autopilot-core-sandbox 0.0.1

package/dist/dist/migrations/20260719215143_outbound_event_triggers.sql

@@ -0,0 +1,219 @@
+-- Outbox triggers: every create/update/delete of a client, job, invoice, or
+-- estimate — from web, mobile, or the public API, all of which write straight
+-- to Postgres — lands in outbound_event. Child-table writes (line items,
+-- schedules, crew, discounts, payments, addresses, tags) surface as
+-- <parent>.updated events, because webhook payloads embed those children.
+--
+-- security definer is required: writes normally run as `authenticated`,
+-- which deliberately has no grants on outbound_event.
+--
+-- Deletes are hard deletes app-wide (is_deleted columns exist but nothing
+-- sets them), so <entity>.deleted fires from AFTER DELETE and carries a
+-- to_jsonb(OLD) snapshot — the only payload the worker can't re-read.
+
+-- ============================================================
+-- Parent entities: client, job, invoice, estimate
+-- ============================================================
+
+create or replace function "public"."enqueue_parent_event"()
+returns trigger
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+begin
+    if TG_OP = 'INSERT' then
+        insert into outbound_event (company_id, entity_type, entity_id, event_type, op, source_table)
+        values (NEW.company_id, TG_TABLE_NAME, NEW.id, TG_TABLE_NAME || '.created', TG_OP, TG_TABLE_NAME);
+    elsif TG_OP = 'UPDATE' then
+        insert into outbound_event (company_id, entity_type, entity_id, event_type, op, source_table)
+        values (NEW.company_id, TG_TABLE_NAME, NEW.id, TG_TABLE_NAME || '.updated', TG_OP, TG_TABLE_NAME);
+    else
+        insert into outbound_event (company_id, entity_type, entity_id, event_type, op, source_table, snapshot)
+        values (OLD.company_id, TG_TABLE_NAME, OLD.id, TG_TABLE_NAME || '.deleted', TG_OP, TG_TABLE_NAME, to_jsonb(OLD));
+    end if;
+    return null;
+end;
+$$;
+
+-- UPDATE triggers are separate so they can carry a WHEN clause: no-op writes
+-- (e.g. an idempotent status recompute) produce no event. Duplicate genuine
+-- updates are coalesced by the delivery worker, not here.
+create or replace trigger "outbound_event_client_cd" after insert or delete on "public"."client"
+    for each row execute function "public"."enqueue_parent_event"();
+create or replace trigger "outbound_event_client_u" after update on "public"."client"
+    for each row when (old.* is distinct from new.*)
+    execute function "public"."enqueue_parent_event"();
+
+create or replace trigger "outbound_event_job_cd" after insert or delete on "public"."job"
+    for each row execute function "public"."enqueue_parent_event"();
+create or replace trigger "outbound_event_job_u" after update on "public"."job"
+    for each row when (old.* is distinct from new.*)
+    execute function "public"."enqueue_parent_event"();
+
+create or replace trigger "outbound_event_invoice_cd" after insert or delete on "public"."invoice"
+    for each row execute function "public"."enqueue_parent_event"();
+create or replace trigger "outbound_event_invoice_u" after update on "public"."invoice"
+    for each row when (old.* is distinct from new.*)
+    execute function "public"."enqueue_parent_event"();
+
+create or replace trigger "outbound_event_estimate_cd" after insert or delete on "public"."estimate"
+    for each row execute function "public"."enqueue_parent_event"();
+create or replace trigger "outbound_event_estimate_u" after update on "public"."estimate"
+    for each row when (old.* is distinct from new.*)
+    execute function "public"."enqueue_parent_event"();
+
+-- ============================================================
+-- Child tables → <parent>.updated
+-- ============================================================
+
+-- TG_ARGV is (parent_entity, fk_column) pairs; dual-parent tables like
+-- job_item pass two pairs. For each pair, the parent id is taken from both
+-- OLD and NEW (an UPDATE can move a row between parents — both sides
+-- changed), deduplicated, and skipped when the parent row no longer exists.
+-- That last guard matters twice over: a client CASCADE delete would
