create-bw-app 0.24.8 → 0.25.0

package/template/supabase/modules/projects/migrations/20260811121700_project_client_meta_preview.sql

@@ -0,0 +1,193 @@
+-- Add bounded client-visible meta previews before destructive cleanup. Keep the
+-- legacy next-steps output during this compatibility phase so upgraded readers
+-- can deploy while older consumers still understand the previous RPC shape.
+
+DROP FUNCTION public.get_current_client_project(uuid);
+DROP FUNCTION public.list_current_client_projects();
+
+CREATE FUNCTION public.list_current_client_projects()
+RETURNS TABLE (
+  project_id uuid,
+  name text,
+  reference text,
+  status text,
+  start_date date,
+  target_date date,
+  completed_at timestamptz,
+  archived_at timestamptz,
+  client_summary text,
+  client_scope text,
+  client_contact jsonb,
+  client_next_steps text,
+  meta_preview jsonb,
+  organizations jsonb,
+  progress_percent integer
+)
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT
+    project.id,
+    project.name,
+    project.code,
+    project.status,
+    project.start_date,
+    project.target_date,
+    project.completed_at,
+    project.archived_at,
+    project.client_summary,
+    project.client_scope,
+    CASE WHEN contact.id IS NULL THEN NULL ELSE jsonb_build_object(
+      'profile_id', contact.id,
+      'name', COALESCE(NULLIF(btrim(concat_ws(' ', contact.first_name, contact.last_name)), ''), contact.email),
+      'email', contact.email
+    ) END,
+    project.client_next_steps,
+    COALESCE((
+      SELECT jsonb_agg(jsonb_build_object(
+        'id', current_meta.id,
+        'title', current_meta.title,
+        'status', current_meta.status,
+        'target_date', current_meta.target_date,
+        'completed_at', current_meta.completed_at,
+        'position', current_meta.position
+      ) ORDER BY current_meta.position, current_meta.target_date, current_meta.id)
+      FROM (
+        SELECT milestone.*
+        FROM public.project_milestones milestone
+        WHERE milestone.project_id = project.id
+          AND milestone.visibility = 'client'
+          AND milestone.status IN ('in_progress', 'delayed')
+        ORDER BY milestone.position, milestone.target_date, milestone.id
+        LIMIT 3
+      ) current_meta
+    ), (
+      SELECT jsonb_agg(jsonb_build_object(
+        'id', pending_meta.id,
+        'title', pending_meta.title,
+        'status', pending_meta.status,
+        'target_date', pending_meta.target_date,
+        'completed_at', pending_meta.completed_at,
+        'position', pending_meta.position
+      ) ORDER BY pending_meta.position, pending_meta.target_date, pending_meta.id)
+      FROM (
+        SELECT milestone.*
+        FROM public.project_milestones milestone
+        WHERE milestone.project_id = project.id
+          AND milestone.visibility = 'client'
+          AND milestone.status = 'pending'
+        ORDER BY milestone.position, milestone.target_date, milestone.id
+        LIMIT 1
+      ) pending_meta
+    ), '[]'::jsonb),
+    COALESCE((
+      SELECT jsonb_agg(jsonb_build_object('id', organization.id, 'name', organization.name) ORDER BY organization.name)
+      FROM public.project_client_organizations audience
+      JOIN public.organization_members org_member
+        ON org_member.organization_id = audience.organization_id
+       AND org_member.profile_id = public.current_profile_id()
+      JOIN public.organizations organization ON organization.id = audience.organization_id
+      WHERE audience.project_id = project.id
+        AND (
+          project.client_access_mode = 'all_org_clients'
+          OR EXISTS (
+            SELECT 1 FROM public.project_client_profiles grant_row
+            WHERE grant_row.project_id = project.id
+              AND grant_row.organization_id = audience.organization_id
+              AND grant_row.profile_id = public.current_profile_id()
+          )
+        )
+    ), '[]'::jsonb),
+    CASE WHEN count(milestone.id) = 0 THEN 0
+      ELSE round(100.0 * count(milestone.id) FILTER (WHERE milestone.status = 'achieved') / count(milestone.id))::integer
+    END
+  FROM public.projects project
+  LEFT JOIN public.profiles contact ON contact.id = project.client_contact_profile_id
+  LEFT JOIN public.project_milestones milestone
+    ON milestone.project_id = project.id AND milestone.visibility = 'client'
+  WHERE public.can_current_client_view_project(project.id)
+  GROUP BY project.id, contact.id
+  ORDER BY project.updated_at DESC;
+$$;
+
+REVOKE ALL ON FUNCTION public.list_current_client_projects()
+  FROM PUBLIC, anon, service_role;
+GRANT EXECUTE ON FUNCTION public.list_current_client_projects()
