@taodigital/database 0.0.0-stage → 1.2.1

package/prisma/migrations/20260908000001_rbac_migration_catchup/migration.sql

@@ -0,0 +1,314 @@
+-- Catch-up migration for failed 20260904180424_rbac_role_configs_admin_roles.
+-- That migration had a bug (KnowledgeChunk.tsv DROP DEFAULT on a generated column)
+-- which caused a PostgreSQL error and rolled back the entire migration, but Prisma
+-- marked it as "applied". This migration re-applies everything idempotently.
+-- All statements use IF NOT EXISTS / IF EXISTS / DO $$ blocks for safety.
+
+-- ============================================================
+-- 1. COLUMN ADDITIONS (critical — missing columns cause 500s)
+-- ============================================================
+
+-- AdminUser.role (RBAC)
+ALTER TABLE "AdminUser" ADD COLUMN IF NOT EXISTS "role" TEXT NOT NULL DEFAULT 'SUPER_ADMIN';
+
+-- Project.vsaEnabled (schema drift — was added to schema.prisma without a migration)
+ALTER TABLE "Project" ADD COLUMN IF NOT EXISTS "vsaEnabled" BOOLEAN NOT NULL DEFAULT false;
+
+-- TestCase timestamps (were added in the RBAC migration, required NOT NULL fields)
+ALTER TABLE "TestCase" ADD COLUMN IF NOT EXISTS "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP;
+ALTER TABLE "TestCase" ADD COLUMN IF NOT EXISTS "updatedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP;
+
+-- ============================================================
+-- 2. COLUMN DROPS (remove deprecated columns; IF EXISTS = safe)
+-- ============================================================
+
+ALTER TABLE "TestCase" DROP COLUMN IF EXISTS "genAt";
+ALTER TABLE "TestResult" DROP COLUMN IF EXISTS "dataRow";
+ALTER TABLE "TestResult" DROP COLUMN IF EXISTS "networkTimings";
+ALTER TABLE "TestResult" DROP COLUMN IF EXISTS "rootCauseSummary";
+ALTER TABLE "VisualBaseline" DROP COLUMN IF EXISTS "domSnapshotPath";
+ALTER TABLE "Screen" DROP COLUMN IF EXISTS "a11yViolations";
+ALTER TABLE "Screen" DROP COLUMN IF EXISTS "securityHeaders";
+ALTER TABLE "PerformanceSnapshot" DROP COLUMN IF EXISTS "lighthouseReport";
+ALTER TABLE "PlatformJob" DROP COLUMN IF EXISTS "appiumSessionId";
+ALTER TABLE "PlatformJob" DROP COLUMN IF EXISTS "deviceFarm";
+ALTER TABLE "PlatformJob" DROP COLUMN IF EXISTS "deviceModel";
+ALTER TABLE "PlatformJob" DROP COLUMN IF EXISTS "osVersion";
+
+-- ============================================================
+-- 3. COLUMN TYPE / DEFAULT CHANGES (idempotent or no-op safe)
+-- ============================================================
+
+-- AppField.piiClass default
+DO $$ BEGIN
+  IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='AppField' AND column_name='piiClass') THEN
+    ALTER TABLE "AppField" ALTER COLUMN "piiClass" SET DEFAULT 'unknown';
+  END IF;
+END $$;
+
+-- Comment.userId — allow null (drop not null constraint)
+DO $$ BEGIN
+  IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='Comment' AND column_name='userId' AND is_nullable='NO') THEN
+    ALTER TABLE "Comment" ALTER COLUMN "userId" DROP NOT NULL;
+  END IF;
+END $$;
+
+-- GitHubRepoConnection.testIdPattern default
+DO $$ BEGIN
+  IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='GitHubRepoConnection' AND column_name='testIdPattern') THEN
+    ALTER TABLE "GitHubRepoConnection" ALTER COLUMN "testIdPattern" SET DEFAULT 'TC-[A-Z]+-\d+';
+  END IF;
+END $$;
+
+-- KnowledgeChunk.tsv — if still a generated column, drop expression so it can be reattached
+-- (Use DO block so it's a no-op if already a plain column)
+DO $$ BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_name = 'KnowledgeChunk' AND column_name = 'tsv'
+    AND is_generated = 'ALWAYS'
+  ) THEN
+    ALTER TABLE "KnowledgeChunk" ALTER COLUMN "tsv" DROP EXPRESSION;
+  END IF;
+END $$;
+
+-- PerformanceSnapshot: change lighthouse columns from numeric to double precision
+DO $$ BEGIN
+  IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='PerformanceSnapshot' AND column_name='lighthousePerf') THEN
+    ALTER TABLE "PerformanceSnapshot"
+      ALTER COLUMN "lighthousePerf" SET DATA TYPE DOUBLE PRECISION,
+      ALTER COLUMN "lighthouseA11y" SET DATA TYPE DOUBLE PRECISION,
+      ALTER COLUMN "lighthouseSEO"  SET DATA TYPE DOUBLE PRECISION,
+      ALTER COLUMN "lighthouseBP"   SET DATA TYPE DOUBLE PRECISION;
+  END IF;
+END $$;
+
+-- SharedRunToken: standardize timestamp types
+DO $$ BEGIN
+  IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='SharedRunToken' AND column_name='expiresAt') THEN
+    ALTER TABLE "SharedRunToken"
+      ALTER COLUMN "expiresAt" SET DATA TYPE TIMESTAMP(3),
+      ALTER COLUMN "createdAt" SET DATA TYPE TIMESTAMP(3);
+  END IF;
+END $$;
+
+-- SsoConfig: set jitProvisioning default to false
+DO $$ BEGIN
+  IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='SsoConfig' AND column_name='jitProvisioning') THEN
+    ALTER TABLE "SsoConfig" ALTER COLUMN "jitProvisioning" SET DEFAULT false;
+  END IF;
+END $$;
+
+-- ============================================================
+-- 4. TABLES (audit history tables + role_configs + LlmPricing)
+-- ============================================================
+
+-- SystemConfigHistory / AgentPromptHistory / WorkspaceAgentPromptHistory
+-- These were added in 20260903000005_add_config_history. If that migration
+-- silently failed and was marked applied by Prisma, recreate idempotently.
+CREATE TABLE IF NOT EXISTS "SystemConfigHistory" (
+    "id"         TEXT NOT NULL,
+    "configKey"  TEXT NOT NULL,
+    "category"   TEXT NOT NULL,
+    "fieldKey"   TEXT NOT NULL,
+    "oldValue"   TEXT,
+    "newValue"   TEXT,
+    "action"     TEXT NOT NULL,
+    "sensitive"  BOOLEAN NOT NULL DEFAULT false,
+    "adminId"    TEXT,
+    "adminEmail" TEXT,
+    "changedAt"  TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "SystemConfigHistory_pkey" PRIMARY KEY ("id")
+);