+-- otherwise emit an .updated storm for entities that are mid-deletion, and
+-- job_item's ON DELETE SET NULL FKs fire this trigger during job/invoice
+-- deletes with the OLD side pointing at the just-deleted parent.
+create or replace function "public"."enqueue_child_event"()
+returns trigger
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+declare
+    rec_old jsonb := case when TG_OP in ('UPDATE', 'DELETE') then to_jsonb(OLD) end;
+    rec_new jsonb := case when TG_OP in ('INSERT', 'UPDATE') then to_jsonb(NEW) end;
+    v_company_id uuid := coalesce((rec_new ->> 'company_id'), (rec_old ->> 'company_id'))::uuid;
+    v_parent_entity text;
+    v_fk_col text;
+    v_parent_id uuid;
+    v_parent_exists boolean;
+    i integer := 0;
+begin
+    while i < TG_NARGS loop
+        v_parent_entity := TG_ARGV[i];
+        v_fk_col := TG_ARGV[i + 1];
+
+        for v_parent_id in
+            select distinct pid from (
+                values ((rec_old ->> v_fk_col)::uuid), ((rec_new ->> v_fk_col)::uuid)
+            ) as t(pid) where pid is not null
+        loop
+            -- v_parent_entity comes from our own trigger definitions below,
+            -- never from row data, so %I on it is safe
+            execute format('select exists (select 1 from public.%I where id = $1)', v_parent_entity)
+                into v_parent_exists using v_parent_id;
+            if v_parent_exists then
+                insert into outbound_event (company_id, entity_type, entity_id, event_type, op, source_table)
+                values (v_company_id, v_parent_entity, v_parent_id, v_parent_entity || '.updated', TG_OP, TG_TABLE_NAME);
+            end if;
+        end loop;
+
+        i := i + 2;
+    end loop;
+    return null;
+end;
+$$;
+
+-- client children (address rows with client_id null — company addresses —
+-- produce nothing because the fk lookup finds no parent id)
+create or replace trigger "outbound_event_address_cd" after insert or delete on "public"."address"
+    for each row execute function "public"."enqueue_child_event"('client', 'client_id');
+create or replace trigger "outbound_event_address_u" after update on "public"."address"
+    for each row when (old.* is distinct from new.*)
+    execute function "public"."enqueue_child_event"('client', 'client_id');
+
+create or replace trigger "outbound_event_client_tag_link_cd" after insert or delete on "public"."client_tag_link"
+    for each row execute function "public"."enqueue_child_event"('client', 'client_id');
+create or replace trigger "outbound_event_client_tag_link_u" after update on "public"."client_tag_link"
+    for each row when (old.* is distinct from new.*)
+    execute function "public"."enqueue_child_event"('client', 'client_id');
+
+-- job/invoice children (job_item and job_discount belong to either or both)
+create or replace trigger "outbound_event_job_item_cd" after insert or delete on "public"."job_item"
+    for each row execute function "public"."enqueue_child_event"('job', 'job_id', 'invoice', 'invoice_id');
+create or replace trigger "outbound_event_job_item_u" after update on "public"."job_item"
+    for each row when (old.* is distinct from new.*)
+    execute function "public"."enqueue_child_event"('job', 'job_id', 'invoice', 'invoice_id');
+
+create or replace trigger "outbound_event_job_discount_cd" after insert or delete on "public"."job_discount"
+    for each row execute function "public"."enqueue_child_event"('job', 'job_id', 'invoice', 'invoice_id');
+create or replace trigger "outbound_event_job_discount_u" after update on "public"."job_discount"
+    for each row when (old.* is distinct from new.*)
+    execute function "public"."enqueue_child_event"('job', 'job_id', 'invoice', 'invoice_id');
+
+create or replace trigger "outbound_event_job_schedule_cd" after insert or delete on "public"."job_schedule"
+    for each row execute function "public"."enqueue_child_event"('job', 'job_id');
+create or replace trigger "outbound_event_job_schedule_u" after update on "public"."job_schedule"
+    for each row when (old.* is distinct from new.*)
+    execute function "public"."enqueue_child_event"('job', 'job_id');
+
+create or replace trigger "outbound_event_job_user_cd" after insert or delete on "public"."job_user"
