@kontrolia/db 1.1.0 → 2.0.0

package/README.md

@@ -1,9 +1,9 @@
 # @kontrolia/db
 
-Migraciones SQL del schema `kontrolia` (organizaciones, RBAC jerárquico, invitaciones, dispositivos, audit log) y el Custom Access Token Hook que enriquece el JWT con `organization_id`, `roles` y `permissions` de la organización activa del usuario.
+Migraciones SQL del schema `kontrolia_auth` (organizaciones, RBAC jerárquico, invitaciones, dispositivos, audit log) y el Custom Access Token Hook que enriquece el JWT con `organization_id`, `roles` y `permissions` de la organización activa del usuario.
 
 Diseñado para aplicarse igual sobre:
-- un proyecto Supabase **existente** (Cloud o self-hosted) — solo aísla sus tablas en el schema `kontrolia`, no toca `public`;
+- un proyecto Supabase **existente** (Cloud o self-hosted) — solo aísla sus tablas en el schema `kontrolia_auth`, no toca `public`;
 - un proyecto Supabase **nuevo** levantado localmente por `docker/docker-compose.yml`.
 
 ## Uso
@@ -14,5 +14,5 @@ DATABASE_URL="postgres://postgres:postgres@localhost:5432/postgres" pnpm --filte
 
 ## Activar el hook
 
-- **Self-hosted**: variable de entorno de GoTrue `GOTRUE_HOOK_CUSTOM_ACCESS_TOKEN_URI=pg-functions://postgres/kontrolia/custom_access_token_hook` (ver `docker/docker-compose.yml`).
-- **Supabase Cloud**: paso manual en el Dashboard → Authentication → Hooks → Custom Access Token → seleccionar `kontrolia.custom_access_token_hook`. No automatizable por API pública.
+- **Self-hosted**: variable de entorno de GoTrue `GOTRUE_HOOK_CUSTOM_ACCESS_TOKEN_URI=pg-functions://postgres/kontrolia_auth/custom_access_token_hook` (ver `docker/docker-compose.yml`).
+- **Supabase Cloud**: paso manual en el Dashboard → Authentication → Hooks → Custom Access Token → seleccionar `kontrolia_auth.custom_access_token_hook`. No automatizable por API pública.

package/dist/api-key.d.ts

@@ -1,5 +1,5 @@
 /** Generates a new plaintext application sync API key. Shown once, never stored. */
 export declare function generateApplicationApiKey(): string;
-/** sha256 hex digest — what actually gets stored in kontrolia.applications.api_key_hash. */
+/** sha256 hex digest — what actually gets stored in kontrolia_auth.applications.api_key_hash. */
 export declare function hashApplicationApiKey(plaintext: string): string;
 //# sourceMappingURL=api-key.d.ts.map

package/dist/api-key.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-key.d.ts","sourceRoot":"","sources":["../src/api-key.ts"],"names":[],"mappings":"AAIA,oFAAoF;AACpF,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,4FAA4F;AAC5F,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/D"}
+{"version":3,"file":"api-key.d.ts","sourceRoot":"","sources":["../src/api-key.ts"],"names":[],"mappings":"AAIA,oFAAoF;AACpF,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,iGAAiG;AACjG,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/D"}

package/dist/api-key.js

@@ -4,7 +4,7 @@ const API_KEY_PREFIX = "kapp_";
 export function generateApplicationApiKey() {
     return `${API_KEY_PREFIX}${randomBytes(24).toString("base64url")}`;
 }
-/** sha256 hex digest — what actually gets stored in kontrolia.applications.api_key_hash. */
+/** sha256 hex digest — what actually gets stored in kontrolia_auth.applications.api_key_hash. */
 export function hashApplicationApiKey(plaintext) {
     return createHash("sha256").update(plaintext).digest("hex");
 }

package/dist/migrate.d.ts

@@ -1,7 +1,7 @@
 export interface MigrateOptions {
     /** Postgres connection string. Works against a fresh self-hosted instance
      * or an existing Supabase project (Cloud or self-hosted) — the migrations
-     * only ever touch the `kontrolia` schema. */
+     * only ever touch the `kontrolia_auth` schema. */
     connectionString: string;
     /** Print each statement before running it. */
     verbose?: boolean;

