autopilot-core-sandbox 0.0.1

package/dist/dist/migrations/20260829090912_fleet_rls.sql

@@ -0,0 +1,1011 @@
+-- Row-level security and least-privilege grants for Autopilot Fleet V1.
+--
+-- Affected tables:
+--   fleet_organization, fleet_member, fleet_vehicle,
+--   fleet_form_template, fleet_form_template_version, fleet_form_section,
+--   fleet_form_question, fleet_form_assignment, fleet_inspection,
+--   fleet_inspection_answer, fleet_media, fleet_issue,
+--   fleet_issue_status_history, fleet_issue_comment, fleet_repair_order,
+--   fleet_repair_order_line_item, fleet_pm_schedule, fleet_service_record,
+--   fleet_notification_preference, fleet_audit_event, storage.objects
+--   (policies scoped only to the private fleet-media bucket).
+--
+-- Every policy first proves the JWT company claim and an active Fleet
+-- membership backed by a current, visible public.user employee row. Helpers
+-- are SECURITY DEFINER to avoid recursive fleet_member RLS evaluation; each
+-- helper binds its decision to auth.uid() and the JWT company claim.
+
+-- ============================================================
+-- Policy helpers
+-- ============================================================
+
+create or replace function "public"."fleet_current_company_id"()
+returns uuid
+language sql
+stable
+set search_path = ''
+as $$
+    select nullif(
+        trim(both '"' from (
+            "public"."get_my_claim"('autopilot_company_id'::text)
+        )::text),
+        ''
+    )::uuid;
+$$;
+
+alter function "public"."fleet_current_company_id"() owner to "postgres";
+
+create or replace function "public"."fleet_has_any_role"(
+    "p_company_id" uuid,
+    "p_roles" text[]
+)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+    select
+        "p_company_id" is not null
+        and "p_company_id" = "public"."fleet_current_company_id"()
+        and exists (
+            select 1
+            from "public"."fleet_member" as "member"
+            join "public"."user" as "employee"
+              on "employee"."id" = "member"."user_id"
+             and "employee"."company_id" = "member"."company_id"
+            where "member"."company_id" = "p_company_id"
+              and "member"."user_id" = (select auth.uid())
+              and "member"."is_active"
+              and "member"."role" = any("p_roles")
+              and "employee"."is_current_employee"
+              and not "employee"."is_hidden"
+        );
+$$;
+
+alter function "public"."fleet_has_any_role"(uuid, text[]) owner to "postgres";
+
+create or replace function "public"."fleet_is_member"("p_company_id" uuid)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+    select "public"."fleet_has_any_role"(
+        "p_company_id",
+        array['owner', 'manager', 'operator', 'technician', 'viewer']::text[]
+    );
+$$;
+
+alter function "public"."fleet_is_member"(uuid) owner to "postgres";
+
+create or replace function "public"."fleet_can_bootstrap_owner"(
+    "p_company_id" uuid,
+    "p_user_id" uuid
+)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+    select
+        "p_company_id" is not null
+        and "p_company_id" = "public"."fleet_current_company_id"()
+        and "p_user_id" = (select auth.uid())
+        and coalesce(
+            "public"."get_my_claim"('autopilot_role'::text)::text,
+            ''::text
+        ) = '"owner"'::text
+        and exists (
+            select 1
+            from "public"."user_role" as "autopilot_membership"
+            where "autopilot_membership"."company_id" = "p_company_id"
+              and "autopilot_membership"."user_id" = "p_user_id"
+              and "autopilot_membership"."role_id" = 1
+        )
+        and exists (
+            select 1
+            from "public"."user" as "employee"
+            where "employee"."id" = "p_user_id"
+              and "employee"."company_id" = "p_company_id"
+              and "employee"."is_current_employee"
+              and not "employee"."is_hidden"
+        )
+        -- Permit recovery when old Fleet rows exist but no current, visible
+        -- employee still holds active Fleet ownership. The canonical
+        -- Autopilot owner can reactivate/upgrade their own membership below.
