snipe-auth-rbac 0.5.0 → 0.6.1

package/sql/0001_initial.sql

@@ -176,6 +176,35 @@ CREATE TABLE IF NOT EXISTS rbac.resource_dependencies (
     CONSTRAINT resource_dependencies_no_self CHECK (parent_resource <> child_resource)
 );
 
+-- 0.6.0+: Per-role admin override of implied permissions.
+--
+-- Granting a parent like `properties:read` implies a read on all of
+-- properties.dependsOn at lookup time. Sometimes an admin wants a
+-- role to have the parent but NOT a specific dependent — Anwalt
+-- gets tenants/leases but must not see payments, even though
+-- tenants.dependsOn includes payments.
+--
+-- A row here is a suppression: "this role does NOT have this
+-- (resource, action), even if rbac.resource_dependencies would
+-- otherwise imply it from a direct grant on the parent." Resolver
+-- functions (rbac.user_can, rbac.user_profile) subtract these rows
+-- from the expanded grant set.
+--
+-- Direct grants are unaffected — if the role has a direct
+-- rbac.role_permissions row granting the action, that row takes
+-- precedence over any override on the same cell.
+CREATE TABLE IF NOT EXISTS rbac.role_permission_overrides (
+    role_id    uuid NOT NULL REFERENCES rbac.roles(id) ON DELETE CASCADE,
+    resource   text NOT NULL REFERENCES rbac.resources(resource) ON DELETE CASCADE,
+    action     text NOT NULL CHECK (action IN ('read','write','update','delete')),
+    created_at timestamptz NOT NULL DEFAULT now(),
+    created_by uuid,
+    PRIMARY KEY (role_id, resource, action)
+);
+
+CREATE INDEX IF NOT EXISTS role_permission_overrides_resource_action_idx
+    ON rbac.role_permission_overrides (resource, action);
+
 CREATE OR REPLACE FUNCTION rbac.check_role_resource_scope()
 RETURNS trigger
 LANGUAGE plpgsql
@@ -284,7 +313,11 @@ BEGIN
 
     IF v_resource_scope = 'system' THEN
         RETURN EXISTS (
-            -- Direct grant on the resource at system scope.
+            -- Direct grant on the resource at system scope, on a
+            -- role without an override on this (resource, action).
+            -- 0.6.0+: overrides apply to direct grants too — if an
+            -- admin explicitly suppresses payments:read on a role,
+            -- the role doesn't get it even if a direct row exists.
             SELECT 1
               FROM rbac.user_system_roles usr
               JOIN rbac.role_permissions rp ON rp.role_id = usr.role_id
@@ -296,12 +329,19 @@ BEGIN
                        WHEN 'update' THEN rp.can_update
                        WHEN 'delete' THEN rp.can_delete
                    END
+               AND NOT EXISTS (
+                 SELECT 1 FROM rbac.role_permission_overrides ovr
+                  WHERE ovr.role_id = rp.role_id
+                    AND ovr.resource = p_resource
+                    AND ovr.action   = p_action
+               )
         ) OR EXISTS (
             -- Implied via a direct grant on any parent at system
             -- scope. resource_dependencies edges are scope-agnostic
             -- (declared per-(parent,child,action)); the SCOPE of the
             -- inheritance is governed by where the parent grant
-            -- lives.
+            -- lives. Override on the child suppresses the implied
+            -- access.
             SELECT 1
               FROM rbac.resource_dependencies d
               JOIN rbac.user_system_roles usr ON true
@@ -316,6 +356,12 @@ BEGIN
                        WHEN 'update' THEN rp.can_update
                        WHEN 'delete' THEN rp.can_delete
                    END
+               AND NOT EXISTS (
+                 SELECT 1 FROM rbac.role_permission_overrides ovr
+                  WHERE ovr.role_id = rp.role_id
+                    AND ovr.resource = p_resource
+                    AND ovr.action   = p_action
+               )
         );
     END IF;
 
@@ -338,6 +384,12 @@ BEGIN
                    WHEN 'update' THEN rp.can_update
                    WHEN 'delete' THEN rp.can_delete
                END
+           AND NOT EXISTS (
+             SELECT 1 FROM rbac.role_permission_overrides ovr
+              WHERE ovr.role_id = rp.role_id
+                AND ovr.resource = p_resource
+                AND ovr.action   = p_action
+           )
     ) OR EXISTS (
         -- Implied via a direct grant on any parent in the same
         -- company.
@@ -356,6 +408,12 @@ BEGIN
                    WHEN 'update' THEN rp.can_update
                    WHEN 'delete' THEN rp.can_delete
                END
+           AND NOT EXISTS (
+             SELECT 1 FROM rbac.role_permission_overrides ovr
+              WHERE ovr.role_id = rp.role_id
+                AND ovr.resource = p_resource
+                AND ovr.action   = p_action
+           )
     );
 END $$;
 
