@fayz-ai/db 0.8.4 → 0.9.0-next.0

package/migrations/021_tenant_roles.sql

@@ -0,0 +1,74 @@
+-- ============================================================================
+-- 021_tenant_roles.sql — custom access profiles, per tenant.
+--
+-- The SDK has always been able to BUILD a custom role (duplicate a system role
+-- in Settings → Permissions, or ask the assistant for one), but the table it
+-- writes to never existed outside one legacy pool: `saas_core.tenant_roles`,
+-- swept into `public` by 0000b and created nowhere else. Everywhere else the
+-- insert threw and the screen swallowed it — a "Criar perfil" button that did
+-- nothing.
+--
+-- Two changes, both required for a custom profile to survive a reload:
+--
+--   1. public.tenant_roles — the role's IDENTITY (key + name). Its grants live
+--      in tenant_role_overrides, keyed by that same `key`.
+--
+--   2. tenant_role_overrides.permission_id loses its FK to public.permissions.
+--      That catalog is a legacy of DB-driven RBAC; the feature catalog is now
+--      DECLARED IN CODE by plugins (`declaredFeatures`) and merged at runtime,
+--      so an app can grant `crm.leads.read` on a pool whose permissions table
+--      never heard of plugin-crm. The FK made every such grant fail. The column
+--      stays text in `feature.action` form — the shape agent_guard reads.
+--
+-- Idempotent: safe to re-run, no-ops when already applied.
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS public.tenant_roles (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id uuid NOT NULL REFERENCES public.tenants(id) ON DELETE CASCADE,
+  -- Stable slug the grants and tenant_members.role point at. Renaming the
+  -- profile must never orphan its permissions, so the key is not the name.
+  key text NOT NULL,
+  name text NOT NULL,
+  description text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE(tenant_id, key)
+);
+
+ALTER TABLE public.tenant_roles ENABLE ROW LEVEL SECURITY;
+
+-- Members see their own tenant's roles (the permission screen lists them);
+-- only tenant admins create, rename or delete one.
+DROP POLICY IF EXISTS "tenant_roles_select" ON public.tenant_roles;
+CREATE POLICY "tenant_roles_select" ON public.tenant_roles FOR SELECT
+  USING (tenant_id IN (SELECT tenant_id FROM public.tenant_members WHERE user_id = auth.uid()));
+
+DROP POLICY IF EXISTS "tenant_roles_manage" ON public.tenant_roles;
+CREATE POLICY "tenant_roles_manage" ON public.tenant_roles FOR ALL
+  USING (public.is_tenant_admin(tenant_id));
+
+GRANT ALL ON public.tenant_roles TO authenticated, service_role;
+
+-- The FK, dropped by lookup rather than by name: pools created before the
+-- rename carry the constraint under whatever name Postgres minted.
+DO $$
+DECLARE
+  c record;
+BEGIN
+  IF to_regclass('public.tenant_role_overrides') IS NULL THEN
+    RETURN;
+  END IF;
+  FOR c IN
+    SELECT con.conname
+    FROM pg_constraint con
+    JOIN pg_class rel ON rel.oid = con.conrelid
+    JOIN pg_namespace nsp ON nsp.oid = rel.relnamespace
+    JOIN pg_class frel ON frel.oid = con.confrelid
+    WHERE nsp.nspname = 'public'
+      AND rel.relname = 'tenant_role_overrides'
+      AND con.contype = 'f'
+      AND frel.relname = 'permissions'
+  LOOP
+    EXECUTE format('ALTER TABLE public.tenant_role_overrides DROP CONSTRAINT %I', c.conname);
+  END LOOP;
+END $$;

package/package.json

@@ -3,9 +3,10 @@
   "fayz": {
     "status": "beta"
   },
-  "version": "0.8.4",
+  "version": "0.9.0-next.0",
   "description": "Fayz SDK database layer — Drizzle schema primitives, spine references, and migration helpers shared across plugins.",
   "type": "module",
+  "sideEffects": false,
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -37,6 +38,7 @@
     "database",
     "schema"
   ],
+  "peerDependencies": {},
   "scripts": {
     "build": "tsup && tsc --emitDeclarationOnly --declaration --declarationMap --noEmit false",
     "dev": "tsup --watch",