+CREATE INDEX IF NOT EXISTS "SystemConfigHistory_configKey_changedAt_idx" ON "SystemConfigHistory"("configKey", "changedAt" DESC);
+CREATE INDEX IF NOT EXISTS "SystemConfigHistory_category_changedAt_idx"  ON "SystemConfigHistory"("category",  "changedAt" DESC);
+CREATE INDEX IF NOT EXISTS "SystemConfigHistory_adminId_idx"             ON "SystemConfigHistory"("adminId");
+
+CREATE TABLE IF NOT EXISTS "AgentPromptHistory" (
+    "id"            TEXT NOT NULL,
+    "agentPromptId" TEXT NOT NULL,
+    "agentKey"      TEXT NOT NULL,
+    "passKey"       TEXT,
+    "oldBody"       TEXT NOT NULL,
+    "newBody"       TEXT NOT NULL,
+    "version"       INTEGER NOT NULL,
+    "adminId"       TEXT,
+    "adminEmail"    TEXT,
+    "changedAt"     TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "AgentPromptHistory_pkey" PRIMARY KEY ("id")
+);
+CREATE INDEX IF NOT EXISTS "AgentPromptHistory_agentPromptId_changedAt_idx" ON "AgentPromptHistory"("agentPromptId", "changedAt" DESC);
+CREATE INDEX IF NOT EXISTS "AgentPromptHistory_agentKey_changedAt_idx"       ON "AgentPromptHistory"("agentKey", "changedAt" DESC);
+
+CREATE TABLE IF NOT EXISTS "WorkspaceAgentPromptHistory" (
+    "id"                     TEXT NOT NULL,
+    "workspaceAgentPromptId" TEXT,
+    "tenantId"               TEXT NOT NULL,
+    "agentKey"               TEXT NOT NULL,
+    "passKey"                TEXT,
+    "oldBody"                TEXT,
+    "newBody"                TEXT,
+    "action"                 TEXT NOT NULL,
+    "updatedBy"              TEXT,
+    "changedAt"              TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT "WorkspaceAgentPromptHistory_pkey" PRIMARY KEY ("id")
+);
+CREATE INDEX IF NOT EXISTS "WorkspaceAgentPromptHistory_tenantId_agentKey_changedAt_idx"      ON "WorkspaceAgentPromptHistory"("tenantId", "agentKey", "changedAt" DESC);
+CREATE INDEX IF NOT EXISTS "WorkspaceAgentPromptHistory_workspaceAgentPromptId_changedAt_idx" ON "WorkspaceAgentPromptHistory"("workspaceAgentPromptId", "changedAt" DESC);
+
+-- role_configs: create with correct schema.
+-- Drop and recreate if table is missing OR has wrong columns (displayName/description
+-- were added by an earlier broken manual attempt on prod).
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM information_schema.tables WHERE table_name = 'role_configs')
+  OR EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name = 'role_configs' AND column_name = 'displayName')
+  OR EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name = 'role_configs' AND column_name = 'description') THEN
+    DROP TABLE IF EXISTS "role_configs";
+    CREATE TABLE "role_configs" (
+      "roleName"    TEXT NOT NULL,
+      "rank"        INTEGER NOT NULL,
+      "permissions" TEXT[],
+      "updatedAt"   TIMESTAMP(3) NOT NULL DEFAULT NOW(),
+      CONSTRAINT "role_configs_pkey" PRIMARY KEY ("roleName")
+    );
+  END IF;
+END $$;
+
+CREATE TABLE IF NOT EXISTS "LlmPricing" (
+  "id"              TEXT NOT NULL,
+  "modelKey"        TEXT NOT NULL,
+  "inputPer1M"      DOUBLE PRECISION NOT NULL,
+  "outputPer1M"     DOUBLE PRECISION NOT NULL,
+  "cacheReadPer1M"  DOUBLE PRECISION NOT NULL DEFAULT 0,
+  "cacheWritePer1M" DOUBLE PRECISION NOT NULL DEFAULT 0,
+  "effectiveDate"   TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "createdAt"       TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "updatedAt"       TIMESTAMP(3) NOT NULL DEFAULT NOW(),
+  CONSTRAINT "LlmPricing_pkey" PRIMARY KEY ("id")
+);
+
+-- ============================================================
+-- 5. INDEXES
+-- ============================================================
+
+DROP INDEX IF EXISTS "KnowledgeChunk_tsv_idx";
+DROP INDEX IF EXISTS "PlatformJob_status_heartbeatAt_idx";
+DROP INDEX IF EXISTS "Screen_tenantId_projectId_discoveryMethod_idx";
+DROP INDEX IF EXISTS "ScreenGroup_tenantId_projectId_crawlJobId_idx";
+
+CREATE UNIQUE INDEX IF NOT EXISTS "role_configs_rank_key"                  ON "role_configs"("rank");
+CREATE UNIQUE INDEX IF NOT EXISTS "LlmPricing_modelKey_key"                ON "LlmPricing"("modelKey");
+CREATE INDEX IF NOT EXISTS "LlmPricing_modelKey_idx"                       ON "LlmPricing"("modelKey");
+CREATE INDEX IF NOT EXISTS "AuditLog_tenantId_action_idx"                  ON "AuditLog"("tenantId", "action");
+CREATE INDEX IF NOT EXISTS "Membership_tenantId_idx"                       ON "Membership"("tenantId");
+CREATE INDEX IF NOT EXISTS "Membership_userId_idx"                         ON "Membership"("userId");
+CREATE INDEX IF NOT EXISTS "MfaRecoveryCode_userId_idx"                    ON "MfaRecoveryCode"("userId");
+CREATE INDEX IF NOT EXISTS "PlatformJob_tenantId_projectId_queuedAt_idx"   ON "PlatformJob"("tenantId", "projectId", "queuedAt");
+CREATE INDEX IF NOT EXISTS "PlatformJob_status_workerId_idx"               ON "PlatformJob"("status", "workerId");
+CREATE INDEX IF NOT EXISTS "Screen_status_idx"                             ON "Screen"("status");
+CREATE INDEX IF NOT EXISTS "TestCase_status_projectId_idx"                 ON "TestCase"("status", "projectId");
+CREATE INDEX IF NOT EXISTS "TestCaseRun_tenantId_status_createdAt_idx"     ON "TestCaseRun"("tenantId", "status", "createdAt");
+CREATE INDEX IF NOT EXISTS "TestResult_tenantId_runId_status_idx"          ON "TestResult"("tenantId", "runId", "status");
+CREATE INDEX IF NOT EXISTS "WebhookDelivery_webhookId_status_idx"          ON "WebhookDelivery"("webhookId", "status");
+
+-- ============================================================
+-- 6. FOREIGN KEYS (all guarded with IF NOT EXISTS + orphan cleanup)
+-- ============================================================
+
+-- Clean up orphaned AuditLog.actorId before adding FK
+UPDATE "AuditLog" SET "actorId" = NULL
+  WHERE "actorId" IS NOT NULL
+    AND "actorId" NOT IN (SELECT id FROM "User");
+
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'AuditLog_actorId_fkey') THEN