package/dist/migrate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../src/migrate.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,cAAc;IAC7B;;iDAE6C;IAC7C,gBAAgB,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAWD;;;GAGG;AACH,wBAAsB,OAAO,CAAC,EAAE,gBAAgB,EAAE,OAAe,EAAE,EAAE,cAAc,iBAgClF"}
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../src/migrate.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,cAAc;IAC7B;;sDAEkD;IAClD,gBAAgB,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAWD;;;GAGG;AACH,wBAAsB,OAAO,CAAC,EAAE,gBAAgB,EAAE,OAAe,EAAE,EAAE,cAAc,iBAgClF"}

package/dist/register-application.d.ts

@@ -25,7 +25,7 @@ export interface RegisteredApplication {
 }
 /**
  * Inserts an application and its permission catalog directly against
- * Postgres. kontrolia.applications/permissions have no insert policy for
+ * Postgres. kontrolia_auth.applications/permissions have no insert policy for
  * regular users (see migrations/0010_rls_policies.sql — writes are meant to
  * go through a platform-admin path), so this is that path: a direct,
  * service-role-equivalent write, the same way migrate() bypasses RLS to

package/dist/register-application.js

@@ -2,7 +2,7 @@ import { Client } from "pg";
 import { generateApplicationApiKey, hashApplicationApiKey } from "./api-key.js";
 /**
  * Inserts an application and its permission catalog directly against
- * Postgres. kontrolia.applications/permissions have no insert policy for
+ * Postgres. kontrolia_auth.applications/permissions have no insert policy for
  * regular users (see migrations/0010_rls_policies.sql — writes are meant to
  * go through a platform-admin path), so this is that path: a direct,
  * service-role-equivalent write, the same way migrate() bypasses RLS to
@@ -14,7 +14,7 @@ export async function registerApplication(options) {
     await client.connect();
     try {
         const candidateApiKey = generateApplicationApiKey();
-        const { rows: [application], } = await client.query(`insert into kontrolia.applications (name, slug, environment, api_key_hash)
+        const { rows: [application], } = await client.query(`insert into kontrolia_auth.applications (name, slug, environment, api_key_hash)
        values ($1, $2, $3, $4)
        on conflict (slug) do update set name = excluded.name, environment = excluded.environment
        returning id, (xmax = 0) as inserted`, [options.name, options.slug, options.environment, hashApplicationApiKey(candidateApiKey)]);
@@ -23,7 +23,7 @@ export async function registerApplication(options) {
         const permissionKeys = [];
         for (const permission of options.permissions) {
             const key = `${options.slug}.${permission.resource}.${permission.action}`;
-            await client.query(`insert into kontrolia.permissions (application_id, resource, action, key, description)
+            await client.query(`insert into kontrolia_auth.permissions (application_id, resource, action, key, description)
          values ($1, $2, $3, $4, $5)
          on conflict (key) do update set description = excluded.description`, [application.id, permission.resource, permission.action, key, permission.description ?? null]);
             permissionKeys.push(key);

