ekwo-os 0.4.1

package/dist/assets/migrations/20260913083901_company_invitations.sql

@@ -0,0 +1,262 @@
+-- Ekwo OS — inviting somebody who does not have an account yet.
+--
+-- `company_members.user_id` deliberately carries no foreign key to
+-- `auth.users`, precisely so that a membership can be written before the
+-- person has signed up. What was missing is the act that produces it: until
+-- now somebody had to know the invitee's `auth.users.id` — which means the
+-- invitee had to exist, and somebody had to go and read it out of the Auth
+-- dashboard.
+--
+-- An invitation is the missing half. It names an address, a preset and any
+-- capability granted on top of it, and it carries a secret that is handed over
+-- once and stored only as a hash. The person signs up with their own address
+-- in the customer's Supabase Auth, and `accept_invitation()` turns the
+-- invitation into a membership — after checking that the address they signed
+-- in with is the one that was invited.
+--
+-- **Three rules and their reasons.**
+--
+-- The token is never stored. `token_hash` is a sha256 of it, computed by
+-- Postgres' own `sha256()` — core since PostgreSQL 11, so no extension, which
+-- `pgcrypto` would have been and PGlite does not carry. A database backup
+-- therefore hands nobody an invitation.
+--
+-- The address is matched, not trusted. A token alone would let whoever
+-- receives a forwarded e-mail join the books; `auth.email()` has to equal the
+-- address the invitation was written for, case-insensitively.
+--
+-- An invitation is used once and expires. Accepting sets `accepted_at`, and
+-- every later attempt is refused rather than silently re-adding a member
+-- somebody may have removed on purpose.
+
+create table company_invitations (
+  id                   uuid primary key default gen_random_uuid(),
+  company_id           uuid not null references companies(id) on delete cascade,
+  -- Lower-cased on the way in: an address is not case-sensitive in its domain
+  -- and, in practice, not in its local part either. `citext` would have said
+  -- the same thing and is an extension.
+  email                text not null,
+  role                 member_role not null default 'viewer',
+  capabilities_granted text[] not null default '{}',
+  token_hash           text not null unique,
+  invited_by           uuid,
+  created_at           timestamptz not null default now(),
+  expires_at           timestamptz not null,
+  accepted_at          timestamptz,
+  accepted_by          uuid,
+  revoked_at           timestamptz,
+  constraint company_invitations_email_lowercase check (email = lower(email)),
+  constraint company_invitations_email_shape check (email like '%_@_%'),
+  constraint company_invitations_expiry check (expires_at > created_at),
+  constraint company_invitations_accepted_together
+    check ((accepted_at is null) = (accepted_by is null))
+);
+
+comment on table company_invitations is
+  'Pending and past invitations into a company. The token is handed over once and kept only as a sha256 hash.';
+comment on column company_invitations.email is
+  'The address the invitation is for, lower-cased. accept_invitation() refuses anyone signed in with another.';
+comment on column company_invitations.capabilities_granted is
+  'Capabilities the new member holds on top of their preset, written onto company_members when the invitation is accepted.';
+comment on column company_invitations.invited_by is
+  'auth.users.id of whoever issued it. No foreign key, for the same reason company_members has none.';
+
+create index company_invitations_company_idx on company_invitations (company_id, created_at desc);
+create index company_invitations_email_idx on company_invitations (lower(email));
+
+-- ---------------------------------------------------------------------------
+-- Issuing one
+--
+-- The secret is two `gen_random_uuid()` with their dashes removed: 256 bits
+-- from the same source the primary keys come from, and no extension. It is
+-- returned by this call and by nothing else, ever.
+-- ---------------------------------------------------------------------------
+
+create or replace function invite_member(
+  p_company_id   uuid,
+  p_email        text,
+  p_role         member_role default 'viewer',
+  -- A list crosses as JSON, the way `opening_balance` takes its lines: over
+  -- PostgREST an argument is a JSON body, and a Postgres driver handed a
+  -- JavaScript array builds an array literal instead. One spelling that both
+  -- routes read the same way.