+    ALTER TABLE "AuditLog" ADD CONSTRAINT "AuditLog_actorId_fkey"
+      FOREIGN KEY ("actorId") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+  END IF;
+END $$;
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'AuditLog_tenantId_fkey') THEN
+    ALTER TABLE "AuditLog" ADD CONSTRAINT "AuditLog_tenantId_fkey"
+      FOREIGN KEY ("tenantId") REFERENCES "Tenant"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+  END IF;
+END $$;
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'AccessReview_tenantId_fkey') THEN
+    ALTER TABLE "AccessReview" ADD CONSTRAINT "AccessReview_tenantId_fkey"
+      FOREIGN KEY ("tenantId") REFERENCES "Tenant"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+  END IF;
+END $$;
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'Screen_projectId_fkey') THEN
+    ALTER TABLE "Screen" ADD CONSTRAINT "Screen_projectId_fkey"
+      FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+  END IF;
+END $$;
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'ScreenA11yViolation_projectId_fkey') THEN
+    ALTER TABLE "ScreenA11yViolation" ADD CONSTRAINT "ScreenA11yViolation_projectId_fkey"
+      FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+  END IF;
+END $$;
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'ScreenA11yViolation_screenId_fkey') THEN
+    ALTER TABLE "ScreenA11yViolation" ADD CONSTRAINT "ScreenA11yViolation_screenId_fkey"
+      FOREIGN KEY ("screenId") REFERENCES "Screen"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+  END IF;
+END $$;
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'Element_screenId_fkey') THEN
+    ALTER TABLE "Element" ADD CONSTRAINT "Element_screenId_fkey"
+      FOREIGN KEY ("screenId") REFERENCES "Screen"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+  END IF;
+END $$;
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'TestSuite_projectId_fkey') THEN
+    ALTER TABLE "TestSuite" ADD CONSTRAINT "TestSuite_projectId_fkey"
+      FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+  END IF;
+END $$;
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'TestCase_dataSetId_fkey') THEN
+    ALTER TABLE "TestCase" ADD CONSTRAINT "TestCase_dataSetId_fkey"
+      FOREIGN KEY ("dataSetId") REFERENCES "TestDataSet"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+  END IF;
+END $$;
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'TestRunShard_runId_fkey') THEN
+    ALTER TABLE "TestRunShard" ADD CONSTRAINT "TestRunShard_runId_fkey"
+      FOREIGN KEY ("runId") REFERENCES "TestRun"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+  END IF;
+END $$;
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'SsoConfig_tenantId_fkey') THEN
+    ALTER TABLE "SsoConfig" ADD CONSTRAINT "SsoConfig_tenantId_fkey"
+      FOREIGN KEY ("tenantId") REFERENCES "Tenant"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+  END IF;
+END $$;
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'ScreenDiff_screenId_fkey') THEN
+    ALTER TABLE "ScreenDiff" ADD CONSTRAINT "ScreenDiff_screenId_fkey"
+      FOREIGN KEY ("screenId") REFERENCES "Screen"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+  END IF;
+END $$;
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'ProbeObservation_screenId_fkey') THEN
+    ALTER TABLE "ProbeObservation" ADD CONSTRAINT "ProbeObservation_screenId_fkey"
+      FOREIGN KEY ("screenId") REFERENCES "Screen"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+  END IF;
+END $$;
+
+-- ============================================================
+-- 7. SEED DATA — role_configs default permissions
+-- ON CONFLICT DO NOTHING so admin customizations are preserved.
+-- ============================================================
+
+INSERT INTO "role_configs" ("roleName", "rank", "permissions", "updatedAt") VALUES
+('VIEWER',    0, ARRAY['project:read','connector:read','audit:read','analytics:read'], NOW()),
+('DEVELOPER', 1, ARRAY['project:read','crawl:run','test:generate','test:run','run:execute','connector:read','extension:write','mcp:access'], NOW()),
+('TESTER',    2, ARRAY['project:read','crawl:run','test:generate','test:review','test:run','run:execute','run:cancel','run:share','connector:read','extension:write','analytics:read','report:send','coverage:export'], NOW()),
+('QA_LEAD',   3, ARRAY['project:create','project:read','project:write','crawl:run','test:generate','test:review','test:run','test:delete','run:execute','run:cancel','run:schedule','run:share','connector:manage','connector:read','visual:manage','skill-file:approve','member:invite','extension:write','analytics:read','report:send','coverage:export','coverage:remap','performance:alert','artifact:delete','import:manage','token-usage:read','mcp:access'], NOW()),
+('ADMIN',     4, ARRAY['project:create','project:read','project:write','project:delete','crawl:run','test:generate','test:review','test:run','test:delete','run:execute','run:cancel','run:schedule','run:share','connector:manage','connector:read','audit:read','visual:manage','skill-file:approve','member:invite','member:manage','extension:write','analytics:read','report:send','coverage:export','coverage:remap','performance:alert','artifact:delete','import:manage','token-usage:read','billing:read','mcp:access','workspace:session-manage'], NOW()),
+('OWNER',     5, ARRAY['workspace:manage','project:create','project:read','project:write','project:delete','crawl:run','test:generate','test:review','test:run','test:delete','run:execute','run:cancel','run:schedule','run:share','connector:manage','connector:read','audit:read','visual:manage','skill-file:approve','member:invite','member:manage','extension:write','analytics:read','report:send','coverage:export','coverage:remap','performance:alert','artifact:delete','import:manage','token-usage:read','billing:read','billing:manage','mcp:access','workspace:session-manage'], NOW())
+ON CONFLICT ("roleName") DO NOTHING;