+        and not exists (
+            select 1
+            from "public"."fleet_member" as "existing_owner"
+            join "public"."user" as "owner_employee"
+              on "owner_employee"."id" = "existing_owner"."user_id"
+             and "owner_employee"."company_id" = "existing_owner"."company_id"
+            where "existing_owner"."company_id" = "p_company_id"
+              and "existing_owner"."user_id" <> "p_user_id"
+              and "existing_owner"."role" = 'owner'
+              and "existing_owner"."is_active"
+              and "owner_employee"."is_current_employee"
+              and not "owner_employee"."is_hidden"
+        );
+$$;
+
+alter function "public"."fleet_can_bootstrap_owner"(uuid, uuid)
+owner to "postgres";
+
+create or replace function "public"."fleet_can_edit_inspection"(
+    "p_company_id" uuid,
+    "p_inspection_id" uuid
+)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+    select
+        "public"."fleet_has_any_role"(
+            "p_company_id",
+            array['owner', 'manager', 'operator', 'technician']::text[]
+        )
+        and exists (
+            select 1
+            from "public"."fleet_inspection" as "inspection"
+            where "inspection"."id" = "p_inspection_id"
+              and "inspection"."company_id" = "p_company_id"
+              and "inspection"."inspector_user_id" = (select auth.uid())
+              and "inspection"."status" = 'draft'
+        );
+$$;
+
+alter function "public"."fleet_can_edit_inspection"(uuid, uuid)
+owner to "postgres";
+
+create or replace function "public"."fleet_can_write_media"(
+    "p_company_id" uuid,
+    "p_inspection_id" uuid,
+    "p_answer_id" uuid,
+    "p_issue_id" uuid,
+    "p_issue_comment_id" uuid,
+    "p_repair_order_id" uuid,
+    "p_service_record_id" uuid
+)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+    select case
+        when "p_inspection_id" is not null then
+            "public"."fleet_can_edit_inspection"(
+                "p_company_id", "p_inspection_id"
+            )
+        when "p_answer_id" is not null then
+            exists (
+                select 1
+                from "public"."fleet_inspection_answer" as "answer"
+                where "answer"."id" = "p_answer_id"
+                  and "answer"."company_id" = "p_company_id"
+                  and "public"."fleet_can_edit_inspection"(
+                      "p_company_id", "answer"."inspection_id"
+                  )
+            )
+        when "p_issue_id" is not null then
+            "public"."fleet_has_any_role"(
+                "p_company_id",
+                array['owner', 'manager', 'operator', 'technician']::text[]
+            )
+            and exists (
+                select 1
+                from "public"."fleet_issue" as "issue"
+                where "issue"."id" = "p_issue_id"
+                  and "issue"."company_id" = "p_company_id"
+            )
+        when "p_issue_comment_id" is not null then
+            "public"."fleet_has_any_role"(
+                "p_company_id",
+                array['owner', 'manager', 'operator', 'technician']::text[]
+            )
+            and exists (
+                select 1
+                from "public"."fleet_issue_comment" as "comment"
+                where "comment"."id" = "p_issue_comment_id"
+                  and "comment"."company_id" = "p_company_id"
+            )
+        when "p_repair_order_id" is not null then
+            "public"."fleet_has_any_role"(
+                "p_company_id", array['owner', 'manager', 'technician']::text[]
+            )
+            and exists (
+                select 1
+                from "public"."fleet_repair_order" as "repair_order"
+                where "repair_order"."id" = "p_repair_order_id"
+                  and "repair_order"."company_id" = "p_company_id"
+            )
+        when "p_service_record_id" is not null then
+            "public"."fleet_has_any_role"(
+                "p_company_id", array['owner', 'manager', 'technician']::text[]
+            )
+            and exists (
+                select 1
+                from "public"."fleet_service_record" as "service_record"
+                where "service_record"."id" = "p_service_record_id"
+                  and "service_record"."company_id" = "p_company_id"
+            )
+        else false
+    end;
+$$;
+
+alter function "public"."fleet_can_write_media"(
+    uuid, uuid, uuid, uuid, uuid, uuid, uuid
+) owner to "postgres";
+
+-- Keep internal lifecycle functions out of the PostgREST/RPC surface. Trigger
+-- execution does not depend on caller EXECUTE privileges.