+  p_capabilities jsonb default '[]'::jsonb,
+  p_valid_for    interval default interval '14 days'
+)
+returns table (invitation_id uuid, token text, expires_at timestamptz)
+language plpgsql
+security definer
+set search_path = public, pg_temp
+as $$
+declare
+  v_email   text := lower(trim(p_email));
+  v_token   text;
+  v_unknown text;
+  v_caps    text[] := coalesce(
+    (select array_agg(value) from jsonb_array_elements_text(coalesce(p_capabilities, '[]'::jsonb)) as value),
+    '{}');
+  v_row     company_invitations%rowtype;
+begin
+  if auth.uid() is not null and not has_capability(p_company_id, 'members.manage')
+     and not is_instance_admin() then
+    raise exception 'not_allowed: inviting somebody into this company needs members.manage'
+      using errcode = '42501';
+  end if;
+
+  if v_email is null or v_email not like '%_@_%' then
+    raise exception 'bad_email: % is not an address an invitation can be sent to', p_email;
+  end if;
+
+  select c into v_unknown
+    from unnest(v_caps) as c
+   where c not in (select code from capabilities)
+   limit 1;
+  if v_unknown is not null then
+    raise exception 'unknown_capability: % is not a capability of this installation', v_unknown;
+  end if;
+
+  -- Re-inviting the same address replaces the pending invitation rather than
+  -- leaving two tokens alive for one seat.
+  update company_invitations
+     set revoked_at = now()
+   where company_id = p_company_id
+     and email = v_email
+     and accepted_at is null
+     and revoked_at is null;
+
+  v_token := replace(gen_random_uuid()::text, '-', '') ||
+             replace(gen_random_uuid()::text, '-', '');
+
+  insert into company_invitations (company_id, email, role, capabilities_granted,
+                                   token_hash, invited_by, expires_at)
+  values (p_company_id, v_email, p_role, v_caps,
+          encode(sha256(convert_to(v_token, 'UTF8')), 'hex'), auth.uid(), now() + p_valid_for)
+  returning * into v_row;
+
+  return query select v_row.id, v_token, v_row.expires_at;
+end;
+$$;
+
+comment on function invite_member(uuid, text, member_role, jsonb, interval) is
+  'Invites an address into a company and returns the token once. Only the hash is stored; re-inviting the same address revokes the pending invitation.';
+
+-- ---------------------------------------------------------------------------
+-- Accepting one
+--
+-- Definer, because the invitee is nobody yet: they cannot read
+-- `company_invitations` and cannot write `company_members`. What the function
+-- checks is everything the policies would have: a live invitation, and the
+-- address it was written for.
