_service ON public.sync_runs FOR ALL TO fayz_integration USING (true) WITH CHECK (true);
+  END IF;
+END $$;
+
+-- ── service_caller_belongs: "is this tenant yours?", asked as the caller ─────
+-- The service verifies a caller's JWT, then asks the cluster, in the caller's
+-- own role, whether the tenant they named is one of theirs. The answer comes
+-- from user_tenant_ids(), the same set RLS uses. SECURITY INVOKER on purpose:
+-- it says nothing a member could not already learn about themselves.
+CREATE OR REPLACE FUNCTION public.service_caller_belongs(p_tenant uuid) RETURNS boolean
+LANGUAGE sql STABLE SET search_path TO ''
+AS $function$
+  SELECT p_tenant IN (SELECT public.user_tenant_ids());
+$function$;
+
+DO $$
+BEGIN
+  REVOKE ALL ON FUNCTION public.service_caller_belongs(uuid) FROM PUBLIC;
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'anon') THEN REVOKE ALL ON FUNCTION public.service_caller_belongs(uuid) FROM anon; END IF;
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated') THEN GRANT EXECUTE ON FUNCTION public.service_caller_belongs(uuid) TO authenticated; END IF;
+END $$;

package/migrations/213_the_service_reads_facts_and_rings_the_bell.sql

@@ -0,0 +1,143 @@
+-- ============================================================================
+-- 213_the_service_reads_facts_and_rings_the_bell — two doors for the
+-- Integration service, so a fact recorded here can reach a person through it.
+--
+-- ADR 0003: the database records what happened (event_log) and answers who may
+-- see what; the service decides who is TOLD, and how. The first user is the
+-- low-stock alert (plugin-inventory 031 records `inventory.stock_low`; the
+-- service turns it into a bell line for whoever can read the stock, and is
+-- where WhatsApp and e-mail join later).
+--
+-- event_log_for_service(keys, since, limit)
+--   The facts of the given keys recorded since a moment, oldest first. The
+--   service keeps its own receipt of what it handled and asks for a window
+--   rather than a cursor: a transaction that committed late can carry a
+--   created_at older than the newest fact already read, and a cursor would
+--   step over it.
+--
+-- notifications_ring_for_service(tenant, permission, unit, type, title, body,
+--                                link, subject_type, subject_id, at)
+--   One bell line per active member whose effective role holds `permission`
+--   (or the `.manage` of its family) for `unit` — the same rule as
+--   app._has_permission_raw, asked here for every member instead of re-made in
+--   the service. The unique index of 130 on (user, subject_type, subject_id,
+--   type) keeps one line per person per subject: a newer ring marks it unread
+--   and moves it up; replaying the same ring (same `at`) changes nothing. The
+--   bell is poked over realtime as the order bell does. Returns how many people
+--   the line reached.
+--
+-- Granted to the service's role only (and service_role). Replay-safe.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION public.event_log_for_service(
+  p_keys  text[],
+  p_since timestamptz,
+  p_limit integer DEFAULT 200
+)
+RETURNS TABLE (
+  id           uuid,
+  tenant_id    uuid,
+  event_key    text,
+  payload      jsonb,
+  subject_type text,
+  subject_id   text,
+  occurred_at  timestamptz,
+  created_at   timestamptz
+)
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path TO ''
+AS $function$
+  SELECT e.id, e.tenant_id, e.event_key, e.payload, e.subject_type, e.subject_id,
+         e.occurred_at, e.created_at
+    FROM public.event_log e
+   WHERE e.event_key = ANY (p_keys)
+     AND e.created_at >= p_since
+   ORDER BY e.created_at, e.id
+   LIMIT least(greatest(coalesce(p_limit, 200), 1), 1000);
+$function$;
+
+CREATE OR REPLACE FUNCTION public.notifications_ring_for_service(
+  p_tenant       uuid,
+  p_permission   text,
+  p_unit         uuid,