+  TO authenticated;
+
+CREATE FUNCTION public.get_current_client_project(target_project_id uuid)
+RETURNS TABLE (
+  project_id uuid,
+  name text,
+  reference text,
+  status text,
+  start_date date,
+  target_date date,
+  completed_at timestamptz,
+  archived_at timestamptz,
+  client_summary text,
+  client_scope text,
+  client_contact jsonb,
+  client_next_steps text,
+  meta_preview jsonb,
+  organizations jsonb,
+  progress_percent integer,
+  metas jsonb,
+  documents jsonb
+)
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT
+    list_row.project_id,
+    list_row.name,
+    list_row.reference,
+    list_row.status,
+    list_row.start_date,
+    list_row.target_date,
+    list_row.completed_at,
+    list_row.archived_at,
+    list_row.client_summary,
+    list_row.client_scope,
+    list_row.client_contact,
+    list_row.client_next_steps,
+    list_row.meta_preview,
+    list_row.organizations,
+    list_row.progress_percent,
+    COALESCE((
+      SELECT jsonb_agg(jsonb_build_object(
+        'id', milestone.id,
+        'title', milestone.title,
+        'status', milestone.status,
+        'target_date', milestone.target_date,
+        'completed_at', milestone.completed_at,
+        'position', milestone.position
+      ) ORDER BY milestone.position, milestone.target_date, milestone.id)
+      FROM public.project_milestones milestone
+      WHERE milestone.project_id = target_project_id
+        AND milestone.visibility = 'client'
+    ), '[]'::jsonb),
+    COALESCE((
+      SELECT jsonb_agg(jsonb_build_object(
+        'id', link.id,
+        'label', link.label,
+        'url', link.url,
+        'kind', link.kind,
+        'created_at', link.created_at
+      ) ORDER BY link.created_at DESC, link.id)
+      FROM public.project_links link
+      WHERE link.project_id = target_project_id
+        AND link.visibility = 'client'
+    ), '[]'::jsonb)
+  FROM public.list_current_client_projects() list_row
+  WHERE list_row.project_id = target_project_id;
+$$;
+
+REVOKE ALL ON FUNCTION public.get_current_client_project(uuid)
+  FROM PUBLIC, anon, service_role;
+GRANT EXECUTE ON FUNCTION public.get_current_client_project(uuid)
+  TO authenticated;

package/template/supabase/modules/projects/migrations/20260811122000_project_client_access_identity_cleanup.sql

@@ -0,0 +1,201 @@
+-- bw-migration-safety: destructive
+-- Destructively normalize legacy project identities only after all readers and
+-- writers use the explicit internal-team and client-audience model.
+
+DELETE FROM public.project_members member
+WHERE NOT EXISTS (
+  SELECT 1
+  FROM public.user_role_assignments role_assignment
+  WHERE role_assignment.profile_id = member.profile_id
+    AND role_assignment.role_code IN ('staff', 'admin')
+);
+
+-- The enforcement migration intentionally rejects unauthenticated identity
+-- changes. Temporarily disable only that column guard for this reviewed,
+-- destructive normalization; deferred consistency checks remain active.
+ALTER TABLE public.projects DISABLE TRIGGER trg_protect_project_identity_fields;
+
+UPDATE public.projects project
+SET owner_profile_id = NULL
+WHERE owner_profile_id IS NOT NULL
+  AND NOT EXISTS (
+    SELECT 1
+    FROM public.user_role_assignments role_assignment
+    WHERE role_assignment.profile_id = project.owner_profile_id
+      AND role_assignment.role_code IN ('staff', 'admin')
+  );
+
+ALTER TABLE public.projects ENABLE TRIGGER trg_protect_project_identity_fields;
+
+-- Existing owner_profile_id is canonical during cleanup. Keep exactly its
+-- matching owner membership and demote stale owner rows.
+UPDATE public.project_members member
+SET role = 'contributor'
+FROM public.projects project
+WHERE project.id = member.project_id
+  AND member.role = 'owner'
+  AND member.profile_id IS DISTINCT FROM project.owner_profile_id;
+
+DELETE FROM public.project_members member
+USING public.projects project
+WHERE project.id = member.project_id
+  AND project.owner_profile_id IS NULL
+  AND member.role = 'owner';
+
+INSERT INTO public.project_members (project_id, profile_id, role)
+SELECT project.id, project.owner_profile_id, 'owner'
+FROM public.projects project
+WHERE project.owner_profile_id IS NOT NULL
+ON CONFLICT (project_id, profile_id)
+DO UPDATE SET role = 'owner';
+
+CREATE OR REPLACE FUNCTION public.enforce_internal_project_identity()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_profile_id uuid;
+BEGIN
+  -- Keep table-specific NEW fields in separate statements. A CASE expression
+  -- still asks PostgreSQL to resolve both record fields and fails on projects
+  -- because that row type has no profile_id column.