+revoke all on function "public"."fleet_set_updated_at"() from public, anon, authenticated;
+revoke all on function "public"."fleet_guard_vehicle_status"()
+    from public, anon, authenticated;
+revoke all on function "public"."fleet_prepare_member"() from public, anon, authenticated;
+revoke all on function "public"."fleet_build_form_version_snapshot"(uuid)
+    from public, anon, authenticated;
+revoke all on function "public"."fleet_prepare_form_version"() from public, anon, authenticated;
+revoke all on function "public"."fleet_guard_form_version_child"()
+    from public, anon, authenticated;
+revoke all on function "public"."fleet_validate_form_assignment"()
+    from public, anon, authenticated;
+revoke all on function "public"."fleet_prepare_inspection_answer"()
+    from public, anon, authenticated;
+revoke all on function "public"."fleet_question_condition_met"(uuid, uuid, jsonb)
+    from public, anon, authenticated;
+revoke all on function "public"."fleet_prepare_inspection"() from public, anon, authenticated;
+revoke all on function "public"."fleet_guard_inspection_media"()
+    from public, anon, authenticated;
+revoke all on function "public"."fleet_prepare_issue"() from public, anon, authenticated;
+revoke all on function "public"."fleet_record_issue_status"()
+    from public, anon, authenticated;
+revoke all on function "public"."fleet_reject_mutation"() from public, anon, authenticated;
+revoke all on function "public"."fleet_prepare_repair_order"()
+    from public, anon, authenticated;
+revoke all on function "public"."fleet_guard_repair_line_item"()
+    from public, anon, authenticated;
+revoke all on function "public"."fleet_prepare_pm_schedule"()
+    from public, anon, authenticated;
+revoke all on function "public"."fleet_prepare_service_record"()
+    from public, anon, authenticated;
+revoke all on function "public"."fleet_apply_service_record"()
+    from public, anon, authenticated;
+revoke all on function "public"."fleet_write_audit_event"()
+    from public, anon, authenticated;
+revoke all on function "public"."fleet_seed_default_form_templates"(uuid, uuid)
+    from public, anon, authenticated;
+revoke all on function "public"."fleet_seed_default_form_templates_trigger"()
+    from public, anon, authenticated;
+
+revoke all on function "public"."fleet_current_company_id"()
+    from public, anon;
+revoke all on function "public"."fleet_has_any_role"(uuid, text[])
+    from public, anon;
+revoke all on function "public"."fleet_is_member"(uuid)
+    from public, anon;
+revoke all on function "public"."fleet_can_bootstrap_owner"(uuid, uuid)
+    from public, anon;
+revoke all on function "public"."fleet_can_edit_inspection"(uuid, uuid)
+    from public, anon;
+revoke all on function "public"."fleet_can_write_media"(
+    uuid, uuid, uuid, uuid, uuid, uuid, uuid
+) from public, anon;
+
+grant execute on function "public"."fleet_current_company_id"()
+    to authenticated, service_role;
+grant execute on function "public"."fleet_has_any_role"(uuid, text[])
+    to authenticated, service_role;
+grant execute on function "public"."fleet_is_member"(uuid)
+    to authenticated, service_role;
+grant execute on function "public"."fleet_can_bootstrap_owner"(uuid, uuid)
+    to authenticated, service_role;
+grant execute on function "public"."fleet_can_edit_inspection"(uuid, uuid)
+    to authenticated, service_role;
+grant execute on function "public"."fleet_can_write_media"(
+    uuid, uuid, uuid, uuid, uuid, uuid, uuid
+) to authenticated, service_role;
+grant execute on function "public"."fleet_seed_default_form_templates"(uuid, uuid)
+    to service_role;
+
+-- ============================================================
+-- RLS enablement and base grants
+-- ============================================================
+
+alter table "public"."fleet_organization" enable row level security;
+alter table "public"."fleet_member" enable row level security;
+alter table "public"."fleet_vehicle" enable row level security;
+alter table "public"."fleet_form_template" enable row level security;
+alter table "public"."fleet_form_template_version" enable row level security;
+alter table "public"."fleet_form_section" enable row level security;
+alter table "public"."fleet_form_question" enable row level security;
+alter table "public"."fleet_form_assignment" enable row level security;
+alter table "public"."fleet_inspection" enable row level security;
+alter table "public"."fleet_inspection_answer" enable row level security;
+alter table "public"."fleet_media" enable row level security;
+alter table "public"."fleet_issue" enable row level security;