package/prisma/migrations/20260908000002_fix_role_configs_empty_permissions/migration.sql

@@ -0,0 +1,22 @@
+-- Fix role_configs rows that have empty permissions arrays (from the broken initial seed).
+-- The catchup migration (20260908000001) used ON CONFLICT DO NOTHING, leaving existing
+-- rows with permissions = '{}' untouched. This migration updates them to canonical defaults.
+-- Rows with non-empty permissions are left alone (preserves admin customizations).
+
+UPDATE "role_configs" SET "permissions" = ARRAY['project:read','connector:read','audit:read','analytics:read'], "updatedAt" = NOW()
+  WHERE "roleName" = 'VIEWER' AND (array_length("permissions", 1) IS NULL OR array_length("permissions", 1) = 0);
+
+UPDATE "role_configs" SET "permissions" = ARRAY['project:read','crawl:run','test:generate','test:run','run:execute','connector:read','extension:write','mcp:access'], "updatedAt" = NOW()
+  WHERE "roleName" = 'DEVELOPER' AND (array_length("permissions", 1) IS NULL OR array_length("permissions", 1) = 0);
+
+UPDATE "role_configs" SET "permissions" = ARRAY['project:read','crawl:run','test:generate','test:review','test:run','run:execute','run:cancel','run:share','connector:read','extension:write','analytics:read','report:send','coverage:export'], "updatedAt" = NOW()
+  WHERE "roleName" = 'TESTER' AND (array_length("permissions", 1) IS NULL OR array_length("permissions", 1) = 0);
+
+UPDATE "role_configs" SET "permissions" = ARRAY['project:create','project:read','project:write','crawl:run','test:generate','test:review','test:run','test:delete','run:execute','run:cancel','run:schedule','run:share','connector:manage','connector:read','visual:manage','skill-file:approve','member:invite','extension:write','analytics:read','report:send','coverage:export','coverage:remap','performance:alert','artifact:delete','import:manage','token-usage:read','mcp:access'], "updatedAt" = NOW()
+  WHERE "roleName" = 'QA_LEAD' AND (array_length("permissions", 1) IS NULL OR array_length("permissions", 1) = 0);
+
+UPDATE "role_configs" SET "permissions" = ARRAY['project:create','project:read','project:write','project:delete','crawl:run','test:generate','test:review','test:run','test:delete','run:execute','run:cancel','run:schedule','run:share','connector:manage','connector:read','audit:read','visual:manage','skill-file:approve','member:invite','member:manage','extension:write','analytics:read','report:send','coverage:export','coverage:remap','performance:alert','artifact:delete','import:manage','token-usage:read','billing:read','mcp:access','workspace:session-manage'], "updatedAt" = NOW()
+  WHERE "roleName" = 'ADMIN' AND (array_length("permissions", 1) IS NULL OR array_length("permissions", 1) = 0);
+
+UPDATE "role_configs" SET "permissions" = ARRAY['workspace:manage','project:create','project:read','project:write','project:delete','crawl:run','test:generate','test:review','test:run','test:delete','run:execute','run:cancel','run:schedule','run:share','connector:manage','connector:read','audit:read','visual:manage','skill-file:approve','member:invite','member:manage','extension:write','analytics:read','report:send','coverage:export','coverage:remap','performance:alert','artifact:delete','import:manage','token-usage:read','billing:read','billing:manage','mcp:access','workspace:session-manage'], "updatedAt" = NOW()
+  WHERE "roleName" = 'OWNER' AND (array_length("permissions", 1) IS NULL OR array_length("permissions", 1) = 0);