+    for each row execute function "public"."enqueue_child_event"('job', 'job_id');
+create or replace trigger "outbound_event_job_user_u" after update on "public"."job_user"
+    for each row when (old.* is distinct from new.*)
+    execute function "public"."enqueue_child_event"('job', 'job_id');
+
+-- payments carry both FKs: a payment recorded against a job before any
+-- invoice exists has invoice_id null (see core createPayment), so job_id
+-- must fan out too or job-only payments would emit nothing
+create or replace trigger "outbound_event_payment_cd" after insert or delete on "public"."payment"
+    for each row execute function "public"."enqueue_child_event"('invoice', 'invoice_id', 'job', 'job_id');
+create or replace trigger "outbound_event_payment_u" after update on "public"."payment"
+    for each row when (old.* is distinct from new.*)
+    execute function "public"."enqueue_child_event"('invoice', 'invoice_id', 'job', 'job_id');
+
+-- estimate children
+create or replace trigger "outbound_event_estimate_item_cd" after insert or delete on "public"."estimate_item"
+    for each row execute function "public"."enqueue_child_event"('estimate', 'estimate_id');
+create or replace trigger "outbound_event_estimate_item_u" after update on "public"."estimate_item"
+    for each row when (old.* is distinct from new.*)
+    execute function "public"."enqueue_child_event"('estimate', 'estimate_id');
+
+create or replace trigger "outbound_event_estimate_discount_cd" after insert or delete on "public"."estimate_discount"
+    for each row execute function "public"."enqueue_child_event"('estimate', 'estimate_id');
+create or replace trigger "outbound_event_estimate_discount_u" after update on "public"."estimate_discount"
+    for each row when (old.* is distinct from new.*)
+    execute function "public"."enqueue_child_event"('estimate', 'estimate_id');
+
+create or replace trigger "outbound_event_estimate_user_cd" after insert or delete on "public"."estimate_user"
+    for each row execute function "public"."enqueue_child_event"('estimate', 'estimate_id');
+create or replace trigger "outbound_event_estimate_user_u" after update on "public"."estimate_user"
+    for each row when (old.* is distinct from new.*)
+    execute function "public"."enqueue_child_event"('estimate', 'estimate_id');
+
+-- ============================================================
+-- Address content changes → .updated for referencing records
+-- ============================================================
+
+-- Jobs, invoices, and estimates reference addresses the other way around
+-- (parent.address_id → address), so enqueue_child_event can't cover them.
+-- Editing an address changes those records' embedded payloads, so their
+-- subscribers need .updated events too. Only UPDATE needs this reverse
+-- lookup: a freshly inserted address can't be referenced yet, and address
+-- DELETEs already surface through the parents' FK actions (job/invoice
+-- SET NULL fires their UPDATE triggers; estimate CASCADE fires .deleted).
+create or replace function "public"."enqueue_address_referrer_events"()
+returns trigger
+language "plpgsql"
+security definer
+set search_path = 'public'
+as $$
+begin
+    insert into outbound_event (company_id, entity_type, entity_id, event_type, op, source_table)
+    select NEW.company_id, 'job', j.id, 'job.updated', TG_OP, TG_TABLE_NAME
+        from job j where j.address_id = NEW.id;
+    insert into outbound_event (company_id, entity_type, entity_id, event_type, op, source_table)
+    select NEW.company_id, 'invoice', i.id, 'invoice.updated', TG_OP, TG_TABLE_NAME
+        from invoice i where i.address_id = NEW.id;
+    insert into outbound_event (company_id, entity_type, entity_id, event_type, op, source_table)
+    select NEW.company_id, 'estimate', e.id, 'estimate.updated', TG_OP, TG_TABLE_NAME
+        from estimate e where e.address_id = NEW.id;
+    return null;
+end;
+$$;
+
+create or replace trigger "outbound_event_address_referrers_u" after update on "public"."address"
+    for each row when (old.* is distinct from new.*)
+    execute function "public"."enqueue_address_referrer_events"();

