@kontrolia/db 2.0.0 → 2.1.1

package/README.md

@@ -15,4 +15,4 @@ DATABASE_URL="postgres://postgres:postgres@localhost:5432/postgres" pnpm --filte
 ## Activar el hook
 
 - **Self-hosted**: variable de entorno de GoTrue `GOTRUE_HOOK_CUSTOM_ACCESS_TOKEN_URI=pg-functions://postgres/kontrolia_auth/custom_access_token_hook` (ver `docker/docker-compose.yml`).
-- **Supabase Cloud**: paso manual en el Dashboard → Authentication → Hooks → Custom Access Token → seleccionar `kontrolia_auth.custom_access_token_hook`. No automatizable por API pública.
+- **Supabase Cloud**: `npx create-kontrolia-auth` (o `deploy`) lo automatiza vía la Management API de Supabase, pidiendo un Personal Access Token de la cuenta. A mano: Dashboard → Authentication → Hooks → Custom Access Token → seleccionar `kontrolia_auth.custom_access_token_hook`.

package/dist/grant-platform-admin.d.ts

@@ -0,0 +1,21 @@
+export interface GrantPlatformAdminOptions {
+    /** Postgres connection string — same trust model as migrate(): whoever has
+     * this can already do anything in the database, so this bypasses the
+     * app's own is_platform_admin authorization check entirely. That's the
+     * point — it's the recovery path for when there are zero platform admins
+     * (e.g. bootstrap_first_platform_admin() didn't fire because auth.users
+     * already had rows from something else sharing the same Supabase
+     * project), which the admin-panel UI can never self-serve since its API
+     * requires an existing platform admin to call it. */
+    connectionString: string;
+    email: string;
+}
+export interface GrantPlatformAdminResult {
+    userId: string;
+    email: string;
+    /** True if this user already was a platform admin — grant is idempotent. */
+    alreadyGranted: boolean;
+}
+/** Grants platform admin directly via SQL — no HTTP layer, no JWT required. */
+export declare function grantPlatformAdmin({ connectionString, email }: GrantPlatformAdminOptions): Promise<GrantPlatformAdminResult>;
+//# sourceMappingURL=grant-platform-admin.d.ts.map

package/dist/grant-platform-admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-platform-admin.d.ts","sourceRoot":"","sources":["../src/grant-platform-admin.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,yBAAyB;IACxC;;;;;;;yDAOqD;IACrD,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,+EAA+E;AAC/E,wBAAsB,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,yBAAyB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA0BlI"}

package/dist/grant-platform-admin.js

@@ -0,0 +1,21 @@
+import { Client } from "pg";
+/** Grants platform admin directly via SQL — no HTTP layer, no JWT required. */
+export async function grantPlatformAdmin({ connectionString, email }) {
+    const client = new Client({ connectionString });
+    await client.connect();
+    try {
+        const { rows: users } = await client.query("select id, email from auth.users where lower(email) = lower($1) limit 1", [email]);
+        const user = users[0];
+        if (!user) {
+            throw new Error(`No hay ningún usuario registrado con el correo "${email}". Regístrate primero desde auth-server.`);
+        }
+        const { rows: inserted } = await client.query(`insert into kontrolia_auth.platform_admins (user_id)
+       values ($1)
+       on conflict (user_id) do nothing
+       returning user_id`, [user.id]);
+        return { userId: user.id, email: user.email, alreadyGranted: inserted.length === 0 };
+    }
+    finally {
+        await client.end();
+    }
+}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export { migrate, type MigrateOptions } from "./migrate.js";
+export { grantPlatformAdmin, type GrantPlatformAdminOptions, type GrantPlatformAdminResult } from "./grant-platform-admin.js";
 export { registerApplication, type RegisterApplicationOptions, type RegisteredApplication, type PermissionInput, } from "./register-application.js";
 export { generateApplicationApiKey, hashApplicationApiKey } from "./api-key.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,GACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,KAAK,yBAAyB,EAAE,KAAK,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC9H,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,GACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -1,3 +1,4 @@
 export { migrate } from "./migrate.js";
+export { grantPlatformAdmin } from "./grant-platform-admin.js";
 export { registerApplication, } from "./register-application.js";
 export { generateApplicationApiKey, hashApplicationApiKey } from "./api-key.js";