package/prisma/migrations/20260908000003_sync_builtin_role_permissions/migration.sql

@@ -0,0 +1,38 @@
+-- Unconditionally sync all built-in role_configs to canonical permission sets.
+-- Previous migration (20260908000002) only fixed EMPTY arrays; rows that had
+-- a non-empty but STALE permissions array (missing permissions added to the
+-- codebase after the row was created) were left untouched, causing 403s for
+-- permissions like artifact:delete that are defined in ROLE_PERMISSIONS but
+-- absent from the DB row.
+--
+-- Built-in roles (OWNER/ADMIN/QA_LEAD/TESTER/DEVELOPER/VIEWER) are always
+-- kept in sync with the canonical list. Only custom roles are admin-managed.
+
+UPDATE "role_configs" SET "permissions" = ARRAY['project:read','connector:read','audit:read','analytics:read'], "updatedAt" = NOW()
+  WHERE "roleName" = 'VIEWER';
+
+UPDATE "role_configs" SET "permissions" = ARRAY['project:read','crawl:run','test:generate','test:review','test:run','run:execute','run:cancel','run:share','connector:read','extension:write','analytics:read','report:send','coverage:export'], "updatedAt" = NOW()
+  WHERE "roleName" = 'TESTER';
+
+UPDATE "role_configs" SET "permissions" = ARRAY['project:read','crawl:run','test:generate','test:run','run:execute','connector:read','extension:write','mcp:access'], "updatedAt" = NOW()
+  WHERE "roleName" = 'DEVELOPER';
+
+UPDATE "role_configs" SET "permissions" = ARRAY['project:create','project:read','project:write','crawl:run','test:generate','test:review','test:run','test:delete','run:execute','run:cancel','run:schedule','run:share','connector:manage','connector:read','visual:manage','skill-file:approve','member:invite','extension:write','analytics:read','report:send','coverage:export','coverage:remap','performance:alert','artifact:delete','import:manage','token-usage:read','mcp:access'], "updatedAt" = NOW()
+  WHERE "roleName" = 'QA_LEAD';
+
+UPDATE "role_configs" SET "permissions" = ARRAY['project:create','project:read','project:write','project:delete','crawl:run','test:generate','test:review','test:run','test:delete','run:execute','run:cancel','run:schedule','run:share','connector:manage','connector:read','audit:read','visual:manage','skill-file:approve','member:invite','member:manage','extension:write','analytics:read','report:send','coverage:export','coverage:remap','performance:alert','artifact:delete','import:manage','token-usage:read','billing:read','mcp:access','workspace:session-manage'], "updatedAt" = NOW()
+  WHERE "roleName" = 'ADMIN';
+
+UPDATE "role_configs" SET "permissions" = ARRAY['workspace:manage','project:create','project:read','project:write','project:delete','crawl:run','test:generate','test:review','test:run','test:delete','run:execute','run:cancel','run:schedule','run:share','connector:manage','connector:read','audit:read','visual:manage','skill-file:approve','member:invite','member:manage','extension:write','analytics:read','report:send','coverage:export','coverage:remap','performance:alert','artifact:delete','import:manage','token-usage:read','billing:read','billing:manage','mcp:access','workspace:session-manage'], "updatedAt" = NOW()
+  WHERE "roleName" = 'OWNER';
+
+-- Insert any missing built-in roles (in case the initial seed never ran)
+INSERT INTO "role_configs" ("roleName", "rank", "permissions", "updatedAt")
+VALUES
+  ('VIEWER',    1, ARRAY['project:read','connector:read','audit:read','analytics:read'], NOW()),
+  ('TESTER',    2, ARRAY['project:read','crawl:run','test:generate','test:review','test:run','run:execute','run:cancel','run:share','connector:read','extension:write','analytics:read','report:send','coverage:export'], NOW()),
+  ('DEVELOPER', 2, ARRAY['project:read','crawl:run','test:generate','test:run','run:execute','connector:read','extension:write','mcp:access'], NOW()),
+  ('QA_LEAD',   3, ARRAY['project:create','project:read','project:write','crawl:run','test:generate','test:review','test:run','test:delete','run:execute','run:cancel','run:schedule','run:share','connector:manage','connector:read','visual:manage','skill-file:approve','member:invite','extension:write','analytics:read','report:send','coverage:export','coverage:remap','performance:alert','artifact:delete','import:manage','token-usage:read','mcp:access'], NOW()),
+  ('ADMIN',     4, ARRAY['project:create','project:read','project:write','project:delete','crawl:run','test:generate','test:review','test:run','test:delete','run:execute','run:cancel','run:schedule','run:share','connector:manage','connector:read','audit:read','visual:manage','skill-file:approve','member:invite','member:manage','extension:write','analytics:read','report:send','coverage:export','coverage:remap','performance:alert','artifact:delete','import:manage','token-usage:read','billing:read','mcp:access','workspace:session-manage'], NOW()),
+  ('OWNER',     5, ARRAY['workspace:manage','project:create','project:read','project:write','project:delete','crawl:run','test:generate','test:review','test:run','test:delete','run:execute','run:cancel','run:schedule','run:share','connector:manage','connector:read','audit:read','visual:manage','skill-file:approve','member:invite','member:manage','extension:write','analytics:read','report:send','coverage:export','coverage:remap','performance:alert','artifact:delete','import:manage','token-usage:read','billing:read','billing:manage','mcp:access','workspace:session-manage'], NOW())
+ON CONFLICT ("roleName") DO NOTHING;