package/migrations/0016_platform_admins.sql

@@ -0,0 +1,117 @@
+-- A "platform admin" needs to see across every organization (support/ops
+-- consoles, cross-tenant monitoring) — something the rest of the model
+-- deliberately can't do, since roles/permissions are always scoped to one
+-- active organization at a time (see custom_access_token_hook). Rather than
+-- have every app invent its own "<app>.admin.ver_todo" escape hatch, this
+-- is one reserved claim outside the app-permission-key namespace, backed by
+-- its own table so it's a single source of truth across the whole install.
+--
+-- No self-service UI/API for granting this on purpose — same "manual step
+-- for now" pattern as application_organizations enablement. Grant with:
+--   insert into kontrolia.platform_admins (user_id) values ('<user-uuid>');
+
+create table kontrolia.platform_admins (
+  user_id uuid primary key references auth.users (id) on delete cascade,
+  granted_by uuid references auth.users (id) on delete set null,
+  granted_at timestamptz not null default now()
+);
+
+comment on table kontrolia.platform_admins is 'Users who can see across every organization — a single reserved claim (is_platform_admin), not an app-defined permission. Granted by inserting directly, no UI yet.';
+
+alter table kontrolia.platform_admins enable row level security;
+
+-- Only platform admins can even see who else is one — nobody self-grants
+-- via RLS (writes require direct database access, same as this table's own
+-- comment says).
+create policy "platform admins can view the platform admin list" on kontrolia.platform_admins
+  for select using (exists (select 1 from kontrolia.platform_admins pa where pa.user_id = auth.uid()));
+
+grant select on kontrolia.platform_admins to authenticated;
+
+create or replace function kontrolia.custom_access_token_hook(event jsonb)
+returns jsonb
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  claims jsonb;
+  target_user_id uuid;
+  active_org_id uuid;
+  active_membership_id uuid;
+  role_names text[];
+  permission_keys text[];
+  platform_admin boolean;
+begin
+  claims := coalesce(event->'claims', '{}'::jsonb);
+  target_user_id := (event->>'user_id')::uuid;
+
+  select exists(select 1 from kontrolia.platform_admins where user_id = target_user_id) into platform_admin;
+
+  select active_organization_id into active_org_id
+  from kontrolia.sessions_context
+  where user_id = target_user_id;
+
+  if active_org_id is null then
+    select organization_id into active_org_id
+    from kontrolia.memberships
+    where user_id = target_user_id and status = 'active'
+    order by created_at asc
+    limit 1;
+  end if;
+
+  if active_org_id is not null then
+    select id into active_membership_id
+    from kontrolia.memberships
+    where user_id = target_user_id
+      and organization_id = active_org_id
+      and status = 'active';
+  end if;
+
+  if active_membership_id is not null then
+    select coalesce(array_agg(distinct r.slug), '{}')
+      into role_names
+    from kontrolia.membership_roles mr
+    join kontrolia.roles r on r.id = mr.role_id
+    where mr.membership_id = active_membership_id;
+
+    select coalesce(array_agg(distinct p.key), '{}')
+      into permission_keys
+    from (
+      select p.id, p.key
+      from kontrolia.membership_roles mr
+      join kontrolia.role_permissions rp on rp.role_id = mr.role_id
+      join kontrolia.permissions p on p.id = rp.permission_id
+      where mr.membership_id = active_membership_id
+      union
+      select p.id, p.key
+      from kontrolia.user_permissions up
+      join kontrolia.permissions p on p.id = up.permission_id
+      where up.membership_id = active_membership_id and up.effect = 'allow'
+    ) p
+    where not exists (
+      select 1 from kontrolia.user_permissions up_deny
+      where up_deny.membership_id = active_membership_id
+        and up_deny.permission_id = p.id
+        and up_deny.effect = 'deny'
+    );
+  else
+    role_names := '{}';
+    permission_keys := '{}';
+  end if;
+
+  -- to_jsonb(NULL::uuid) is SQL NULL, not a jsonb null — and jsonb_set is
+  -- strict, so passing it straight through would collapse the whole
+  -- function's result to NULL for any user without an organization yet
+  -- (i.e. every brand-new signup). coalesce() converts that to a real
+  -- jsonb null instead.
+  claims := jsonb_set(claims, '{organization_id}', coalesce(to_jsonb(active_org_id), 'null'::jsonb));
+  claims := jsonb_set(claims, '{roles}', to_jsonb(coalesce(role_names, '{}')));
+  claims := jsonb_set(claims, '{permissions}', to_jsonb(coalesce(permission_keys, '{}')));
+  claims := jsonb_set(claims, '{is_platform_admin}', to_jsonb(coalesce(platform_admin, false)));
+
+  event := jsonb_set(event, '{claims}', claims);
+  return event;
+end;
+$$;

package/migrations/0017_bootstrap_first_platform_admin.sql

@@ -0,0 +1,35 @@
+-- Closes the platform-admin bootstrapping problem: /oauth-clients and any
+-- future platform-admin-only screen are useless on a fresh install if
+-- granting the very first one requires direct database access — exactly
+-- the kind of step this product is supposed to eliminate for non-technical
+-- operators. Same idea as kontrolia.handle_new_organization() (the creator
+-- of the first organization becomes its Owner automatically): the very
+-- first user of a fresh installation becomes its first platform admin
+-- automatically, regardless of how they signed up (password, Google,
+-- Microsoft — this fires on auth.users itself, not any one auth method).
+--
+-- Guarded by two conditions together, not just "platform_admins is empty":
+-- if the sole platform admin is later revoked, this must NOT silently hand
+-- the role to whoever happens to sign up next on an otherwise-live
+-- installation. Checking auth.users count = 1 pins this to a genuinely
+-- fresh install — it can only ever fire once, on the very first signup.
+
+create or replace function kontrolia.bootstrap_first_platform_admin()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if not exists (select 1 from kontrolia.platform_admins limit 1)
+     and (select count(*) from auth.users) = 1 then
+    insert into kontrolia.platform_admins (user_id) values (new.id);
+  end if;
+  return new;
+end;
+$$;
+
+create trigger on_first_user_created
+  after insert on auth.users
+  for each row
+  execute function kontrolia.bootstrap_first_platform_admin();