@@ -384,6 +442,10 @@ STABLE
 SECURITY DEFINER
 SET search_path = rbac, public
 AS $$
+  -- 0.6.0+: every grant is computed per-(role,resource) so that
+  -- rbac.role_permission_overrides can subtract suppressions on a
+  -- per-role basis. Aggregating to per-resource happens AFTER the
+  -- per-role overrides filter.
   WITH
   system_roles AS (
     SELECT r.id, r.name, r.is_super, r.frontend_config
@@ -391,32 +453,72 @@ AS $$
       JOIN rbac.roles r ON r.id = usr.role_id
      WHERE usr.user_id = p_user_id
   ),
-  -- Direct grants at system scope, aggregated per resource.
-  system_direct AS (
-    SELECT rp.resource,
-           bool_or(rp.can_read)   AS can_read,
-           bool_or(rp.can_write)  AS can_write,
-           bool_or(rp.can_update) AS can_update,
-           bool_or(rp.can_delete) AS can_delete
+  system_role_grants AS (
+    SELECT usr.role_id, rp.resource,
+           rp.can_read   AND NOT EXISTS (
+             SELECT 1 FROM rbac.role_permission_overrides ovr
+              WHERE ovr.role_id = rp.role_id AND ovr.resource = rp.resource AND ovr.action = 'read'
+           ) AS can_read,
+           rp.can_write  AND NOT EXISTS (
+             SELECT 1 FROM rbac.role_permission_overrides ovr
+              WHERE ovr.role_id = rp.role_id AND ovr.resource = rp.resource AND ovr.action = 'write'
+           ) AS can_write,
+           rp.can_update AND NOT EXISTS (
+             SELECT 1 FROM rbac.role_permission_overrides ovr
+              WHERE ovr.role_id = rp.role_id AND ovr.resource = rp.resource AND ovr.action = 'update'
+           ) AS can_update,
+           rp.can_delete AND NOT EXISTS (
+             SELECT 1 FROM rbac.role_permission_overrides ovr
+              WHERE ovr.role_id = rp.role_id AND ovr.resource = rp.resource AND ovr.action = 'delete'
+           ) AS can_delete
       FROM rbac.user_system_roles usr
       JOIN rbac.role_permissions rp ON rp.role_id = usr.role_id
      WHERE usr.user_id = p_user_id
-     GROUP BY rp.resource
   ),
-  -- For every direct grant on a parent, fan out to children via
-  -- rbac.resource_dependencies and AND-mask by the cascading action.
+  system_direct AS (
+    SELECT resource,
+           bool_or(can_read)   AS can_read,
+           bool_or(can_write)  AS can_write,
+           bool_or(can_update) AS can_update,
+           bool_or(can_delete) AS can_delete
+      FROM system_role_grants
+     GROUP BY resource
+  ),
+  -- Implied per role: for each parent direct-grant on a role, fan
+  -- out via resource_dependencies. Override on (role, child, action)
+  -- suppresses the child for that role.
+  system_implied_per_role AS (
+    SELECT g.role_id,
+           d.child_resource AS resource,
+           bool_or(d.action = 'read'   AND g.can_read AND NOT EXISTS (
+             SELECT 1 FROM rbac.role_permission_overrides ovr
+              WHERE ovr.role_id = g.role_id AND ovr.resource = d.child_resource AND ovr.action = 'read'
+           )) AS can_read,
+           bool_or(d.action = 'write'  AND g.can_write AND NOT EXISTS (
+             SELECT 1 FROM rbac.role_permission_overrides ovr
+              WHERE ovr.role_id = g.role_id AND ovr.resource = d.child_resource AND ovr.action = 'write'
+           )) AS can_write,
+           bool_or(d.action = 'update' AND g.can_update AND NOT EXISTS (
+             SELECT 1 FROM rbac.role_permission_overrides ovr
+              WHERE ovr.role_id = g.role_id AND ovr.resource = d.child_resource AND ovr.action = 'update'
+           )) AS can_update,
+           bool_or(d.action = 'delete' AND g.can_delete AND NOT EXISTS (
+             SELECT 1 FROM rbac.role_permission_overrides ovr
+              WHERE ovr.role_id = g.role_id AND ovr.resource = d.child_resource AND ovr.action = 'delete'
+           )) AS can_delete
+      FROM system_role_grants g
+      JOIN rbac.resource_dependencies d ON d.parent_resource = g.resource
+     GROUP BY g.role_id, d.child_resource
+  ),
   system_implied AS (
-    SELECT d.child_resource AS resource,
-           bool_or(d.action = 'read'   AND sd.can_read)   AS can_read,
-           bool_or(d.action = 'write'  AND sd.can_write)  AS can_write,
-           bool_or(d.action = 'update' AND sd.can_update) AS can_update,
-           bool_or(d.action = 'delete' AND sd.can_delete) AS can_delete
-      FROM system_direct sd
-      JOIN rbac.resource_dependencies d ON d.parent_resource = sd.resource