+-- ---------------------------------------------------------------------------
+
+create or replace function accept_invitation(p_token text)
+returns company_members
+language plpgsql
+security definer
+set search_path = public, pg_temp
+as $$
+declare
+  v_invitation company_invitations%rowtype;
+  v_member     company_members%rowtype;
+begin
+  if auth.uid() is null then
+    raise exception 'no_user: accepting an invitation is something a signed-in user does';
+  end if;
+
+  select * into v_invitation
+    from company_invitations
+   where token_hash = encode(sha256(convert_to(coalesce(p_token, ''), 'UTF8')), 'hex');
+
+  if v_invitation.id is null then
+    raise exception 'unknown_invitation: that is not an invitation of this installation';
+  end if;
+  if v_invitation.revoked_at is not null then
+    raise exception 'invitation_revoked: that invitation was withdrawn on %', v_invitation.revoked_at;
+  end if;
+  if v_invitation.accepted_at is not null then
+    raise exception 'invitation_already_accepted: that invitation was used on %', v_invitation.accepted_at;
+  end if;
+  if v_invitation.expires_at <= now() then
+    raise exception 'invitation_expired: that invitation expired on %', v_invitation.expires_at;
+  end if;
+  if lower(coalesce(auth.email(), '')) <> v_invitation.email then
+    raise exception 'invitation_not_yours: that invitation was sent to another address'
+      using errcode = '42501';
+  end if;
+
+  insert into company_members (company_id, user_id, role, capabilities_granted)
+  values (v_invitation.company_id, auth.uid(), v_invitation.role,
+          v_invitation.capabilities_granted)
+  on conflict (company_id, user_id) do nothing
+  returning * into v_member;
+
+  if v_member.user_id is null then
+    select * into v_member
+      from company_members
+     where company_id = v_invitation.company_id and user_id = auth.uid();
+  end if;
+
+  update company_invitations
+     set accepted_at = now(), accepted_by = auth.uid()
+   where id = v_invitation.id;
+
+  return v_member;
+end;
+$$;
+
+comment on function accept_invitation(text) is
+  'Turns an invitation into a membership for the signed-in user, whose address has to be the one invited. Single use, and refused once expired.';
+
+create or replace function revoke_invitation(p_invitation_id uuid)
+returns company_invitations
+language plpgsql
+security definer
+set search_path = public, pg_temp
+as $$
+declare
+  v_row company_invitations%rowtype;
+begin
+  select * into v_row from company_invitations where id = p_invitation_id;
+  if v_row.id is null then
+    raise exception 'unknown_invitation: no invitation with that id';
+  end if;
+
+  if auth.uid() is not null and not has_capability(v_row.company_id, 'members.manage')
+     and not is_instance_admin() then
+    raise exception 'not_allowed: withdrawing an invitation needs members.manage'
+      using errcode = '42501';
+  end if;
+
+  if v_row.accepted_at is not null then
+    raise exception 'invitation_already_accepted: it became a membership on %; remove the member instead',
+      v_row.accepted_at;
+  end if;
+
+  update company_invitations set revoked_at = coalesce(revoked_at, now())
+   where id = p_invitation_id
+  returning * into v_row;
+
+  return v_row;
+end;
+$$;
+
+comment on function revoke_invitation(uuid) is
+  'Withdraws an invitation that has not been accepted. An accepted one is a member, and members are removed from company_members.';
+
+-- ---------------------------------------------------------------------------
+-- Row level security
+--
+-- Reading an invitation is administering members, so it is `members.manage`
+-- and the instance administrator. Nothing writes through the API: the three
+-- functions above are the only way in, and each one checks what a policy
+-- would have.
+-- ---------------------------------------------------------------------------
+
+alter table company_invitations enable row level security;
+
+create policy company_invitations_select on company_invitations
+  for select using (
+    has_capability(company_id, 'members.manage') or is_instance_admin()
+  );
+
+revoke execute on all functions in schema public from public;

package/dist/assets/migrations/20260913084402_user_preferences.sql

@@ -0,0 +1,376 @@
+-- Ekwo OS — what a person prefers, and the one way a label is chosen.
+--
+-- Two things that turned out to be the same thing.
+--
+-- **A preference belongs to a person, not to a company.** Which company they
+-- work in by default, the language they read in, their timezone, how they
+-- like a date and a number written. None of it has a default in the schema,
+-- for the reason P0-7 and P0-8 gave before: a default language is one
+-- country's answer handed to everybody who has not spoken, and null means
+-- "ask the company, then the pack, then the client" rather than "English".
+--
+-- **A label is chosen in one place.** `name_i18n` and `text_i18n` sit on the
+-- chart, the journals, the declaration boxes, the statement lines and the
+-- legal mentions, and the way to read one was written out as
+-- `coalesce(nullif(x.name_i18n ->> lang, ''), x.name)` wherever it was
+-- needed. That is a formula, and a formula written twice is a formula that
+-- will one day disagree with itself. `label_for(name, name_i18n, languages)`
+-- is now the only spelling of it, it takes a **list** of languages rather
+-- than one, and `preferred_languages(company)` builds that list: the user's
+-- own, then the company's, then the pack's.