package/migrations/0021_org_owner_delete.sql

@@ -0,0 +1,31 @@
+-- Deleting an organization is irreversible and cascades through every
+-- membership/role/invitation/audit-log row for it (see the FKs in
+-- 0002/0004/0005/0006_*.sql) — permission_denied by default today, since no
+-- DELETE policy exists on kontrolia_auth.organizations at all. Reserved for
+-- the org's Owner specifically, not any Admin: is_org_admin() (0009/0020)
+-- deliberately treats Owner and Admin the same for day-to-day management,
+-- but wiping the whole organization (including its audit trail) is a
+-- different level of consequence.
+create or replace function kontrolia_auth.is_org_owner(org_id uuid)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select exists (
+    select 1
+    from kontrolia_auth.memberships m
+    join kontrolia_auth.membership_roles mr on mr.membership_id = m.id
+    join kontrolia_auth.roles r on r.id = mr.role_id
+    where m.organization_id = org_id
+      and m.user_id = auth.uid()
+      and m.status = 'active'
+      and r.slug = 'owner'
+  );
+$$;
+
+grant execute on function kontrolia_auth.is_org_owner(uuid) to authenticated;
+
+create policy "org owners can delete their organization" on kontrolia_auth.organizations
+  for delete using (kontrolia_auth.is_org_owner(id));

package/migrations/0022_application_homepage_url.sql

@@ -0,0 +1,17 @@
+-- Nothing in the schema records where a registered application is actually
+-- reachable for end users — redirect_urls is OAuth callback URIs, not a
+-- home page. Needed for an "apps you have access to" launcher (auth-server)
+-- to have somewhere to link. Nullable: not always known at registration
+-- time via the CLI wizard.
+alter table kontrolia_auth.applications add column homepage_url text;
+
+comment on column kontrolia_auth.applications.homepage_url is
+  'Where this application is reachable for end users (its actual URL, not an OAuth redirect URI) — what an "apps you can access" launcher links to.';
+
+-- No UPDATE policy existed on applications at all before this (0018 only
+-- added a SELECT policy widening catalog browsing). Scoped to the
+-- registering org's admins, not every org that merely enabled the app.
+create policy "owning org admins can update their application" on kontrolia_auth.applications
+  for update
+  using (owner_organization_id is not null and kontrolia_auth.is_org_admin(owner_organization_id))
+  with check (owner_organization_id is not null and kontrolia_auth.is_org_admin(owner_organization_id));