+alter table "public"."fleet_issue_status_history" enable row level security;
+alter table "public"."fleet_issue_comment" enable row level security;
+alter table "public"."fleet_repair_order" enable row level security;
+alter table "public"."fleet_repair_order_line_item" enable row level security;
+alter table "public"."fleet_pm_schedule" enable row level security;
+alter table "public"."fleet_service_record" enable row level security;
+alter table "public"."fleet_notification_preference" enable row level security;
+alter table "public"."fleet_audit_event" enable row level security;
+
+do $$
+declare
+    "v_table" text;
+begin
+    foreach "v_table" in array array[
+        'fleet_organization', 'fleet_member', 'fleet_vehicle',
+        'fleet_form_template', 'fleet_form_template_version',
+        'fleet_form_section', 'fleet_form_question', 'fleet_form_assignment',
+        'fleet_inspection', 'fleet_inspection_answer', 'fleet_media',
+        'fleet_issue', 'fleet_issue_status_history', 'fleet_issue_comment',
+        'fleet_repair_order', 'fleet_repair_order_line_item',
+        'fleet_pm_schedule', 'fleet_service_record',
+        'fleet_notification_preference', 'fleet_audit_event'
+    ]
+    loop
+        execute format(
+            'revoke all on table public.%I from public, anon, authenticated',
+            "v_table"
+        );
+        execute format('grant all on table public.%I to service_role', "v_table");
+    end loop;
+end;
+$$;
+
+grant select, insert, update on table "public"."fleet_organization" to authenticated;
+grant select, insert, update on table "public"."fleet_member" to authenticated;
+grant select, insert, update on table "public"."fleet_vehicle" to authenticated;
+grant select, insert, update on table "public"."fleet_form_template" to authenticated;
+grant select, insert, update, delete on table "public"."fleet_form_template_version"
+    to authenticated;
+grant select, insert, update, delete on table "public"."fleet_form_section"
+    to authenticated;
+grant select, insert, update, delete on table "public"."fleet_form_question"
+    to authenticated;
+grant select, insert, update, delete on table "public"."fleet_form_assignment"
+    to authenticated;
+grant select, insert, update on table "public"."fleet_inspection" to authenticated;
+grant select, insert, update, delete on table "public"."fleet_inspection_answer"
+    to authenticated;
+grant select, insert, update, delete on table "public"."fleet_media" to authenticated;
+grant select, insert, update on table "public"."fleet_issue" to authenticated;
+grant select on table "public"."fleet_issue_status_history" to authenticated;
+grant select, insert on table "public"."fleet_issue_comment" to authenticated;
+grant select, insert, update on table "public"."fleet_repair_order" to authenticated;
+grant select, insert, update, delete on table "public"."fleet_repair_order_line_item"
+    to authenticated;
+grant select, insert, update on table "public"."fleet_pm_schedule" to authenticated;
+grant select, insert, update on table "public"."fleet_service_record" to authenticated;
+grant select, insert, update, delete on table "public"."fleet_notification_preference"
+    to authenticated;
+grant select on table "public"."fleet_audit_event" to authenticated;
+
+-- ============================================================
+-- Organization, membership, vehicles, and form configuration
+-- ============================================================
+
+create policy "Fleet members can view their organization"
+on "public"."fleet_organization"
+for select to authenticated
+using ((select "public"."fleet_is_member"("company_id")));
+
+create policy "Autopilot owner can create first Fleet organization"
+on "public"."fleet_organization"
+for insert to authenticated
+with check ((select "public"."fleet_can_bootstrap_owner"(
+    "company_id", (select auth.uid())
+)) and "created_by" = (select auth.uid()));
+
+create policy "Fleet owners and managers can update organization"
+on "public"."fleet_organization"
+for update to authenticated
+using ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)))
+with check ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)));
+
+create policy "Fleet members can view memberships"
+on "public"."fleet_member"
+for select to authenticated
+using (
+    (select "public"."fleet_is_member"("company_id"))
+    or (
+        "user_id" = (select auth.uid())
+        and (select "public"."fleet_can_bootstrap_owner"(
+            "company_id", "user_id"
+        ))
+    )
+);
+
+create policy "Fleet owner bootstrap or leadership can add memberships"
+on "public"."fleet_member"