+--
+-- `install_country_template()` is republished on top of it. It keeps passing
+-- one language and the company's, deliberately: a chart of accounts is copied
+-- in the language the books are kept in, not in the language of whoever
+-- happened to run the installer.
+
+-- ---------------------------------------------------------------------------
+-- label_for — the one way a translated label is picked
+-- ---------------------------------------------------------------------------
+
+create or replace function label_for(p_name text, p_i18n jsonb, p_languages text[])
+returns text
+language sql
+immutable
+as $$
+  select coalesce(
+    (select nullif(p_i18n ->> lang, '')
+       from unnest(coalesce(p_languages, '{}')) with ordinality as l(lang, ord)
+      where nullif(p_i18n ->> lang, '') is not null
+      order by l.ord
+      limit 1),
+    p_name);
+$$;
+
+comment on function label_for(text, jsonb, text[]) is
+  'The label in the first language of the list that has one, and the row''s own name when none of them does. The only place a translated label is chosen.';
+
+-- ---------------------------------------------------------------------------
+-- user_preferences
+-- ---------------------------------------------------------------------------
+
+create table user_preferences (
+  user_id              uuid primary key references auth.users(id) on delete cascade,
+  preferred_company_id uuid references companies(id) on delete set null,
+  language             text,
+  timezone             text,
+  -- `*_display_format` and not `date_format` / `number_format`: the second of
+  -- those is already a column of `country_defaults`, where it is the pattern
+  -- a document number is built from. Two questions that have nothing to do
+  -- with each other should not answer to one name — a reader meeting both
+  -- would have to know which table they were in to know what they had.
+  date_display_format   text,
+  number_display_format text,
+  theme                text,
+  created_at           timestamptz not null default now(),
+  updated_at           timestamptz not null default now(),
+  constraint user_preferences_language_shape
+    check (language is null or language ~ '^[a-z]{2}(-[A-Za-z0-9]{2,8})?$')
+);
+
+comment on table user_preferences is
+  'What one person prefers, across every company they are a member of. Every column is nullable and none has a default: null means "take the company''s answer, then the pack''s".';
+comment on column user_preferences.preferred_company_id is
+  'The company an interface opens on. Cleared rather than kept when that company is deleted.';
+comment on column user_preferences.language is
+  'Language this person reads labels in. First in the list preferred_languages() builds.';
+comment on column user_preferences.theme is
+  'A client''s business. The core stores it and interprets nothing.';
+
+create trigger user_preferences_set_updated_at
+  before update on user_preferences
+  for each row execute function set_updated_at();
+
+-- ---------------------------------------------------------------------------
+-- preferred_languages — the chain a reader follows
+-- ---------------------------------------------------------------------------
+
+create or replace function preferred_languages(p_company_id uuid default null)
+returns text[]
+language sql
+stable
+security definer
+set search_path = public, pg_temp
+as $$
+  select array_remove(array[
+    (select p.language from user_preferences p where p.user_id = auth.uid()),
+    (select c.language from companies c where c.id = p_company_id),
+    (select d.language_default
+       from companies c join country_defaults d on d.country = c.country
+      where c.id = p_company_id)
+  ], null);
+$$;
+
+comment on function preferred_languages(uuid) is
+  'The languages to try, in order: the user''s own, then the company''s, then the one the country pack declares. Feed it to label_for().';
+
+-- ---------------------------------------------------------------------------
+-- install_country_template, republished on label_for
+--
+-- Unchanged but for one expression: the chart is copied under
+-- `label_for(t.name, t.name_i18n, array[v_language])` instead of the coalesce
+-- that was written out here. Same answer, one formula.