package/migrations/0018_org_admins_manage_applications.sql

@@ -0,0 +1,25 @@
+-- Closes a real gap: kontrolia.application_organizations had a SELECT
+-- policy but nothing let anyone actually enable an application for their
+-- organization — the wizard/API registers an application globally, but
+-- nothing ever connected it to an org, so Aplicaciones/Permisos/Roles all
+-- stayed empty even after registering a real application. Enabling an app
+-- for your org is an org-level decision (same model as installing a Slack
+-- app into your workspace), so this is org-admin self-service, not
+-- platform-admin gated.
+--
+-- Also widens who can even see the application *catalog*: the original
+-- applications SELECT policy only showed a row once it was already enabled
+-- for one of your orgs — a chicken-and-egg problem for browsing what's
+-- available to enable in the first place. Nothing in the catalog itself is
+-- per-org secret data, so any authenticated user can browse it now; what's
+-- still gated is enabling one for a specific organization.
+
+drop policy if exists "anyone can view applications enabled for their org" on kontrolia.applications;
+
+create policy "authenticated users can browse the application catalog" on kontrolia.applications
+  for select to authenticated using (true);
+
+create policy "org admins enable/disable applications for their org" on kontrolia.application_organizations
+  for all
+  using (kontrolia.is_org_admin(organization_id))
+  with check (kontrolia.is_org_admin(organization_id));