package/migrations/0023_fix_audit_triggers_on_org_delete.sql

@@ -0,0 +1,60 @@
+-- Deleting an organization (0021) cascades to memberships, which cascades
+-- to membership_roles — and the AFTER DELETE audit triggers on both
+-- (0013_audit_log_triggers.sql) tried to INSERT a new audit_logs row
+-- referencing that same organization_id mid-cascade, violating
+-- audit_logs_organization_id_fkey (audit_logs itself also cascades on
+-- organization delete, so by the time these triggers fire the parent
+-- organization row is gone). There's no point logging "membership removed"
+-- for a membership that's disappearing because its whole organization —
+-- audit trail included — is being wiped a moment later anyway. Guard both
+-- triggers: only log when the organization is still around, i.e. this is a
+-- real standalone removal, not a side effect of deleting the org itself.
+create or replace function kontrolia_auth.log_membership_change()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if tg_op = 'INSERT' then
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (new.organization_id, coalesce(auth.uid(), new.user_id), 'membership.created', 'membership', new.id::text, jsonb_build_object('user_id', new.user_id, 'status', new.status));
+    return new;
+  else
+    if exists (select 1 from kontrolia_auth.organizations where id = old.organization_id) then
+      insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+      values (old.organization_id, auth.uid(), 'membership.removed', 'membership', old.id::text, jsonb_build_object('user_id', old.user_id));
+    end if;
+    return old;
+  end if;
+end;
+$$;
+
+create or replace function kontrolia_auth.log_role_assignment_change()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  target_membership record;
+begin
+  select organization_id, user_id into target_membership
+  from kontrolia_auth.memberships
+  where id = coalesce(new.membership_id, old.membership_id);
+
+  if not exists (select 1 from kontrolia_auth.organizations where id = target_membership.organization_id) then
+    if tg_op = 'INSERT' then return new; else return old; end if;
+  end if;
+
+  if tg_op = 'INSERT' then
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (target_membership.organization_id, coalesce(auth.uid(), target_membership.user_id), 'role.assigned', 'membership_role', new.membership_id::text, jsonb_build_object('role_id', new.role_id));
+    return new;
+  else
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (target_membership.organization_id, auth.uid(), 'role.unassigned', 'membership_role', old.membership_id::text, jsonb_build_object('role_id', old.role_id));
+    return old;
+  end if;
+end;
+$$;

package/migrations/0024_extend_audit_triggers.sql

@@ -0,0 +1,77 @@
+-- Suspending/reactivating a member (organization-members PATCH) and
+-- revoking or resending an invitation (admin-panel's Invitaciones page)
+-- previously left no audit trail: the membership trigger only ran on
+-- INSERT/DELETE (0013), and invitations had no DELETE trigger at all.
+-- Extends both to keep 0013's own promise — "the database logs it, not
+-- application code" — up to date with what the UI can now do.
+
+create or replace function kontrolia_auth.log_membership_change()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if tg_op = 'INSERT' then
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (new.organization_id, coalesce(auth.uid(), new.user_id), 'membership.created', 'membership', new.id::text, jsonb_build_object('user_id', new.user_id, 'status', new.status));
+    return new;
+  elsif tg_op = 'UPDATE' then
+    if old.status is distinct from new.status then
+      insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+      values (new.organization_id, auth.uid(), 'membership.status_changed', 'membership', new.id::text, jsonb_build_object('user_id', new.user_id, 'from_status', old.status, 'to_status', new.status));
+    end if;
+    return new;
+  else
+    if exists (select 1 from kontrolia_auth.organizations where id = old.organization_id) then
+      insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+      values (old.organization_id, auth.uid(), 'membership.removed', 'membership', old.id::text, jsonb_build_object('user_id', old.user_id));
+    end if;
+    return old;
+  end if;
+end;
+$$;
+
+drop trigger if exists audit_membership_change on kontrolia_auth.memberships;
+create trigger audit_membership_change
+  after insert or update or delete on kontrolia_auth.memberships
+  for each row execute function kontrolia_auth.log_membership_change();
+
+create or replace function kontrolia_auth.log_invitation_deleted()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if exists (select 1 from kontrolia_auth.organizations where id = old.organization_id) then
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (old.organization_id, auth.uid(), 'invitation.revoked', 'invitation', old.id::text, jsonb_build_object('email', old.email));
+  end if;
+  return old;
+end;
+$$;
+
+create trigger audit_invitation_deleted
+  after delete on kontrolia_auth.invitations
+  for each row execute function kontrolia_auth.log_invitation_deleted();
+
+-- Resend (extend expires_at on a still-pending invitation) shares the same
+-- AFTER UPDATE trigger slot as "accepted" — one function, two cases.
+create or replace function kontrolia_auth.log_invitation_accepted()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if old.accepted_at is null and new.accepted_at is not null then
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (new.organization_id, auth.uid(), 'invitation.accepted', 'invitation', new.id::text, jsonb_build_object('email', new.email));
+  elsif new.accepted_at is null and old.expires_at is distinct from new.expires_at then
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (new.organization_id, auth.uid(), 'invitation.resent', 'invitation', new.id::text, jsonb_build_object('email', new.email, 'new_expires_at', new.expires_at));
+  end if;
+  return new;
+end;
+$$;