+-- ---------------------------------------------------------------------------
+
+create or replace function install_country_template(
+  p_company_id uuid,
+  p_country    char(2),
+  p_language   char(2) default null,
+  p_chart_code text default null
+)
+returns void
+language plpgsql
+as $$
+declare
+  v_defaults country_defaults%rowtype;
+  r          record;
+  v_tax_id   uuid;
+  v_language char(2);
+  v_version  text;
+  v_chart    text;
+  v_charts   text;
+begin
+  if not exists (select 1 from companies where id = p_company_id) then
+    raise exception 'unknown_company: %', p_company_id;
+  end if;
+
+  -- Which chart. The caller names one, or the pack's default stands. A named
+  -- chart that does not exist is an error that lists what does: guessing here
+  -- would install the wrong plan of accounts and nobody would notice for a
+  -- year.
+  if p_chart_code is null then
+    select c.code into v_chart
+      from chart_templates c
+     where c.country = p_country and c.is_default;
+    if v_chart is null then
+      -- No pack for this country, or a pack that names no default chart.
+      raise exception 'unknown_country_template: no chart of accounts seeded for %', p_country;
+    end if;
+  else
+    select c.code into v_chart
+      from chart_templates c
+     where c.country = p_country and c.code = p_chart_code;
+    if v_chart is null then
+      select string_agg(c.code, ', ' order by c.code) into v_charts
+        from chart_templates c where c.country = p_country;
+      raise exception 'unknown_chart: % has no chart %. It has: %',
+        p_country, p_chart_code, coalesce(v_charts, 'none');
+    end if;
+  end if;
+
+  if not exists (
+    select 1 from account_templates
+     where country = p_country and chart_code = v_chart
+  ) then
+    raise exception 'unknown_country_template: chart % of % holds no account', v_chart, p_country;
+  end if;
+
+  -- The language of the copy: what the caller asked for, else what the
+  -- company keeps its books in.
+  select coalesce(p_language, c.language) into v_language
+    from companies c where c.id = p_company_id;
+
+  -- 1. Accounts, without the hierarchy.
+  insert into accounts (company_id, code, name, name_i18n, statement_hint,
+                        account_type, reconcilable)
+  select p_company_id, t.code,
+         label_for(t.name, t.name_i18n, array[v_language]),
+         t.name_i18n, t.statement_hint, t.account_type, t.reconcilable
+    from account_templates t
+   where t.country = p_country
+     and t.chart_code = v_chart
+  on conflict (company_id, code) do nothing;
+
+  -- 2. Hierarchy, now that every code exists.
+  update accounts a
+     set parent_id = p.id
+    from account_templates t
+    join accounts p on p.company_id = p_company_id and p.code = t.parent_code
+   where a.company_id = p_company_id
+     and a.code = t.code
+     and t.country = p_country
+     and t.chart_code = v_chart
+     and t.parent_code is not null
+     and a.parent_id is null;
+
+  -- 3. Journals. Common to every chart of the country.
+  insert into journals (company_id, code, name, journal_type)
+  select p_company_id, t.code, t.name, t.journal_type
+    from journal_templates t
+   where t.country = p_country
+  on conflict (company_id, code) do nothing;
+
+  -- 4. Taxes and their postings. Also common: a chart changes how a company
+  --    presents itself, not what it owes.