package/dist/dist/migrations/20260719215144_create_api_key.sql

@@ -0,0 +1,34 @@
+-- Per-company API keys for the public REST API (/api/v1 in autopilot-web).
+-- The plaintext key (format: ap_live_<43 chars base62>) is shown exactly once
+-- at creation; only its SHA-256 hex digest is stored. SHA-256 rather than a
+-- slow hash is deliberate: keys carry 32 bytes of CSPRNG entropy, so
+-- brute-force resistance from bcrypt buys nothing, and a deterministic hash
+-- makes auth a single indexed lookup per request.
+
+create table if not exists "public"."api_key" (
+    "id" uuid default gen_random_uuid() not null,
+    "created_at" timestamp with time zone default now() not null,
+    "company_id" uuid not null,
+    -- auth user id of the creator; intentionally no FK so keys survive
+    -- employee removal
+    "created_by" uuid,
+    "label" text not null,
+    -- display fragment for the settings page, e.g. 'ap_live_3f9c2a1b'
+    "key_prefix" text not null,
+    "key_hash" text not null,
+    "last_used_at" timestamp with time zone,
+    "revoked_at" timestamp with time zone
+);
+
+alter table only "public"."api_key"
+    add constraint "api_key_pkey" primary key ("id");
+
+alter table only "public"."api_key"
+    add constraint "api_key_key_hash_key" unique ("key_hash");
+
+alter table only "public"."api_key"
+    add constraint "api_key_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+create index if not exists "api_key_company_idx"
+    on "public"."api_key" ("company_id");

package/dist/dist/migrations/20260719215146_create_api_key_rls.sql

@@ -0,0 +1,12 @@
+-- RLS: api_key is service-role only.
+-- Same deliberate deviation (and rationale) as outbound_event_rls, plus one
+-- more reason: key hashes are credentials. The settings page lists and
+-- revokes keys through a session-authed server route (which returns only
+-- label/prefix/timestamps), never by querying this table from the browser.
+
+alter table "public"."api_key" enable row level security;
+
+revoke all on table "public"."api_key" from "anon";
+revoke all on table "public"."api_key" from "authenticated";
+
+grant all on table "public"."api_key" to "service_role";

package/dist/dist/migrations/20260719215147_webhook_subscription_add_secret_active.sql

@@ -0,0 +1,28 @@
+-- webhook_subscription: per-subscription HMAC secret + lifecycle columns for
+-- the outbox delivery worker.
+--
+-- Existing rows keep their legacy event_type values ('new_client',
+-- 'updated_client', 'deleted_client') — the worker maps those aliases to the
+-- canonical '<entity>.<created|updated|deleted>' names, so the live alpha
+-- Zapier app keeps working without a coordinated deploy. Multiple
+-- subscriptions per (company_id, event_type) remain allowed by design.
+
+alter table "public"."webhook_subscription"
+    add column if not exists "secret" text,
+    add column if not exists "is_active" boolean default true not null,
+    -- 'gone_410' | 'max_failures' | 'user_revoked'
+    add column if not exists "deactivated_reason" text;
+
+-- backfill existing (alpha Zapier) subscriptions so every row has a signing
+-- secret; new rows get one from the subscribe route
+update "public"."webhook_subscription"
+    set "secret" = encode(gen_random_bytes(32), 'hex')
+    where "secret" is null;
+
+alter table "public"."webhook_subscription"
+    alter column "secret" set not null;
+
+-- fan-out lookup: active subscriptions for a company + event type
+create index if not exists "webhook_subscription_lookup_idx"
+    on "public"."webhook_subscription" ("company_id", "event_type")
+    where "is_active";