+for insert to authenticated
+with check (
+    "created_by" = (select auth.uid())
+    and (
+        (select "public"."fleet_has_any_role"(
+            "company_id", array['owner']::text[]
+        ))
+        or (
+            "role" <> 'owner'
+            and (select "public"."fleet_has_any_role"(
+                "company_id", array['manager']::text[]
+            ))
+        )
+        or (
+            "role" = 'owner'
+            and "is_active"
+            and (select "public"."fleet_can_bootstrap_owner"(
+                "company_id", "user_id"
+            ))
+        )
+    )
+);
+
+create policy "Fleet leadership can update memberships"
+on "public"."fleet_member"
+for update to authenticated
+using (
+    (select "public"."fleet_has_any_role"(
+        "company_id", array['owner']::text[]
+    ))
+    or (
+        "role" <> 'owner'
+        and (select "public"."fleet_has_any_role"(
+            "company_id", array['manager']::text[]
+        ))
+    )
+    or (
+        "user_id" = (select auth.uid())
+        and (select "public"."fleet_can_bootstrap_owner"(
+            "company_id", "user_id"
+        ))
+    )
+)
+with check (
+    (select "public"."fleet_has_any_role"(
+        "company_id", array['owner']::text[]
+    ))
+    or (
+        "role" <> 'owner'
+        and (select "public"."fleet_has_any_role"(
+            "company_id", array['manager']::text[]
+        ))
+    )
+    or (
+        "user_id" = (select auth.uid())
+        and "role" = 'owner'
+        and "is_active"
+        and (select "public"."fleet_can_bootstrap_owner"(
+            "company_id", "user_id"
+        ))
+    )
+);
+
+create policy "Fleet members can view vehicles"
+on "public"."fleet_vehicle"
+for select to authenticated
+using ((select "public"."fleet_is_member"("company_id")));
+
+create policy "Fleet owners and managers can add vehicles"
+on "public"."fleet_vehicle"
+for insert to authenticated
+with check ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)) and "created_by" = (select auth.uid()));
+
+create policy "Fleet owners and managers can update vehicles"
+on "public"."fleet_vehicle"
+for update to authenticated
+using ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)))
+with check ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)));
+
+create policy "Fleet members can view form templates"
+on "public"."fleet_form_template"
+for select to authenticated
+using ((select "public"."fleet_is_member"("company_id")));
+
+create policy "Fleet leadership can add form templates"
+on "public"."fleet_form_template"
+for insert to authenticated
+with check ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)) and "created_by" = (select auth.uid()));
+
+create policy "Fleet leadership can update form templates"
+on "public"."fleet_form_template"
+for update to authenticated
+using ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)))
+with check ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)));
+
+create policy "Fleet members can view form versions"
+on "public"."fleet_form_template_version"
+for select to authenticated
+using ((select "public"."fleet_is_member"("company_id")));
+
+create policy "Fleet leadership can add form versions"
+on "public"."fleet_form_template_version"
+for insert to authenticated
+with check ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)) and "created_by" = (select auth.uid()));
+
+create policy "Fleet leadership can update form versions"
+on "public"."fleet_form_template_version"
+for update to authenticated
+using ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)))
+with check ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)));
+
+create policy "Fleet leadership can delete draft form versions"
+on "public"."fleet_form_template_version"
+for delete to authenticated
+using (
+    "status" = 'draft'
+    and (select "public"."fleet_has_any_role"(
+        "company_id", array['owner', 'manager']::text[]
+    ))
+);
+
+create policy "Fleet members can view form sections"
+on "public"."fleet_form_section"
+for select to authenticated
+using ((select "public"."fleet_is_member"("company_id")));
+
+create policy "Fleet leadership can add form sections"
+on "public"."fleet_form_section"
+for insert to authenticated
+with check ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)));
+
+create policy "Fleet leadership can update form sections"
+on "public"."fleet_form_section"
+for update to authenticated
+using ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)))
+with check ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)));
+
+create policy "Fleet leadership can delete form sections"