package/prisma/migrations/20260909000000_add_filepath_to_testscript/migration.sql

@@ -0,0 +1,5 @@
+-- Add filePath column to TestScript.
+-- This column was added to schema.prisma in commit 2ee9eed9 without a corresponding
+-- migration, causing Prisma to SELECT a non-existent column → 500 on any query
+-- that includes TestScript (e.g. listTestCases with scripts: true).
+ALTER TABLE "TestScript" ADD COLUMN IF NOT EXISTS "filePath" TEXT;

package/prisma/migrations/20260909000001_add_alignment_result_table/migration.sql

@@ -0,0 +1,31 @@
+-- CreateTable: AlignmentResult
+-- Dedicated table for AI alignment verification results.
+-- Replaces the previous hack of storing JSON blobs in TestScript rows
+-- with a synthetic language suffix (e.g. 'playwright-ts:alignment').
+
+CREATE TABLE "AlignmentResult" (
+    "id" TEXT NOT NULL,
+    "tenantId" TEXT NOT NULL,
+    "projectId" TEXT NOT NULL,
+    "testCaseId" TEXT NOT NULL,
+    "language" TEXT NOT NULL,
+    "score" INTEGER NOT NULL DEFAULT 0,
+    "aligned" BOOLEAN NOT NULL DEFAULT false,
+    "issues" JSONB NOT NULL DEFAULT '[]',
+    "verifiedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "AlignmentResult_pkey" PRIMARY KEY ("id")
+);
+
+CREATE UNIQUE INDEX "AlignmentResult_testCaseId_language_key" ON "AlignmentResult"("testCaseId", "language");
+CREATE INDEX "AlignmentResult_tenantId_projectId_idx" ON "AlignmentResult"("tenantId", "projectId");
+CREATE INDEX "AlignmentResult_tenantId_testCaseId_idx" ON "AlignmentResult"("tenantId", "testCaseId");
+
+-- Apply Row-Level Security (same pattern as all other tenant tables).
+ALTER TABLE "AlignmentResult" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "AlignmentResult" FORCE ROW LEVEL SECURITY;
+CREATE POLICY tenant_isolation ON "AlignmentResult"
+  USING ("tenantId" = current_setting('app.current_tenant', true))
+  WITH CHECK ("tenantId" = current_setting('app.current_tenant', true));