+  for r in
+    select * from tax_templates where country = p_country order by sequence, code
+  loop
+    v_tax_id := null;
+    insert into taxes (company_id, code, name, description, amount_type, amount,
+                       applies_to, treatment, country, valid_from, valid_to,
+                       legal_reference, vat_category, exemption_code, sequence,
+                       tax_kind, recoverable, jurisdiction, price_include,
+                       cash_basis, cash_basis_transition_account_id)
+    values (p_company_id, r.code, r.name, r.description, r.amount_type, r.amount,
+            r.applies_to, r.treatment, p_country, r.valid_from, r.valid_to,
+            r.legal_reference, r.vat_category, r.exemption_code, r.sequence,
+            r.tax_kind, r.recoverable, r.jurisdiction, r.price_include,
+            r.cash_basis, account_id_by_code(p_company_id, r.cash_basis_transition_account_code))
+    on conflict (company_id, code) do nothing
+    returning id into v_tax_id;
+
+    if v_tax_id is null then
+      continue;
+    end if;
+
+    insert into tax_postings (tax_id, company_id, document_kind, posting_type,
+                              factor_percent, account_id, declaration_box,
+                              box_factor_percent, report_code, sequence)
+    select v_tax_id, p_company_id, tp.document_kind, tp.posting_type,
+           tp.factor_percent, account_id_by_code(p_company_id, tp.account_code),
+           tp.declaration_box, tp.box_factor_percent, tp.report_code, tp.sequence
+      from tax_posting_templates tp
+     where tp.tax_template_id = r.id
+     order by tp.sequence;
+  end loop;
+
+  -- 5. Roles.
+  select * into v_defaults from country_defaults where country = p_country;
+  if found then
+    update companies c
+       set receivable_account_id       = coalesce(c.receivable_account_id, account_id_by_code(p_company_id, v_defaults.receivable_code)),
+           payable_account_id          = coalesce(c.payable_account_id, account_id_by_code(p_company_id, v_defaults.payable_code)),
+           suspense_account_id         = coalesce(c.suspense_account_id, account_id_by_code(p_company_id, v_defaults.suspense_code)),
+           rounding_account_id         = coalesce(c.rounding_account_id, account_id_by_code(p_company_id, v_defaults.rounding_code)),
+           retained_earnings_account_id = coalesce(c.retained_earnings_account_id, account_id_by_code(p_company_id, v_defaults.retained_earnings_code)),
+           default_sales_account_id    = coalesce(c.default_sales_account_id, account_id_by_code(p_company_id, v_defaults.sales_account_code)),
+           default_purchase_account_id = coalesce(c.default_purchase_account_id, account_id_by_code(p_company_id, v_defaults.purchase_account_code)),
+           sales_journal_id            = coalesce(c.sales_journal_id, (select id from journals where company_id = p_company_id and code = v_defaults.sales_journal_code)),
+           purchase_journal_id         = coalesce(c.purchase_journal_id, (select id from journals where company_id = p_company_id and code = v_defaults.purchase_journal_code)),
+           miscellaneous_journal_id    = coalesce(c.miscellaneous_journal_id, (select id from journals where company_id = p_company_id and code = v_defaults.misc_journal_code))
+     where c.id = p_company_id;
+
+    -- 6. The financial journals point at their account.
+    update journals j
+       set default_account_id = account_id_by_code(p_company_id, v_defaults.bank_account_code)
+     where j.company_id = p_company_id
+       and j.journal_type = 'bank'
+       and j.default_account_id is null
+       and v_defaults.bank_account_code is not null;
+
+    update journals j
+       set default_account_id = account_id_by_code(p_company_id, v_defaults.cash_account_code)
+     where j.company_id = p_company_id
+       and j.journal_type = 'cash'
+       and j.default_account_id is null
+       and v_defaults.cash_account_code is not null;
+  end if;
+
+  -- 7. What was copied, from which version, and on which chart.
+  v_version := coalesce((select version from country_packs where country = p_country), '1.0.0');
+
+  insert into company_packs (company_id, country, version, chart_code)
+  values (p_company_id, p_country, v_version, v_chart)
+  on conflict (company_id, country) do update
+     set version = excluded.version,
+         chart_code = excluded.chart_code,
+         upgraded_at = now()
+   where company_packs.version is distinct from excluded.version
+      or company_packs.chart_code is distinct from excluded.chart_code;
+end;
+$$;
+
+-- ---------------------------------------------------------------------------
+-- Writing them
+--
+-- A patch rather than a row, and jsonb rather than seven arguments, for one
+-- reason: with arguments there is no way to tell "leave the timezone alone"
+-- from "clear the timezone". A key that is present is written — null
+-- included, which is how a preference is cleared — and a key that is absent
+-- is untouched. A key nobody declared is refused rather than dropped on the
+-- floor, because a preference that silently did not save is worse than an
+-- error.