+on "public"."fleet_form_section"
+for delete to authenticated
+using ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)));
+
+create policy "Fleet members can view form questions"
+on "public"."fleet_form_question"
+for select to authenticated
+using ((select "public"."fleet_is_member"("company_id")));
+
+create policy "Fleet leadership can add form questions"
+on "public"."fleet_form_question"
+for insert to authenticated
+with check ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)));
+
+create policy "Fleet leadership can update form questions"
+on "public"."fleet_form_question"
+for update to authenticated
+using ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)))
+with check ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)));
+
+create policy "Fleet leadership can delete form questions"
+on "public"."fleet_form_question"
+for delete to authenticated
+using ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)));
+
+create policy "Fleet members can view form assignments"
+on "public"."fleet_form_assignment"
+for select to authenticated
+using ((select "public"."fleet_is_member"("company_id")));
+
+create policy "Fleet leadership can add form assignments"
+on "public"."fleet_form_assignment"
+for insert to authenticated
+with check ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)) and "created_by" = (select auth.uid()));
+
+create policy "Fleet leadership can update form assignments"
+on "public"."fleet_form_assignment"
+for update to authenticated
+using ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)))
+with check ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)));
+
+create policy "Fleet leadership can delete form assignments"
+on "public"."fleet_form_assignment"
+for delete to authenticated
+using ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)));
+
+-- ============================================================
+-- Inspection execution, evidence, and issue lifecycle
+-- ============================================================
+
+create policy "Fleet members can view inspections"
+on "public"."fleet_inspection"
+for select to authenticated
+using ((select "public"."fleet_is_member"("company_id")));
+
+create policy "Fleet operational roles can start inspections"
+on "public"."fleet_inspection"
+for insert to authenticated
+with check (
+    "inspector_user_id" = (select auth.uid())
+    and "created_by" = (select auth.uid())
+    and (select "public"."fleet_has_any_role"(
+        "company_id", array['owner', 'manager', 'operator', 'technician']::text[]
+    ))
+);
+
+create policy "Fleet inspectors can update their drafts"
+on "public"."fleet_inspection"
+for update to authenticated
+using ((select "public"."fleet_can_edit_inspection"(
+    "company_id", "id"
+)))
+with check (
+    "inspector_user_id" = (select auth.uid())
+    and (select "public"."fleet_has_any_role"(
+        "company_id", array['owner', 'manager', 'operator', 'technician']::text[]
+    ))
+);
+
+create policy "Fleet members can view inspection answers"
+on "public"."fleet_inspection_answer"
+for select to authenticated
+using ((select "public"."fleet_is_member"("company_id")));
+
+create policy "Fleet inspection editors can add answers"
+on "public"."fleet_inspection_answer"
+for insert to authenticated
+with check (
+    (select "public"."fleet_can_edit_inspection"(
+        "company_id", "inspection_id"
+    ))
+    and "answered_by" = (select auth.uid())
+);
+
+create policy "Fleet inspection editors can update answers"
+on "public"."fleet_inspection_answer"
+for update to authenticated
+using (
+    "answered_by" = (select auth.uid())
+    and (select "public"."fleet_can_edit_inspection"(
+        "company_id", "inspection_id"
+    ))
+)
+with check (
+    (select "public"."fleet_can_edit_inspection"(
+        "company_id", "inspection_id"
+    ))
+    and "answered_by" = (select auth.uid())
+);
+
+create policy "Fleet inspection editors can delete draft answers"
+on "public"."fleet_inspection_answer"
+for delete to authenticated
+using ((select "public"."fleet_can_edit_inspection"(
+    "company_id", "inspection_id"
+)) and "answered_by" = (select auth.uid()));
+
+create policy "Fleet members can view media metadata"
+on "public"."fleet_media"
+for select to authenticated
+using ((select "public"."fleet_is_member"("company_id")));
+
+create policy "Fleet operational roles can add media metadata"
+on "public"."fleet_media"
+for insert to authenticated
+with check (
+    "uploaded_by" = (select auth.uid())
+    and "storage_bucket" = 'fleet-media'
+    and ("storage"."foldername"("storage_object_path"))[1] = "company_id"::text