package/prisma/migrations/20260910000000_add_admin_mfa/migration.sql

@@ -0,0 +1,35 @@
+ALTER TABLE "AdminUser"
+  ADD COLUMN "mfaEnabled" BOOLEAN NOT NULL DEFAULT false,
+  ADD COLUMN "mfaSecret_enc" TEXT,
+  ADD COLUMN "mfaVerifiedAt" TIMESTAMP(3);
+
+CREATE TABLE "AdminMfaRecoveryCode" (
+  "id" TEXT NOT NULL,
+  "adminId" TEXT NOT NULL,
+  "codeHash" TEXT NOT NULL,
+  "usedAt" TIMESTAMP(3),
+  "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT "AdminMfaRecoveryCode_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "AdminMfaChallenge" (
+  "id" TEXT NOT NULL,
+  "adminId" TEXT NOT NULL,
+  "purpose" TEXT NOT NULL,
+  "expiresAt" TIMESTAMP(3) NOT NULL,
+  "usedAt" TIMESTAMP(3),
+  "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  CONSTRAINT "AdminMfaChallenge_pkey" PRIMARY KEY ("id")
+);
+
+CREATE INDEX "AdminMfaRecoveryCode_adminId_idx" ON "AdminMfaRecoveryCode"("adminId");
+CREATE INDEX "AdminMfaChallenge_adminId_purpose_usedAt_idx" ON "AdminMfaChallenge"("adminId", "purpose", "usedAt");
+CREATE INDEX "AdminMfaChallenge_expiresAt_idx" ON "AdminMfaChallenge"("expiresAt");
+
+ALTER TABLE "AdminMfaRecoveryCode"
+  ADD CONSTRAINT "AdminMfaRecoveryCode_adminId_fkey"
+  FOREIGN KEY ("adminId") REFERENCES "AdminUser"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "AdminMfaChallenge"
+  ADD CONSTRAINT "AdminMfaChallenge_adminId_fkey"
+  FOREIGN KEY ("adminId") REFERENCES "AdminUser"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20260910000000_add_dom_snapshot_cloud_url/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "Screen" ADD COLUMN "domSnapshotCloudUrl" TEXT;

package/prisma/migrations/20260910000001_add_requires_auth_to_screen/migration.sql

@@ -0,0 +1 @@
+ALTER TABLE "Screen" ADD COLUMN "requiresAuth" BOOLEAN NOT NULL DEFAULT false;

package/prisma/migrations/20260910000002_add_screen_requires_auth/migration.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "Screen"
+ADD COLUMN IF NOT EXISTS "requiresAuth" BOOLEAN NOT NULL DEFAULT false;

package/prisma/migrations/20260910000003_add_admin_auth_sessions/migration.sql

@@ -0,0 +1,17 @@
+CREATE TABLE "AdminAuthSession" (
+  "id" TEXT NOT NULL,
+  "adminId" TEXT NOT NULL,
+  "userAgent" TEXT,
+  "ipAddress" TEXT,
+  "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "lastSeenAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  "revokedAt" TIMESTAMP(3),
+  CONSTRAINT "AdminAuthSession_pkey" PRIMARY KEY ("id")
+);
+
+CREATE INDEX "AdminAuthSession_adminId_idx" ON "AdminAuthSession"("adminId");
+CREATE INDEX "AdminAuthSession_lastSeenAt_idx" ON "AdminAuthSession"("lastSeenAt");
+
+ALTER TABLE "AdminAuthSession"
+  ADD CONSTRAINT "AdminAuthSession_adminId_fkey"
+  FOREIGN KEY ("adminId") REFERENCES "AdminUser"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20260916000001_add_admin_last_login/migration.sql

@@ -0,0 +1 @@
+ALTER TABLE "AdminUser" ADD COLUMN "lastLoginAt" TIMESTAMP(3);

package/prisma/migrations/20260916000002_add_admin_failed_login/migration.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "AdminUser" ADD COLUMN "failedLoginCount" INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE "AdminUser" ADD COLUMN "lastFailedLoginAt" TIMESTAMP(3);

package/prisma/migrations/20260916000003_seed_system_tenant/migration.sql

@@ -0,0 +1,6 @@
+-- Sentinel tenant for platform-admin audit events that have no tenant context
+-- (e.g. admin.login / admin.login.failed). AuditLog.tenantId is NOT NULL with
+-- an enforced FK, so a real Tenant row is required. Idempotent.
+INSERT INTO "Tenant" (id, name, slug, isolation, region)
+VALUES ('system', 'Platform (System)', 'system', 'POOL', 'GLOBAL')
+ON CONFLICT (id) DO NOTHING;

package/prisma/migrations/20260918000000_fix_permissions_comprehensive/migration.sql