+--
+-- It writes the caller's own row and no other: `auth.uid()` is the key, and
+-- it is not an argument.
+-- ---------------------------------------------------------------------------
+
+create or replace function set_preferences(p_patch jsonb)
+returns user_preferences
+language plpgsql
+as $$
+declare
+  v_known text[] := array['preferred_company_id', 'language', 'timezone',
+                          'date_display_format', 'number_display_format', 'theme'];
+  v_unknown text;
+  v_row user_preferences%rowtype;
+begin
+  if auth.uid() is null then
+    raise exception 'no_user: preferences belong to a signed-in user';
+  end if;
+  if p_patch is null or jsonb_typeof(p_patch) <> 'object' then
+    raise exception 'bad_patch: set_preferences takes an object of the preferences to change';
+  end if;
+
+  select k into v_unknown
+    from jsonb_object_keys(p_patch) as k
+   where k <> all (v_known)
+   limit 1;
+  if v_unknown is not null then
+    raise exception 'unknown_preference: % is not a preference this installation keeps (%)',
+      v_unknown, array_to_string(v_known, ', ');
+  end if;
+
+  insert into user_preferences (user_id, preferred_company_id, language, timezone,
+                                date_display_format, number_display_format, theme)
+  values (auth.uid(),
+          nullif(p_patch ->> 'preferred_company_id', '')::uuid,
+          nullif(p_patch ->> 'language', ''),
+          nullif(p_patch ->> 'timezone', ''),
+          nullif(p_patch ->> 'date_display_format', ''),
+          nullif(p_patch ->> 'number_display_format', ''),
+          nullif(p_patch ->> 'theme', ''))
+  on conflict (user_id) do update set
+    preferred_company_id = case when p_patch ? 'preferred_company_id'
+                                then nullif(p_patch ->> 'preferred_company_id', '')::uuid
+                                else user_preferences.preferred_company_id end,
+    language             = case when p_patch ? 'language'
+                                then nullif(p_patch ->> 'language', '')
+                                else user_preferences.language end,
+    timezone             = case when p_patch ? 'timezone'
+                                then nullif(p_patch ->> 'timezone', '')
+                                else user_preferences.timezone end,
+    date_display_format   = case when p_patch ? 'date_display_format'
+                                 then nullif(p_patch ->> 'date_display_format', '')
+                                 else user_preferences.date_display_format end,
+    number_display_format = case when p_patch ? 'number_display_format'
+                                 then nullif(p_patch ->> 'number_display_format', '')
+                                 else user_preferences.number_display_format end,
+    theme                = case when p_patch ? 'theme'
+                                then nullif(p_patch ->> 'theme', '')
+                                else user_preferences.theme end
+  returning * into v_row;
+
+  return v_row;
+end;
+$$;
+
+comment on function set_preferences(jsonb) is
+  'Writes the signed-in user''s preferences. A key that is present is written, null included; a key that is absent is left alone; a key nobody declared is refused.';
+
+-- ---------------------------------------------------------------------------
+-- Row level security
+--
+-- A preference is nobody else's business — not another member's, not an
+-- instance administrator's. One policy, own row, both ways.
+-- ---------------------------------------------------------------------------
+
+alter table user_preferences enable row level security;
+
+create policy user_preferences_own on user_preferences
+  for all using (user_id = auth.uid()) with check (user_id = auth.uid());
+
+comment on policy user_preferences_own on user_preferences is
+  'Yours and nobody else''s, including an administrator''s.';
+
+revoke execute on all functions in schema public from public;