+    and ("storage"."foldername"("storage_object_path"))[2]
+        = (select auth.uid()::text)
+    and (select "public"."fleet_can_write_media"(
+        "company_id", "inspection_id", "answer_id", "issue_id",
+        "issue_comment_id", "repair_order_id", "service_record_id"
+    ))
+);
+
+create policy "Fleet media uploaders can update authorized metadata"
+on "public"."fleet_media"
+for update to authenticated
+using (
+    "uploaded_by" = (select auth.uid())
+    and (select "public"."fleet_can_write_media"(
+        "company_id", "inspection_id", "answer_id", "issue_id",
+        "issue_comment_id", "repair_order_id", "service_record_id"
+    ))
+)
+with check (
+    "uploaded_by" = (select auth.uid())
+    and "storage_bucket" = 'fleet-media'
+    and ("storage"."foldername"("storage_object_path"))[1] = "company_id"::text
+    and ("storage"."foldername"("storage_object_path"))[2]
+        = (select auth.uid()::text)
+    and (select "public"."fleet_can_write_media"(
+        "company_id", "inspection_id", "answer_id", "issue_id",
+        "issue_comment_id", "repair_order_id", "service_record_id"
+    ))
+);
+
+create policy "Fleet media uploaders can delete authorized metadata"
+on "public"."fleet_media"
+for delete to authenticated
+using (
+    "uploaded_by" = (select auth.uid())
+    and (select "public"."fleet_can_write_media"(
+        "company_id", "inspection_id", "answer_id", "issue_id",
+        "issue_comment_id", "repair_order_id", "service_record_id"
+    ))
+);
+
+create policy "Fleet members can view issues"
+on "public"."fleet_issue"
+for select to authenticated
+using ((select "public"."fleet_is_member"("company_id")));
+
+create policy "Fleet operational roles can report issues"
+on "public"."fleet_issue"
+for insert to authenticated
+with check (
+    "reported_by" = (select auth.uid())
+    and
+    (select "public"."fleet_has_any_role"(
+        "company_id", array['owner', 'manager', 'operator', 'technician']::text[]
+    ))
+);
+
+create policy "Fleet leadership and technicians can update issues"
+on "public"."fleet_issue"
+for update to authenticated
+using ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager', 'technician']::text[]
+)))
+with check ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager', 'technician']::text[]
+)));
+
+create policy "Fleet members can view issue status history"
+on "public"."fleet_issue_status_history"
+for select to authenticated
+using ((select "public"."fleet_is_member"("company_id")));
+
+create policy "Fleet members can view issue comments"
+on "public"."fleet_issue_comment"
+for select to authenticated
+using ((select "public"."fleet_is_member"("company_id")));
+
+create policy "Fleet operational roles can add issue comments"
+on "public"."fleet_issue_comment"
+for insert to authenticated
+with check (
+    "author_user_id" = (select auth.uid())
+    and (select "public"."fleet_has_any_role"(
+        "company_id", array['owner', 'manager', 'operator', 'technician']::text[]
+    ))
+);
+
+-- ============================================================
+-- Repairs, preventive maintenance, preferences, and audit
+-- ============================================================
+
+create policy "Fleet members can view repair orders"
+on "public"."fleet_repair_order"
+for select to authenticated
+using ((select "public"."fleet_is_member"("company_id")));
+
+create policy "Fleet leadership and technicians can add repair orders"
+on "public"."fleet_repair_order"
+for insert to authenticated
+with check ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager', 'technician']::text[]
+)) and "created_by" = (select auth.uid()));
+
+create policy "Fleet leadership and technicians can update repair orders"
+on "public"."fleet_repair_order"
+for update to authenticated
+using ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager', 'technician']::text[]
+)))
+with check ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager', 'technician']::text[]
+)));
+
+create policy "Fleet members can view repair line items"
+on "public"."fleet_repair_order_line_item"
+for select to authenticated
+using ((select "public"."fleet_is_member"("company_id")));
+
+create policy "Fleet leadership and technicians can add repair line items"
+on "public"."fleet_repair_order_line_item"
+for insert to authenticated
+with check ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager', 'technician']::text[]
+)));
+
+create policy "Fleet leadership and technicians can update repair line items"
+on "public"."fleet_repair_order_line_item"
+for update to authenticated
+using ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager', 'technician']::text[]