@@ -0,0 +1,63 @@
+-- ============================================================================
+--  Comprehensive permissions fix
+--
+--  Gaps fixed:
+--  1. ALTER DEFAULT PRIVILEGES was missing FOR ROLE zeta_admin — tables created
+--     by zeta_admin in migrations after 0002 did not auto-grant to qip_app.
+--     This caused 42501 on Notification, ScreenGroup, WebhookDelivery, etc.
+--
+--  2. Eight tables have ENABLE ROW LEVEL SECURITY but not FORCE ROW LEVEL
+--     SECURITY, allowing the table owner (zeta_admin / migration role) to
+--     bypass RLS silently. Consistent with all other tenant-scoped tables.
+--
+--  3. Re-grants all existing tables and sequences to qip_app (catchup for
+--     any table created after the initial 0002 grant ran without default privs).
+-- ============================================================================
+
+-- ---- 1. Fix DEFAULT PRIVILEGES so future tables auto-grant to qip_app ------
+-- Without FOR ROLE the grant only applies to the role that ran migration 0002,
+-- not to zeta_admin which creates all schema objects in production migrations.
+DO $$
+BEGIN
+  -- Set default privileges for zeta_admin-created objects going forward.
+  -- Idempotent: repeated runs are harmless.
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'zeta_admin') THEN
+    EXECUTE $q$ALTER DEFAULT PRIVILEGES FOR ROLE zeta_admin IN SCHEMA public
+              GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO qip_app$q$;
+    EXECUTE $q$ALTER DEFAULT PRIVILEGES FOR ROLE zeta_admin IN SCHEMA public
+              GRANT USAGE, SELECT, UPDATE ON SEQUENCES TO qip_app$q$;
+  END IF;
+END $$;
+
+-- ---- 2. Catchup grant: all tables and sequences that exist right now --------
+GRANT USAGE ON SCHEMA public TO qip_app;
+GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO qip_app;
+GRANT USAGE, SELECT, UPDATE ON ALL SEQUENCES IN SCHEMA public TO qip_app;
+
+-- ---- 3. Add FORCE ROW LEVEL SECURITY to tables missing it ------------------
+-- These tables have RLS enabled but not FORCE, letting the owner bypass policies.
+DO $$
+DECLARE
+  t text;
+  tables text[] := ARRAY[
+    'TenantSetting',
+    'AgentToken',
+    'Webhook',
+    'ProjectArtifact',
+    'KnowledgeChunk',
+    'Invitation',
+    'ProjectMember',
+    'CustomRole'
+  ];
+BEGIN
+  FOREACH t IN ARRAY tables LOOP
+    -- Only apply if table exists and RLS is already enabled
+    IF EXISTS (
+      SELECT 1 FROM pg_class c
+      JOIN pg_namespace n ON n.oid = c.relnamespace
+      WHERE c.relname = t AND n.nspname = 'public' AND c.relrowsecurity = true
+    ) THEN
+      EXECUTE format('ALTER TABLE "%s" FORCE ROW LEVEL SECURITY;', t);
+    END IF;
+  END LOOP;
+END $$;

package/prisma/migrations/20260924000000_add_screen_role_access/migration.sql

@@ -0,0 +1,2 @@
+-- Add roleAccess column to Screen for multi-role crawl tracking
+ALTER TABLE "Screen" ADD COLUMN IF NOT EXISTS "roleAccess" TEXT[] NOT NULL DEFAULT '{}';

package/prisma/migrations/20260928000000_add_navigation_graph/migration.sql

@@ -0,0 +1,41 @@
+-- Navigation Knowledge Graph: Phase 1 schema additions
+
+-- Screen: add crawl depth and parent URL for graph traversal
+ALTER TABLE "Screen" ADD COLUMN IF NOT EXISTS "depth" INTEGER;
+ALTER TABLE "Screen" ADD COLUMN IF NOT EXISTS "parentUrl" TEXT;
+
+-- DiscoveredLink: hyperlink edges between screens discovered during crawl
+CREATE TABLE IF NOT EXISTS "DiscoveredLink" (
+    "id"           TEXT NOT NULL,
+    "tenantId"     TEXT NOT NULL,
+    "projectId"    TEXT NOT NULL,
+    "fromScreenId" TEXT NOT NULL,
+    "toScreenId"   TEXT,
+    "href"         TEXT NOT NULL,
+    "text"         TEXT,
+    "landmark"     TEXT,
+    "linkType"     TEXT NOT NULL DEFAULT 'NAV_LINK',
+    "source"       TEXT NOT NULL DEFAULT 'DOM',
+    "confidence"   DOUBLE PRECISION NOT NULL DEFAULT 1.0,
+    "jobId"        TEXT,
+    "createdAt"    TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "DiscoveredLink_pkey" PRIMARY KEY ("id")
+);
+
+-- Foreign keys
+ALTER TABLE "DiscoveredLink" ADD CONSTRAINT "DiscoveredLink_projectId_fkey"
+    FOREIGN KEY ("projectId") REFERENCES "Project"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "DiscoveredLink" ADD CONSTRAINT "DiscoveredLink_fromScreenId_fkey"
+    FOREIGN KEY ("fromScreenId") REFERENCES "Screen"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "DiscoveredLink" ADD CONSTRAINT "DiscoveredLink_toScreenId_fkey"
+    FOREIGN KEY ("toScreenId") REFERENCES "Screen"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- Indexes
+CREATE INDEX IF NOT EXISTS "DiscoveredLink_tenantId_projectId_idx" ON "DiscoveredLink"("tenantId", "projectId");
+CREATE INDEX IF NOT EXISTS "DiscoveredLink_tenantId_projectId_jobId_idx" ON "DiscoveredLink"("tenantId", "projectId", "jobId");
+CREATE INDEX IF NOT EXISTS "DiscoveredLink_fromScreenId_idx" ON "DiscoveredLink"("fromScreenId");
+CREATE INDEX IF NOT EXISTS "DiscoveredLink_toScreenId_idx" ON "DiscoveredLink"("toScreenId");
+CREATE INDEX IF NOT EXISTS "DiscoveredLink_href_idx" ON "DiscoveredLink"("href");