package/migrations/0025_prevent_last_owner_role_removal.sql

@@ -0,0 +1,57 @@
+-- wouldRemoveLastOwner() (organization-members API route) already stops a
+-- caller from suspending/removing the org's only active Owner — but that
+-- guard lives at the API-route layer, not the DB layer. The RLS policy
+-- actually governing kontrolia_auth.membership_roles ("org admins manage
+-- membership roles", 0010) is a bare is_org_admin() check with no owner
+-- protection at all, so any org Admin can DELETE the sole Owner's role
+-- row directly and reproduce the exact same lockout through a door the
+-- API-layer fix never covered. Enforce it where it can't be bypassed: in
+-- the database, on every DELETE, regardless of which code path issued it.
+
+create or replace function kontrolia_auth.prevent_last_owner_role_removal()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_organization_id uuid;
+  v_role_slug text;
+  v_active_owner_count int;
+begin
+  select organization_id into v_organization_id
+  from kontrolia_auth.memberships
+  where id = old.membership_id;
+
+  -- Membership already gone (e.g. cascaded from an org delete, or from a
+  -- membership delete the API route already validated before issuing) —
+  -- nothing left to protect. Mirrors 0023's org-delete cascade guard.
+  if v_organization_id is null or not exists (select 1 from kontrolia_auth.organizations where id = v_organization_id) then
+    return old;
+  end if;
+
+  select slug into v_role_slug from kontrolia_auth.roles where id = old.role_id;
+
+  if v_role_slug is distinct from 'owner' then
+    return old;
+  end if;
+
+  select count(*) into v_active_owner_count
+  from kontrolia_auth.membership_roles mr
+  join kontrolia_auth.memberships m on m.id = mr.membership_id
+  join kontrolia_auth.roles r on r.id = mr.role_id
+  where m.organization_id = v_organization_id
+    and m.status = 'active'
+    and r.slug = 'owner';
+
+  if v_active_owner_count <= 1 then
+    raise exception 'No puedes quitar el rol de Owner al único Owner activo de la organización.';
+  end if;
+
+  return old;
+end;
+$$;
+
+create trigger prevent_last_owner_role_removal
+  before delete on kontrolia_auth.membership_roles
+  for each row execute function kontrolia_auth.prevent_last_owner_role_removal();