package/migrations/0019_app_scoped_custom_roles.sql

@@ -0,0 +1,194 @@
+-- Custom roles now belong to exactly one application, so each app can define
+-- its own catalog of roles (e.g. "Facturación → Contador") instead of one
+-- role potentially spanning several unrelated apps. The 3 global system
+-- roles (Owner/Admin/Member) are untouched — they stay organization-wide,
+-- shared, and immutable exactly as before.
+--
+-- Enabling an application for an org now also auto-creates an "Administrador
+-- de <app>" role scoped to that (org, app) pair, holding every permission the
+-- app currently declares. Its permissions are never toggled by hand — a
+-- trigger keeps it in sync whenever the app registers a new permission, so it
+-- never drifts out of date the way a manually-curated role would.
+
+alter table kontrolia.roles
+  add column application_id uuid references kontrolia.applications (id) on delete cascade,
+  add column grants_all_permissions boolean not null default false;
+
+-- One unused test role predates this constraint and can't be backfilled
+-- (zero permissions, zero members, and its organization has no application
+-- enabled to infer one from) — safe to drop.
+delete from kontrolia.roles
+where slug = 'facturacion-solo-lectura' and organization_id is not null and not is_system_role
+  and not exists (select 1 from kontrolia.role_permissions rp where rp.role_id = roles.id)
+  and not exists (select 1 from kontrolia.membership_roles mr where mr.role_id = roles.id);
+
+-- The other pre-existing custom role already only references one
+-- application's permissions — infer application_id from that.
+update kontrolia.roles r
+set application_id = inferred.application_id
+from (
+  select rp.role_id, p.application_id
+  from kontrolia.role_permissions rp
+  join kontrolia.permissions p on p.id = rp.permission_id
+  group by rp.role_id, p.application_id
+  having count(distinct p.application_id) = 1
+) inferred
+where inferred.role_id = r.id and r.application_id is null and r.organization_id is not null and not r.is_system_role;
+
+-- A custom (non-system) role now must belong to one application. The 3
+-- global system roles (organization_id null) and any future org-wide system
+-- role are exempt. Added after the cleanup/backfill above so it only ever
+-- validates the steady state.
+alter table kontrolia.roles
+  add constraint roles_custom_roles_require_application
+  check (organization_id is null or is_system_role or application_id is not null);
+
+-- roles: reopen browsing (already true for applications, mirror it here so
+-- picking an application for a new custom role can list its permission
+-- count) and require an application on insert, matching the constraint
+-- above; system roles (including the auto-created "Administrador de <app>")
+-- can never be renamed or deleted through the API.
+drop policy if exists "org admins can manage custom roles" on kontrolia.roles;
+create policy "org admins can create app-scoped custom roles" on kontrolia.roles
+  for insert to authenticated
+  with check (
+    organization_id is not null and application_id is not null and not is_system_role
+    and kontrolia.is_org_admin(organization_id)
+    and exists (
+      select 1 from kontrolia.application_organizations ao
+      where ao.organization_id = roles.organization_id and ao.application_id = roles.application_id
+    )
+  );
+
+drop policy if exists "org admins can update custom roles" on kontrolia.roles;
+create policy "org admins can update custom roles" on kontrolia.roles
+  for update using (organization_id is not null and not is_system_role and kontrolia.is_org_admin(organization_id));
+
+drop policy if exists "org admins can delete custom roles" on kontrolia.roles;
+create policy "org admins can delete custom roles" on kontrolia.roles
+  for delete using (organization_id is not null and not is_system_role and kontrolia.is_org_admin(organization_id));
+
+-- role_permissions: "Administrador de <app>" roles are excluded from manual
+-- writes — their permission set is only ever changed by the sync trigger
+-- below, so hand-editing them would just get overwritten on the next catalog
+-- sync anyway.
+drop policy if exists "org admins manage role permissions" on kontrolia.role_permissions;
+create policy "org admins manage role permissions" on kontrolia.role_permissions
