@fayz-ai/db 0.8.3 → 0.9.0-next.0

package/migrations/020_fayz_projects.sql

@@ -0,0 +1,63 @@
+-- 020_fayz_projects.sql — tenant ↔ fayz project association
+-- ----------------------------------------------------------------------------
+-- Almost every tenant owns one or more "fayz projects": deployed sites/apps on
+-- the fayz platform, each addressed by a platform projectId. A tenant's client
+-- site (exposed on the web by fayz) is one such project; an e-commerce client's
+-- site is a project with the storefront module active — i.e. a sales channel.
+--
+-- This table lives in the CLIENT pool (e.g. cluster-ecommerce) and gives the
+-- admin SDK apps a mature link: admin app ↔ tenant ↔ fayz project. It drives the
+-- "Seu site" widget in the sidebar (open preview / open editor), the Loja Online
+-- sales channel (= the storefront project), and Marketing landing-page links.
+--
+-- No platform integration yet: rows are maintained by the admin (manual CRUD),
+-- and the preview/editor URLs are stored explicitly (there is no URL convention
+-- in code and the platform domains are still undecided). A future platform sync
+-- can populate fayz_project_id + URLs automatically.
+--
+-- Additive + idempotent (CREATE TABLE IF NOT EXISTS).
+
+CREATE TABLE IF NOT EXISTS public.fayz_projects (
+  id                 uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id          uuid NOT NULL,
+  -- The fayz platform project id (addresses /public/projects/{id}/…). Text
+  -- because the platform issues its own ids; nullable until provisioned.
+  fayz_project_id    text,
+  -- App manifest id of the deployed app (e.g. 'artorious-shop'), when known.
+  app_id             text,
+  name               text NOT NULL,
+  -- site | storefront | landing_page | other
+  kind               text NOT NULL DEFAULT 'site',
+  -- The tenant's default site (the one the "Seu site" widget shows). Partial
+  -- unique index below keeps at most one default per tenant.
+  is_default         boolean NOT NULL DEFAULT false,
+  -- Whether the storefront module is active on this site. A storefront-enabled
+  -- site is an e-commerce sales channel (the Loja Online channel).
+  storefront_enabled boolean NOT NULL DEFAULT false,
+  -- Explicit public URLs. preview_url = the live/preview site; editor_url = the
+  -- fayz editor (/fayz/editor). Stored, not derived (no convention in code yet).
+  preview_url        text,
+  editor_url         text,
+  slug               text,
+  metadata           jsonb NOT NULL DEFAULT '{}',
+  created_at         timestamptz NOT NULL DEFAULT now(),
+  updated_at         timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS fayz_projects_tenant_idx ON public.fayz_projects (tenant_id);
+-- At most one default project per tenant.
+CREATE UNIQUE INDEX IF NOT EXISTS fayz_projects_one_default_per_tenant
+  ON public.fayz_projects (tenant_id) WHERE is_default;
+
+DROP TRIGGER IF EXISTS fayz_projects_updated_at ON public.fayz_projects;
+CREATE TRIGGER fayz_projects_updated_at BEFORE UPDATE ON public.fayz_projects
+  FOR EACH ROW EXECUTE FUNCTION public.handle_updated_at();
+
+ALTER TABLE public.fayz_projects ENABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS "fayz_projects_member_all" ON public.fayz_projects;
+CREATE POLICY "fayz_projects_member_all" ON public.fayz_projects FOR ALL TO authenticated
+  USING (tenant_id IN (SELECT public.user_tenant_ids()))
+  WITH CHECK (tenant_id IN (SELECT public.user_tenant_ids()));
+
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.fayz_projects TO authenticated, service_role;

package/migrations/021_tenant_roles.sql

@@ -0,0 +1,74 @@
+-- ============================================================================
+-- 021_tenant_roles.sql — custom access profiles, per tenant.
+--
+-- The SDK has always been able to BUILD a custom role (duplicate a system role
+-- in Settings → Permissions, or ask the assistant for one), but the table it
+-- writes to never existed outside one legacy pool: `saas_core.tenant_roles`,
+-- swept into `public` by 0000b and created nowhere else. Everywhere else the
+-- insert threw and the screen swallowed it — a "Criar perfil" button that did
+-- nothing.
+--
+-- Two changes, both required for a custom profile to survive a reload:
+--
+--   1. public.tenant_roles — the role's IDENTITY (key + name). Its grants live
+--      in tenant_role_overrides, keyed by that same `key`.
+--
+--   2. tenant_role_overrides.permission_id loses its FK to public.permissions.
+--      That catalog is a legacy of DB-driven RBAC; the feature catalog is now
+--      DECLARED IN CODE by plugins (`declaredFeatures`) and merged at runtime,
+--      so an app can grant `crm.leads.read` on a pool whose permissions table
+--      never heard of plugin-crm. The FK made every such grant fail. The column
+--      stays text in `feature.action` form — the shape agent_guard reads.
+--
+-- Idempotent: safe to re-run, no-ops when already applied.
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS public.tenant_roles (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  -- Stable slug the grants and tenant_members.role point at. Renaming the
+  -- profile must never orphan its permissions, so the key is not the name.
+  key text NOT NULL,
+  name text NOT NULL,
+  description text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE(tenant_id, key)
+);
+
+ALTER TABLE public.tenant_roles ENABLE ROW LEVEL SECURITY;
+
+-- Members see their own tenant's roles (the permission screen lists them);
+-- only tenant admins create, rename or delete one.
+DROP POLICY IF EXISTS "tenant_roles_select" ON public.tenant_roles;
+CREATE POLICY "tenant_roles_select" ON public.tenant_roles FOR SELECT
+  USING (tenant_id IN (SELECT tenant_id FROM public.tenant_members WHERE user_id = auth.uid()));
+
+DROP POLICY IF EXISTS "tenant_roles_manage" ON public.tenant_roles;
+CREATE POLICY "tenant_roles_manage" ON public.tenant_roles FOR ALL
+  USING (public.is_tenant_admin(tenant_id));
+
+GRANT ALL ON public.tenant_roles TO authenticated, service_role;
+
+-- The FK, dropped by lookup rather than by name: pools created before the
+-- rename carry the constraint under whatever name Postgres minted.
+DO $$
+DECLARE
+  c record;
+BEGIN
+  IF to_regclass('public.tenant_role_overrides') IS NULL THEN
+    RETURN;
+  END IF;
+  FOR c IN
+    SELECT con.conname
+    FROM pg_constraint con
+    JOIN pg_class rel ON rel.oid = con.conrelid
+    JOIN pg_namespace nsp ON nsp.oid = rel.relnamespace
+    JOIN pg_class frel ON frel.oid = con.confrelid
+    WHERE nsp.nspname = 'public'
+      AND rel.relname = 'tenant_role_overrides'
+      AND con.contype = 'f'
+      AND frel.relname = 'permissions'
+  LOOP
+    EXECUTE format('ALTER TABLE public.tenant_role_overrides DROP CONSTRAINT %I', c.conname);
+  END LOOP;
+END $$;

package/package.json

@@ -3,9 +3,10 @@
   "fayz": {
     "status": "beta"
   },
-  "version": "0.8.3",
+  "version": "0.9.0-next.0",
   "description": "Fayz SDK database layer — Drizzle schema primitives, spine references, and migration helpers shared across plugins.",
   "type": "module",
+  "sideEffects": false,
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -37,6 +38,7 @@
     "database",
     "schema"
   ],
+  "peerDependencies": {},
   "scripts": {
     "build": "tsup && tsc --emitDeclarationOnly --declaration --declarationMap --noEmit false",
     "dev": "tsup --watch",