package/migrations/0026_prevent_last_owner_membership_removal.sql

@@ -0,0 +1,111 @@
+-- 0025 closed the last-owner lockout for one specific vector — deleting the
+-- membership_roles row directly. Same-day re-audit found the identical
+-- outcome (an org left with zero active Owners) still reachable through two
+-- sibling doors on kontrolia_auth.memberships itself, neither guarded by
+-- any DB-level check: a direct DELETE of the membership row (RLS policy
+-- "org admins remove memberships" is a bare is_org_admin() check), and a
+-- direct UPDATE of its status to anything other than 'active' (RLS policy
+-- "org admins update memberships", same bare check — this is the exact
+-- suspend-to-zero-Owners bug already fixed once at the API layer in
+-- 4579870, reachable again via raw PostgREST). Close both at the table
+-- that actually matters, the same way 0025 closed membership_roles.
+
+create or replace function kontrolia_auth.prevent_last_owner_membership_removal()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_is_owner boolean;
+  v_active_owner_count int;
+begin
+  -- Cascaded from the organization's own deletion — nothing left to
+  -- protect, and blocking here would make "delete organization" itself
+  -- impossible. Mirrors 0023/0025's cascade-safety guard.
+  if not exists (select 1 from kontrolia_auth.organizations where id = old.organization_id) then
+    return old;
+  end if;
+
+  -- A membership that wasn't active wasn't counted among active Owners
+  -- anyway, so removing it can't be what drops the count to zero.
+  if old.status is distinct from 'active' then
+    return old;
+  end if;
+
+  select exists (
+    select 1
+    from kontrolia_auth.membership_roles mr
+    join kontrolia_auth.roles r on r.id = mr.role_id
+    where mr.membership_id = old.id and r.slug = 'owner'
+  ) into v_is_owner;
+
+  if not v_is_owner then
+    return old;
+  end if;
+
+  select count(*) into v_active_owner_count
+  from kontrolia_auth.membership_roles mr
+  join kontrolia_auth.memberships m on m.id = mr.membership_id
+  join kontrolia_auth.roles r on r.id = mr.role_id
+  where m.organization_id = old.organization_id
+    and m.status = 'active'
+    and r.slug = 'owner';
+
+  if v_active_owner_count <= 1 then
+    raise exception 'No puedes quitar al único Owner activo de la organización.';
+  end if;
+
+  return old;
+end;
+$$;
+
+create trigger prevent_last_owner_membership_delete
+  before delete on kontrolia_auth.memberships
+  for each row execute function kontrolia_auth.prevent_last_owner_membership_removal();
+
+create or replace function kontrolia_auth.prevent_last_owner_deactivation()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_is_owner boolean;
+  v_active_owner_count int;
+begin
+  -- Only relevant when a membership is moving OUT of active status.
+  if old.status is distinct from 'active' or new.status = 'active' then
+    return new;
+  end if;
+
+  select exists (
+    select 1
+    from kontrolia_auth.membership_roles mr
+    join kontrolia_auth.roles r on r.id = mr.role_id
+    where mr.membership_id = old.id and r.slug = 'owner'
+  ) into v_is_owner;
+
+  if not v_is_owner then
+    return new;
+  end if;
+
+  select count(*) into v_active_owner_count
+  from kontrolia_auth.membership_roles mr
+  join kontrolia_auth.memberships m on m.id = mr.membership_id
+  join kontrolia_auth.roles r on r.id = mr.role_id
+  where m.organization_id = old.organization_id
+    and m.status = 'active'
+    and r.slug = 'owner';
+
+  if v_active_owner_count <= 1 then
+    raise exception 'No puedes suspender al único Owner activo de la organización.';
+  end if;
+
+  return new;
+end;
+$$;
+
+create trigger prevent_last_owner_deactivation
+  before update on kontrolia_auth.memberships
+  for each row execute function kontrolia_auth.prevent_last_owner_deactivation();

package/migrations/0027_prevent_last_owner_org_reassignment.sql

@@ -0,0 +1,56 @@
+-- 0026's UPDATE trigger only inspected `status`, never `organization_id` —
+-- a caller with admin rights in the Owner's org AND the destination org
+-- (the RLS policy's implicit WITH CHECK, reusing USING since none is
+-- declared, already requires both) could move the sole active Owner's
+-- membership to a different organization while leaving status untouched,
+-- leaving the source org with zero active Owners the same way a status
+-- flip to 'suspended' would. Narrower precondition than 0026's two fixes
+-- (needs dual-org admin, not just single-org), but the same bug class —
+-- extend the same trigger rather than leave it half-covering "leaving
+-- active status" as the only way to lose the last Owner.
+
+create or replace function kontrolia_auth.prevent_last_owner_deactivation()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_is_owner boolean;
+  v_active_owner_count int;
+  v_leaving_org boolean;
+begin
+  -- "Leaving" now covers both ways a membership stops counting toward its
+  -- (original) org's active Owners: no longer active, or reassigned away.
+  v_leaving_org := (new.organization_id is distinct from old.organization_id) or (new.status is distinct from 'active');
+
+  if old.status is distinct from 'active' or not v_leaving_org then
+    return new;
+  end if;
+
+  select exists (
+    select 1
+    from kontrolia_auth.membership_roles mr
+    join kontrolia_auth.roles r on r.id = mr.role_id
+    where mr.membership_id = old.id and r.slug = 'owner'
+  ) into v_is_owner;
+
+  if not v_is_owner then
+    return new;
+  end if;
+
+  select count(*) into v_active_owner_count
+  from kontrolia_auth.membership_roles mr
+  join kontrolia_auth.memberships m on m.id = mr.membership_id
+  join kontrolia_auth.roles r on r.id = mr.role_id
+  where m.organization_id = old.organization_id
+    and m.status = 'active'
+    and r.slug = 'owner';
+
+  if v_active_owner_count <= 1 then
+    raise exception 'No puedes quitar al único Owner activo de la organización.';
+  end if;
+
+  return new;
+end;
+$$;