+  for all using (
+    exists (
+      select 1 from kontrolia.roles r
+      where r.id = role_id and r.organization_id is not null and not r.grants_all_permissions
+        and kontrolia.is_org_admin(r.organization_id)
+    )
+  );
+
+-- Auto-create the "Administrador de <app>" role (+ its full permission set)
+-- whenever an application gets enabled for an organization.
+create or replace function kontrolia.handle_application_enabled()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  app_name text;
+  app_slug text;
+  new_role_id uuid;
+begin
+  select name, slug into app_name, app_slug from kontrolia.applications where id = new.application_id;
+
+  insert into kontrolia.roles (organization_id, application_id, name, slug, is_system_role, grants_all_permissions)
+  values (new.organization_id, new.application_id, 'Administrador de ' || app_name, 'admin-' || app_slug, true, true)
+  on conflict (organization_id, slug) do nothing
+  returning id into new_role_id;
+
+  if new_role_id is not null then
+    insert into kontrolia.role_permissions (role_id, permission_id)
+    select new_role_id, p.id from kontrolia.permissions p where p.application_id = new.application_id;
+  end if;
+
+  return new;
+end;
+$$;
+
+drop trigger if exists on_application_enabled on kontrolia.application_organizations;
+create trigger on_application_enabled
+  after insert on kontrolia.application_organizations
+  for each row
+  execute function kontrolia.handle_application_enabled();
+
+-- Backfill: create the "Administrador de <app>" role for every
+-- (org, application) pair that was already enabled before this migration.
+insert into kontrolia.roles (organization_id, application_id, name, slug, is_system_role, grants_all_permissions)
+select ao.organization_id, ao.application_id, 'Administrador de ' || a.name, 'admin-' || a.slug, true, true
+from kontrolia.application_organizations ao
+join kontrolia.applications a on a.id = ao.application_id
+on conflict (organization_id, slug) do nothing;
+
+insert into kontrolia.role_permissions (role_id, permission_id)
+select r.id, p.id
+from kontrolia.roles r
+join kontrolia.permissions p on p.application_id = r.application_id
+where r.grants_all_permissions
+on conflict do nothing;
+
+-- Keep every "Administrador de <app>" role in sync automatically whenever
+-- the app declares a new permission (e.g. its next deploy syncs a new
+-- resource.action pair) — nobody should have to remember to go re-grant it.
+create or replace function kontrolia.handle_permission_added()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  insert into kontrolia.role_permissions (role_id, permission_id)
+  select r.id, new.id
+  from kontrolia.roles r
+  where r.application_id = new.application_id and r.grants_all_permissions
+  on conflict do nothing;
+  return new;
+end;
+$$;
+
+drop trigger if exists on_permission_added on kontrolia.permissions;
+create trigger on_permission_added
+  after insert on kontrolia.permissions
+  for each row
+  execute function kontrolia.handle_permission_added();
+
+-- A membership can hold at most one role per application (org-wide system
+-- roles are exempt — a user is always exactly one of Owner/Admin/Member,
+-- plus at most one role per app they've been granted access to).
+create or replace function kontrolia.enforce_one_role_per_application()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  target_app_id uuid;
+  conflict_count int;
+begin
+  select application_id into target_app_id from kontrolia.roles where id = new.role_id;
+
+  if target_app_id is not null then
+    select count(*) into conflict_count
+    from kontrolia.membership_roles mr
+    join kontrolia.roles r on r.id = mr.role_id
+    where mr.membership_id = new.membership_id and r.application_id = target_app_id and mr.role_id <> new.role_id;
+
+    if conflict_count > 0 then
+      raise exception 'Este usuario ya tiene un rol asignado para esta aplicación. Quita el rol anterior antes de asignar uno nuevo.';
+    end if;
+  end if;
+
+  return new;
+end;
+$$;
+
+drop trigger if exists before_membership_role_insert on kontrolia.membership_roles;
+create trigger before_membership_role_insert
+  before insert on kontrolia.membership_roles
+  for each row
+  execute function kontrolia.enforce_one_role_per_application();