+)))
+with check ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager', 'technician']::text[]
+)));
+
+create policy "Fleet leadership and technicians can delete repair line items"
+on "public"."fleet_repair_order_line_item"
+for delete to authenticated
+using ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager', 'technician']::text[]
+)));
+
+create policy "Fleet members can view PM schedules"
+on "public"."fleet_pm_schedule"
+for select to authenticated
+using ((select "public"."fleet_is_member"("company_id")));
+
+create policy "Fleet leadership and technicians can add PM schedules"
+on "public"."fleet_pm_schedule"
+for insert to authenticated
+with check ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager', 'technician']::text[]
+)) and "created_by" = (select auth.uid()));
+
+create policy "Fleet leadership and technicians can update PM schedules"
+on "public"."fleet_pm_schedule"
+for update to authenticated
+using ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager', 'technician']::text[]
+)))
+with check ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager', 'technician']::text[]
+)));
+
+create policy "Fleet members can view service records"
+on "public"."fleet_service_record"
+for select to authenticated
+using ((select "public"."fleet_is_member"("company_id")));
+
+create policy "Fleet leadership and technicians can add service records"
+on "public"."fleet_service_record"
+for insert to authenticated
+with check ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager', 'technician']::text[]
+))
+and "created_by" = (select auth.uid())
+and (
+    "performed_by_user_id" is null
+    or "performed_by_user_id" = (select auth.uid())
+));
+
+create policy "Fleet leadership and technicians can correct service notes"
+on "public"."fleet_service_record"
+for update to authenticated
+using ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager', 'technician']::text[]
+)))
+with check ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager', 'technician']::text[]
+)));
+
+create policy "Fleet users or leadership can view notification preferences"
+on "public"."fleet_notification_preference"
+for select to authenticated
+using (
+    (
+        "user_id" = (select auth.uid())
+        and (select "public"."fleet_is_member"("company_id"))
+    )
+    or (select "public"."fleet_has_any_role"(
+        "company_id", array['owner', 'manager']::text[]
+    ))
+);
+
+create policy "Fleet users can add their notification preferences"
+on "public"."fleet_notification_preference"
+for insert to authenticated
+with check (
+    "user_id" = (select auth.uid())
+    and (select "public"."fleet_is_member"("company_id"))
+);
+
+create policy "Fleet users can update their notification preferences"
+on "public"."fleet_notification_preference"
+for update to authenticated
+using (
+    "user_id" = (select auth.uid())
+    and (select "public"."fleet_is_member"("company_id"))
+)
+with check (
+    "user_id" = (select auth.uid())
+    and (select "public"."fleet_is_member"("company_id"))
+);
+
+create policy "Fleet users can delete their notification preferences"
+on "public"."fleet_notification_preference"
+for delete to authenticated
+using (
+    "user_id" = (select auth.uid())
+    and (select "public"."fleet_is_member"("company_id"))
+);
+
+create policy "Fleet reporting roles can view audit events"
+on "public"."fleet_audit_event"
+for select to authenticated
+using ((select "public"."fleet_has_any_role"(
+    "company_id", array['owner', 'manager']::text[]
+)));
+
+-- ============================================================
+-- Private Supabase Storage objects
+-- ============================================================
+
+create policy "Fleet members can read tenant media objects"
+on "storage"."objects"
+for select to authenticated
+using (
+    "bucket_id" = 'fleet-media'
+    and ("storage"."foldername"("name"))[1]
+        = (select "public"."fleet_current_company_id"()::text)
+    and (select "public"."fleet_is_member"(
+        "public"."fleet_current_company_id"()
+    ))
+);
+
+create policy "Fleet operational roles can upload tenant media objects"
+on "storage"."objects"
+for insert to authenticated
+with check (
+    "bucket_id" = 'fleet-media'
+    and ("storage"."foldername"("name"))[1]
+        = (select "public"."fleet_current_company_id"()::text)
+    and ("storage"."foldername"("name"))[2]
+        = (select auth.uid()::text)
+    and (select "public"."fleet_has_any_role"(
+        "public"."fleet_current_company_id"(),
+        array['owner', 'manager', 'operator', 'technician']::text[]
+    ))
+);