package/migrations/0028_restrict_owner_grant_and_membership_identity.sql

@@ -0,0 +1,70 @@
+-- Fourth same-day Phase 2 audit found two CRITICALs that fully defeat every
+-- last-owner protection added today (0025-0027), because those all guard
+-- operations against an *existing* Owner's own row — none of them restrict
+-- who can become an Owner in the first place, or what a membership row's
+-- identity means. Both are day-one gaps in migration 0010's RLS policies,
+-- live-exploited this session by a plain org Admin (no dual-org privilege
+-- needed, unlike 0027's narrower finding):
+--
+-- 1. "org admins manage membership roles" is a bare is_org_admin() check
+--    with no restriction on which role_id may be inserted — any Admin can
+--    grant themselves (or anyone) the 'owner' role directly, then use the
+--    now-legitimate 2-owner path to suspend the real Owner.
+-- 2. "org admins update memberships" permits changing ANY column,
+--    including user_id, as long as organization_id is unchanged — an Admin
+--    can silently reassign the sole Owner's membership row to an arbitrary
+--    third-party user, and since the audit trigger only fires on status
+--    changes, this leaves zero trail.
+--
+-- No legitimate code path in this app ever updates memberships.user_id
+-- (grepped: the only UPDATE anywhere is the status PATCH in
+-- organization-members/route.ts) — a membership's identity is created once
+-- via invitation-accept or org-bootstrap and never reassigned, so blocking
+-- any change to it entirely, for every membership, is safe.
+
+create or replace function kontrolia_auth.prevent_admin_granting_owner_role()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_role_slug text;
+  v_organization_id uuid;
+begin
+  select slug into v_role_slug from kontrolia_auth.roles where id = new.role_id;
+  if v_role_slug is distinct from 'owner' then
+    return new;
+  end if;
+
+  select organization_id into v_organization_id from kontrolia_auth.memberships where id = new.membership_id;
+
+  if not kontrolia_auth.is_org_owner(v_organization_id) then
+    raise exception 'Solo un Owner puede otorgar el rol de Owner.';
+  end if;
+
+  return new;
+end;
+$$;
+
+create trigger prevent_admin_granting_owner_role
+  before insert on kontrolia_auth.membership_roles
+  for each row execute function kontrolia_auth.prevent_admin_granting_owner_role();
+
+create or replace function kontrolia_auth.prevent_membership_identity_change()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if new.user_id is distinct from old.user_id then
+    raise exception 'No se puede reasignar la identidad de una membresía existente.';
+  end if;
+  return new;
+end;
+$$;
+
+create trigger prevent_membership_identity_change
+  before update on kontrolia_auth.memberships
+  for each row execute function kontrolia_auth.prevent_membership_identity_change();