package/migrations/0020_rename_schema_to_kontrolia_auth.sql

@@ -0,0 +1,379 @@
+-- Renames the schema from kontrolia to kontrolia_auth. ALTER SCHEMA RENAME
+-- moves every table/function/trigger/policy/grant along with it — object
+-- identities (OIDs) don't change, so RLS policies, views, CHECK constraints,
+-- foreign keys and grants (all of which Postgres compiles to OID references
+-- at creation time) keep working untouched.
+--
+-- The one thing that does NOT survive a schema rename automatically: a
+-- plpgsql/sql function's own BODY is stored as literal source text and
+-- re-resolves every identifier by name each time it runs — so every
+-- function below that references another kontrolia.<object> internally has
+-- to be redefined with the new schema name, or it starts raising "schema
+-- kontrolia does not exist" the next time it's called. Verified empirically
+-- against a throwaway transaction before writing this migration: RLS
+-- policies survive unmodified, function bodies do not.
+
+alter schema kontrolia rename to kontrolia_auth;
+
+-- packages/db/migrations/0009_helper_functions.sql
+create or replace function kontrolia_auth.is_org_member(org_id uuid)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select exists (
+    select 1 from kontrolia_auth.memberships m
+    where m.organization_id = org_id
+      and m.user_id = auth.uid()
+      and m.status = 'active'
+  );
+$$;
+
+create or replace function kontrolia_auth.is_org_admin(org_id uuid)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select exists (
+    select 1
+    from kontrolia_auth.memberships m
+    join kontrolia_auth.membership_roles mr on mr.membership_id = m.id
+    join kontrolia_auth.roles r on r.id = mr.role_id
+    where m.organization_id = org_id
+      and m.user_id = auth.uid()
+      and m.status = 'active'
+      and r.slug in ('owner', 'admin')
+  );
+$$;
+
+grant execute on function kontrolia_auth.is_org_member(uuid) to authenticated;
+grant execute on function kontrolia_auth.is_org_admin(uuid) to authenticated;
+
+-- packages/db/migrations/0011_org_owner_bootstrap_trigger.sql
+create or replace function kontrolia_auth.handle_new_organization()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  owner_role_id uuid;
+  new_membership_id uuid;
+begin
+  select id into owner_role_id from kontrolia_auth.roles where slug = 'owner' and organization_id is null;
+
+  insert into kontrolia_auth.memberships (user_id, organization_id, status)
+  values (auth.uid(), new.id, 'active')
+  returning id into new_membership_id;
+
+  insert into kontrolia_auth.membership_roles (membership_id, role_id)
+  values (new_membership_id, owner_role_id);
+
+  return new;
+end;
+$$;
+
+-- packages/db/migrations/0012_devices_and_session_revoke.sql
+create or replace function kontrolia_auth.revoke_session(target_session_id uuid)
+returns void
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if not exists (
+    select 1 from kontrolia_auth.devices
+    where session_id = target_session_id and user_id = auth.uid()
+  ) then
+    raise exception 'not authorized to revoke this session';
+  end if;
+
+  delete from auth.sessions where id = target_session_id;
+  delete from kontrolia_auth.devices where session_id = target_session_id;
+end;
+$$;
+
+grant execute on function kontrolia_auth.revoke_session(uuid) to authenticated;
+revoke execute on function kontrolia_auth.revoke_session(uuid) from anon, public;
+
+-- packages/db/migrations/0013_audit_log_triggers.sql
+create or replace function kontrolia_auth.log_organization_created()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+  values (new.id, auth.uid(), 'organization.created', 'organization', new.id::text, jsonb_build_object('name', new.name, 'slug', new.slug));
+  return new;
+end;
+$$;
+
+create or replace function kontrolia_auth.log_membership_change()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if tg_op = 'INSERT' then
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (new.organization_id, coalesce(auth.uid(), new.user_id), 'membership.created', 'membership', new.id::text, jsonb_build_object('user_id', new.user_id, 'status', new.status));
+    return new;
+  else
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (old.organization_id, auth.uid(), 'membership.removed', 'membership', old.id::text, jsonb_build_object('user_id', old.user_id));
+    return old;
+  end if;
+end;
+$$;
+
+create or replace function kontrolia_auth.log_invitation_created()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+  values (new.organization_id, auth.uid(), 'invitation.created', 'invitation', new.id::text, jsonb_build_object('email', new.email));
+  return new;
+end;
+$$;
+
+create or replace function kontrolia_auth.log_invitation_accepted()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if old.accepted_at is null and new.accepted_at is not null then
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (new.organization_id, auth.uid(), 'invitation.accepted', 'invitation', new.id::text, jsonb_build_object('email', new.email));
+  end if;
+  return new;
+end;
+$$;
+
+create or replace function kontrolia_auth.log_role_assignment_change()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  target_membership record;
+begin
+  select organization_id, user_id into target_membership
+  from kontrolia_auth.memberships
+  where id = coalesce(new.membership_id, old.membership_id);
+
+  if tg_op = 'INSERT' then
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (target_membership.organization_id, coalesce(auth.uid(), target_membership.user_id), 'role.assigned', 'membership_role', new.membership_id::text, jsonb_build_object('role_id', new.role_id));
+    return new;
+  else
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (target_membership.organization_id, auth.uid(), 'role.unassigned', 'membership_role', old.membership_id::text, jsonb_build_object('role_id', old.role_id));
+    return old;
+  end if;
+end;
+$$;
+
+-- packages/db/migrations/0014_fix_device_revoked_actor_fk.sql (latest version of log_device_revoked)
+create or replace function kontrolia_auth.log_device_revoked()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  fallback_actor uuid;
+begin