+  p_type         text,
+  p_title        text,
+  p_body         text,
+  p_link         text,
+  p_subject_type text,
+  p_subject_id   uuid,
+  p_at           timestamptz DEFAULT now()
+)
+RETURNS integer
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path TO ''
+AS $function$
+DECLARE
+  v_reached integer;
+BEGIN
+  IF p_tenant IS NULL OR coalesce(p_permission, '') = '' OR coalesce(p_type, '') = ''
+     OR coalesce(p_title, '') = '' OR p_subject_id IS NULL THEN
+    RAISE EXCEPTION 'notifications_ring_for_service: tenant, permission, type, title and subject are required'
+      USING ERRCODE = 'invalid_parameter_value';
+  END IF;
+
+  WITH recipients AS (
+    SELECT DISTINCT m.user_id
+      FROM app.memberships m
+     WHERE m.tenant_id = p_tenant AND m.active AND m.user_id IS NOT NULL
+       AND EXISTS (
+             SELECT 1 FROM app.role_permissions rp
+              WHERE rp.tenant_id = p_tenant
+                AND rp.role_id = app.effective_role_id(p_tenant, m.user_id, p_unit)
+                AND rp.permission IN (p_permission, regexp_replace(p_permission, '\.[^.]+$', '.manage')))
+  ), rung AS (
+    INSERT INTO public.notifications (tenant_id, user_id, title, body, type, link, subject_type, subject_id, created_at)
+    SELECT p_tenant, r.user_id, p_title, p_body, p_type, p_link, p_subject_type, p_subject_id, coalesce(p_at, now())
+      FROM recipients r
+    ON CONFLICT (user_id, subject_type, subject_id, type) WHERE subject_id IS NOT NULL
+    DO UPDATE SET read = false, created_at = EXCLUDED.created_at,
+                  title = EXCLUDED.title, body = EXCLUDED.body, link = EXCLUDED.link
+          WHERE public.notifications.created_at < EXCLUDED.created_at
+    RETURNING 1
+  )
+  SELECT count(*)::integer INTO v_reached FROM rung;
+
+  IF v_reached > 0 AND to_regproc('realtime.send') IS NOT NULL THEN
+    BEGIN
+      PERFORM realtime.send(
+        jsonb_build_object('type', p_type, 'subjectId', p_subject_id),
+        'notification',
+        -- Contract with `subscribeBell()` in packages/admin/src/lib/bell.ts.
+        'avisos:' || p_tenant::text,
+        false);
+    EXCEPTION WHEN OTHERS THEN
+      RAISE WARNING 'notifications_ring_for_service: realtime: %', SQLERRM;
+    END;
+  END IF;
+
+  RETURN v_reached;
+END;
+$function$;
+
+DO $$
+DECLARE
+  f text;
+BEGIN
+  FOREACH f IN ARRAY ARRAY[
+    'public.event_log_for_service(text[], timestamptz, integer)',
+    'public.notifications_ring_for_service(uuid, text, uuid, text, text, text, text, text, uuid, timestamptz)'
+  ] LOOP
+    EXECUTE format('REVOKE ALL ON FUNCTION %s FROM PUBLIC', f);
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'anon') THEN EXECUTE format('REVOKE ALL ON FUNCTION %s FROM anon', f); END IF;
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated') THEN EXECUTE format('REVOKE ALL ON FUNCTION %s FROM authenticated', f); END IF;
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'service_role') THEN EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO service_role', f); END IF;
+    -- The service's role, under its current name and the name it is moving to
+    -- (control_integration): granted to whichever exists, so this file is
+    -- right before and after the rename.
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'fayz_integration') THEN EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO fayz_integration', f); END IF;
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'control_integration') THEN EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO control_integration', f); END IF;
+  END LOOP;
+END $$;

package/package.json

@@ -3,7 +3,7 @@
   "fayz": {
     "status": "beta"
   },
-  "version": "0.24.2",
+  "version": "0.25.0",
   "description": "Fayz SDK database layer — Drizzle schema primitives, spine references, and migration helpers shared across plugins.",
   "type": "module",
   "sideEffects": false,