package/migrations/0029_membership_roles_update_guard.sql

@@ -0,0 +1,108 @@
+-- Fifth same-day Phase 2 audit found kontrolia_auth.membership_roles had no
+-- trigger on UPDATE at all — 0025 guards DELETE and 0028 guards INSERT, but
+-- role_id (part of the table's own primary key) could be changed directly
+-- via a plain UPDATE, sidestepping both guards entirely: self-promote to
+-- Owner, demote the sole active Owner, or hijack an existing Owner row
+-- outright, all live-exploited this session by a plain org Admin.
+--
+-- The same audit also found a functional regression 0028 introduced:
+-- is_org_owner() depends on auth.uid(), which is NULL under the
+-- service-role connection apps/auth-server/app/api/invitations/accept/
+-- route.ts uses to grant an invited role — so accepting any invitation
+-- offering the 'owner' role now silently fails its role grant, for every
+-- organization. Service-role connections are already the top of this app's
+-- trust chain (RLS doesn't even apply to them, via BYPASSRLS) — govern them
+-- by application code review the same way the rest of the schema already
+-- does, not by re-deriving auth.uid() a service-role session never has.
+--
+-- Detecting that trust boundary needs auth.role() (reads the
+-- request.jwt.claims GUC), not current_user: these trigger functions are
+-- `security definer`, so current_user inside the function body reports the
+-- function's OWNER, not the caller — confirmed by direct experimentation
+-- against this migration's first draft, which used current_user and still
+-- blocked the legitimate service-role grant.
+
+create or replace function kontrolia_auth.prevent_admin_granting_owner_role()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_role_slug text;
+  v_organization_id uuid;
+begin
+  if auth.role() = 'service_role' then
+    return new;
+  end if;
+
+  select slug into v_role_slug from kontrolia_auth.roles where id = new.role_id;
+  if v_role_slug is distinct from 'owner' then
+    return new;
+  end if;
+
+  select organization_id into v_organization_id from kontrolia_auth.memberships where id = new.membership_id;
+
+  if not kontrolia_auth.is_org_owner(v_organization_id) then
+    raise exception 'Solo un Owner puede otorgar el rol de Owner.';
+  end if;
+
+  return new;
+end;
+$$;
+
+create or replace function kontrolia_auth.prevent_membership_role_update()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_organization_id uuid;
+  v_old_slug text;
+  v_new_slug text;
+  v_active_owner_count int;
+begin
+  -- No legitimate flow ever reassigns a role_id row to a different
+  -- membership — same reasoning as 0028's blanket ban on
+  -- memberships.user_id. Unlike the owner-grant/removal checks below,
+  -- there's no service-role exception: nothing legitimate does this either.
+  if new.membership_id is distinct from old.membership_id then
+    raise exception 'No se puede reasignar un rol de membresía a otra membresía.';
+  end if;
+
+  -- A true no-op UPDATE (e.g. an ON CONFLICT DO UPDATE upsert that hit an
+  -- already-identical row, as invitation-accept's upsert can) changes
+  -- nothing here — skip straight through rather than re-running checks
+  -- against a role that never actually changed.
+  if old.role_id is distinct from new.role_id and auth.role() is distinct from 'service_role' then
+    select slug into v_old_slug from kontrolia_auth.roles where id = old.role_id;
+    select slug into v_new_slug from kontrolia_auth.roles where id = new.role_id;
+    select organization_id into v_organization_id from kontrolia_auth.memberships where id = old.membership_id;
+
+    if v_new_slug = 'owner' and not kontrolia_auth.is_org_owner(v_organization_id) then
+      raise exception 'Solo un Owner puede otorgar el rol de Owner.';
+    end if;
+
+    if v_old_slug = 'owner' and v_new_slug is distinct from 'owner' then
+      select count(*) into v_active_owner_count
+      from kontrolia_auth.membership_roles mr
+      join kontrolia_auth.memberships m on m.id = mr.membership_id
+      join kontrolia_auth.roles r on r.id = mr.role_id
+      where m.organization_id = v_organization_id
+        and m.status = 'active'
+        and r.slug = 'owner';
+
+      if v_active_owner_count <= 1 then
+        raise exception 'No puedes quitar el rol de Owner al único Owner activo de la organización.';
+      end if;
+    end if;
+  end if;
+
+  return new;
+end;
+$$;
+
+create trigger prevent_membership_role_update
+  before update on kontrolia_auth.membership_roles
+  for each row execute function kontrolia_auth.prevent_membership_role_update();