+  select id into fallback_actor from auth.users where id = old.user_id;
+
+  insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+  values (null, coalesce(auth.uid(), fallback_actor), 'device.revoked', 'device', old.session_id::text, jsonb_build_object('label', old.label));
+  return old;
+end;
+$$;
+
+-- packages/db/migrations/0016_platform_admins.sql (latest version of custom_access_token_hook)
+create or replace function kontrolia_auth.custom_access_token_hook(event jsonb)
+returns jsonb
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  claims jsonb;
+  target_user_id uuid;
+  active_org_id uuid;
+  active_membership_id uuid;
+  role_names text[];
+  permission_keys text[];
+  platform_admin boolean;
+begin
+  claims := coalesce(event->'claims', '{}'::jsonb);
+  target_user_id := (event->>'user_id')::uuid;
+
+  select exists(select 1 from kontrolia_auth.platform_admins where user_id = target_user_id) into platform_admin;
+
+  select active_organization_id into active_org_id
+  from kontrolia_auth.sessions_context
+  where user_id = target_user_id;
+
+  if active_org_id is null then
+    select organization_id into active_org_id
+    from kontrolia_auth.memberships
+    where user_id = target_user_id and status = 'active'
+    order by created_at asc
+    limit 1;
+  end if;
+
+  if active_org_id is not null then
+    select id into active_membership_id
+    from kontrolia_auth.memberships
+    where user_id = target_user_id
+      and organization_id = active_org_id
+      and status = 'active';
+  end if;
+
+  if active_membership_id is not null then
+    select coalesce(array_agg(distinct r.slug), '{}')
+      into role_names
+    from kontrolia_auth.membership_roles mr
+    join kontrolia_auth.roles r on r.id = mr.role_id
+    where mr.membership_id = active_membership_id;
+
+    select coalesce(array_agg(distinct p.key), '{}')
+      into permission_keys
+    from (
+      select p.id, p.key
+      from kontrolia_auth.membership_roles mr
+      join kontrolia_auth.role_permissions rp on rp.role_id = mr.role_id
+      join kontrolia_auth.permissions p on p.id = rp.permission_id
+      where mr.membership_id = active_membership_id
+      union
+      select p.id, p.key
+      from kontrolia_auth.user_permissions up
+      join kontrolia_auth.permissions p on p.id = up.permission_id
+      where up.membership_id = active_membership_id and up.effect = 'allow'
+    ) p
+    where not exists (
+      select 1 from kontrolia_auth.user_permissions up_deny
+      where up_deny.membership_id = active_membership_id
+        and up_deny.permission_id = p.id
+        and up_deny.effect = 'deny'
+    );
+  else
+    role_names := '{}';
+    permission_keys := '{}';
+  end if;
+
+  claims := jsonb_set(claims, '{organization_id}', coalesce(to_jsonb(active_org_id), 'null'::jsonb));
+  claims := jsonb_set(claims, '{roles}', to_jsonb(coalesce(role_names, '{}')));
+  claims := jsonb_set(claims, '{permissions}', to_jsonb(coalesce(permission_keys, '{}')));
+  claims := jsonb_set(claims, '{is_platform_admin}', to_jsonb(coalesce(platform_admin, false)));
+
+  event := jsonb_set(event, '{claims}', claims);
+  return event;
+end;
+$$;
+
+grant execute on function kontrolia_auth.custom_access_token_hook(jsonb) to supabase_auth_admin;
+revoke execute on function kontrolia_auth.custom_access_token_hook(jsonb) from authenticated, anon, public;
+
+-- packages/db/migrations/0017_bootstrap_first_platform_admin.sql
+create or replace function kontrolia_auth.bootstrap_first_platform_admin()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if not exists (select 1 from kontrolia_auth.platform_admins limit 1)
+     and (select count(*) from auth.users) = 1 then
+    insert into kontrolia_auth.platform_admins (user_id) values (new.id);
+  end if;
+  return new;
+end;
+$$;
+
+-- packages/db/migrations/0019_app_scoped_custom_roles.sql
+create or replace function kontrolia_auth.handle_application_enabled()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  app_name text;
+  app_slug text;
+  new_role_id uuid;
+begin
+  select name, slug into app_name, app_slug from kontrolia_auth.applications where id = new.application_id;
+
+  insert into kontrolia_auth.roles (organization_id, application_id, name, slug, is_system_role, grants_all_permissions)
+  values (new.organization_id, new.application_id, 'Administrador de ' || app_name, 'admin-' || app_slug, true, true)
+  on conflict (organization_id, slug) do nothing
+  returning id into new_role_id;
+
+  if new_role_id is not null then
+    insert into kontrolia_auth.role_permissions (role_id, permission_id)
+    select new_role_id, p.id from kontrolia_auth.permissions p where p.application_id = new.application_id;
+  end if;
+
+  return new;
+end;
+$$;
+
+create or replace function kontrolia_auth.handle_permission_added()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  insert into kontrolia_auth.role_permissions (role_id, permission_id)
+  select r.id, new.id
+  from kontrolia_auth.roles r
+  where r.application_id = new.application_id and r.grants_all_permissions
+  on conflict do nothing;
+  return new;
+end;
+$$;
+
+create or replace function kontrolia_auth.enforce_one_role_per_application()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  target_app_id uuid;
+  conflict_count int;
+begin
+  select application_id into target_app_id from kontrolia_auth.roles where id = new.role_id;
+
+  if target_app_id is not null then
+    select count(*) into conflict_count
+    from kontrolia_auth.membership_roles mr
+    join kontrolia_auth.roles r on r.id = mr.role_id
+    where mr.membership_id = new.membership_id and r.application_id = target_app_id and mr.role_id <> new.role_id;
+
+    if conflict_count > 0 then
+      raise exception 'Este usuario ya tiene un rol asignado para esta aplicación. Quita el rol anterior antes de asignar uno nuevo.';
+    end if;
+  end if;
+
+  return new;
+end;
+$$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontrolia/db",
-  "version": "1.1.0",
+  "version": "2.0.0",
   "license": "MIT",
   "description": "KontrolIA Auth database layer: SQL migrations for the `kontrolia` schema (organizations, RBAC, Custom Access Token Hook) and a connection-string-agnostic migration runner.",
   "keywords": [