+  IF TG_TABLE_NAME = 'projects' THEN
+    v_profile_id := NEW.owner_profile_id;
+  ELSE
+    v_profile_id := NEW.profile_id;
+  END IF;
+
+  IF v_profile_id IS NOT NULL AND NOT EXISTS (
+    SELECT 1
+    FROM public.user_role_assignments role_assignment
+    WHERE role_assignment.profile_id = v_profile_id
+      AND role_assignment.role_code IN ('staff', 'admin')
+  ) THEN
+    RAISE EXCEPTION 'Project owners and members must be internal staff.'
+      USING ERRCODE = '23514';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS trg_enforce_internal_project_owner ON public.projects;
+CREATE TRIGGER trg_enforce_internal_project_owner
+BEFORE INSERT OR UPDATE OF owner_profile_id ON public.projects
+FOR EACH ROW
+EXECUTE FUNCTION public.enforce_internal_project_identity();
+
+DROP TRIGGER IF EXISTS trg_enforce_internal_project_member ON public.project_members;
+CREATE TRIGGER trg_enforce_internal_project_member
+BEFORE INSERT OR UPDATE OF profile_id, role ON public.project_members
+FOR EACH ROW
+EXECUTE FUNCTION public.enforce_internal_project_identity();
+
+CREATE OR REPLACE FUNCTION public.validate_project_owner_consistency()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_project_id uuid;
+  v_owner_profile_id uuid;
+  v_owner_count integer;
+  v_matching_owner_count integer;
+BEGIN
+  IF TG_TABLE_NAME = 'projects' THEN
+    v_project_id := COALESCE(NEW.id, OLD.id);
+  ELSE
+    v_project_id := COALESCE(NEW.project_id, OLD.project_id);
+  END IF;
+
+  SELECT project.owner_profile_id
+  INTO v_owner_profile_id
+  FROM public.projects project
+  WHERE project.id = v_project_id;
+  IF NOT FOUND THEN
+    RETURN NULL;
+  END IF;
+
+  SELECT
+    count(*) FILTER (WHERE member.role = 'owner'),
+    count(*) FILTER (
+      WHERE member.role = 'owner'
+        AND member.profile_id = v_owner_profile_id
+    )
+  INTO v_owner_count, v_matching_owner_count
+  FROM public.project_members member
+  WHERE member.project_id = v_project_id;
+
+  IF (v_owner_profile_id IS NULL AND v_owner_count <> 0)
+    OR (v_owner_profile_id IS NOT NULL AND (v_owner_count <> 1 OR v_matching_owner_count <> 1)) THEN
+    RAISE EXCEPTION 'Project owner and owner membership must match exactly.'
+      USING ERRCODE = '23514';
+  END IF;
+  RETURN NULL;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS trg_validate_project_owner_from_project ON public.projects;
+CREATE CONSTRAINT TRIGGER trg_validate_project_owner_from_project
+AFTER INSERT OR UPDATE OF owner_profile_id ON public.projects
+DEFERRABLE INITIALLY DEFERRED
+FOR EACH ROW
+EXECUTE FUNCTION public.validate_project_owner_consistency();
+
+DROP TRIGGER IF EXISTS trg_validate_project_owner_from_member ON public.project_members;
+CREATE CONSTRAINT TRIGGER trg_validate_project_owner_from_member
+AFTER INSERT OR UPDATE OR DELETE ON public.project_members
+DEFERRABLE INITIALLY DEFERRED
+FOR EACH ROW
+EXECUTE FUNCTION public.validate_project_owner_consistency();
+
+CREATE OR REPLACE FUNCTION public.validate_project_primary_participation()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  v_project_id uuid := COALESCE(NEW.project_id, OLD.project_id);
+  v_primary_organization_id uuid;
+  v_matching_primary_count integer;
+  v_other_primary_count integer;
+BEGIN
+  SELECT project.organization_id
+  INTO v_primary_organization_id
+  FROM public.projects project
+  WHERE project.id = v_project_id;
+  IF NOT FOUND THEN
+    RETURN NULL;
+  END IF;
+
+  SELECT
+    count(*) FILTER (
+      WHERE participant.organization_id = v_primary_organization_id
+        AND participant.is_primary
+    ),
+    count(*) FILTER (
+      WHERE participant.is_primary
+        AND participant.organization_id <> v_primary_organization_id
+    )
+  INTO v_matching_primary_count, v_other_primary_count
+  FROM public.project_organizations participant
+  WHERE participant.project_id = v_project_id;
+
+  IF v_matching_primary_count <> 1 OR v_other_primary_count <> 0 THEN
+    RAISE EXCEPTION 'The project primary organization must be its only primary participant.'
+      USING ERRCODE = '23514';
+  END IF;
+  RETURN NULL;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS trg_validate_project_primary_participation
+  ON public.project_organizations;
+CREATE CONSTRAINT TRIGGER trg_validate_project_primary_participation
+AFTER INSERT OR UPDATE OR DELETE ON public.project_organizations
+DEFERRABLE INITIALLY DEFERRED
+FOR EACH ROW
+EXECUTE FUNCTION public.validate_project_primary_participation();