-     GROUP BY d.child_resource
+    SELECT resource,
+           bool_or(can_read)   AS can_read,
+           bool_or(can_write)  AS can_write,
+           bool_or(can_update) AS can_update,
+           bool_or(can_delete) AS can_delete
+      FROM system_implied_per_role
+     GROUP BY resource
   ),
-  -- Expanded = direct UNION implied. bool_or merges duplicate
-  -- (resource, action) hits across the two sources.
   system_expanded AS (
     SELECT resource,
            bool_or(can_read)   AS can_read,
@@ -444,29 +546,67 @@ AS $$
      WHERE ucr.user_id = p_user_id
      GROUP BY c.id, c.name, c.slug
   ),
-  -- Direct grants at company scope.
-  company_direct AS (
-    SELECT ucr.company_id,
-           rp.resource,
-           bool_or(rp.can_read)   AS can_read,
-           bool_or(rp.can_write)  AS can_write,
-           bool_or(rp.can_update) AS can_update,
-           bool_or(rp.can_delete) AS can_delete
+  company_role_grants AS (
+    SELECT ucr.company_id, ucr.role_id, rp.resource,
+           rp.can_read   AND NOT EXISTS (
+             SELECT 1 FROM rbac.role_permission_overrides ovr
+              WHERE ovr.role_id = rp.role_id AND ovr.resource = rp.resource AND ovr.action = 'read'
+           ) AS can_read,
+           rp.can_write  AND NOT EXISTS (
+             SELECT 1 FROM rbac.role_permission_overrides ovr
+              WHERE ovr.role_id = rp.role_id AND ovr.resource = rp.resource AND ovr.action = 'write'
+           ) AS can_write,
+           rp.can_update AND NOT EXISTS (
+             SELECT 1 FROM rbac.role_permission_overrides ovr
+              WHERE ovr.role_id = rp.role_id AND ovr.resource = rp.resource AND ovr.action = 'update'
+           ) AS can_update,
+           rp.can_delete AND NOT EXISTS (
+             SELECT 1 FROM rbac.role_permission_overrides ovr
+              WHERE ovr.role_id = rp.role_id AND ovr.resource = rp.resource AND ovr.action = 'delete'
+           ) AS can_delete
       FROM rbac.user_company_roles ucr
       JOIN rbac.role_permissions rp ON rp.role_id = ucr.role_id
      WHERE ucr.user_id = p_user_id
-     GROUP BY ucr.company_id, rp.resource
+  ),
+  company_direct AS (
+    SELECT company_id, resource,
+           bool_or(can_read)   AS can_read,
+           bool_or(can_write)  AS can_write,
+           bool_or(can_update) AS can_update,
+           bool_or(can_delete) AS can_delete
+      FROM company_role_grants
+     GROUP BY company_id, resource
+  ),
+  company_implied_per_role AS (
+    SELECT g.company_id, g.role_id, d.child_resource AS resource,
+           bool_or(d.action = 'read'   AND g.can_read AND NOT EXISTS (
+             SELECT 1 FROM rbac.role_permission_overrides ovr
+              WHERE ovr.role_id = g.role_id AND ovr.resource = d.child_resource AND ovr.action = 'read'
+           )) AS can_read,
+           bool_or(d.action = 'write'  AND g.can_write AND NOT EXISTS (
+             SELECT 1 FROM rbac.role_permission_overrides ovr
+              WHERE ovr.role_id = g.role_id AND ovr.resource = d.child_resource AND ovr.action = 'write'
+           )) AS can_write,
+           bool_or(d.action = 'update' AND g.can_update AND NOT EXISTS (
+             SELECT 1 FROM rbac.role_permission_overrides ovr
+              WHERE ovr.role_id = g.role_id AND ovr.resource = d.child_resource AND ovr.action = 'update'
+           )) AS can_update,
+           bool_or(d.action = 'delete' AND g.can_delete AND NOT EXISTS (
+             SELECT 1 FROM rbac.role_permission_overrides ovr
+              WHERE ovr.role_id = g.role_id AND ovr.resource = d.child_resource AND ovr.action = 'delete'
+           )) AS can_delete
+      FROM company_role_grants g
+      JOIN rbac.resource_dependencies d ON d.parent_resource = g.resource
+     GROUP BY g.company_id, g.role_id, d.child_resource
   ),
   company_implied AS (
-    SELECT cd.company_id,
-           d.child_resource AS resource,
-           bool_or(d.action = 'read'   AND cd.can_read)   AS can_read,
-           bool_or(d.action = 'write'  AND cd.can_write)  AS can_write,
-           bool_or(d.action = 'update' AND cd.can_update) AS can_update,
-           bool_or(d.action = 'delete' AND cd.can_delete) AS can_delete
-      FROM company_direct cd
-      JOIN rbac.resource_dependencies d ON d.parent_resource = cd.resource
-     GROUP BY cd.company_id, d.child_resource
+    SELECT company_id, resource,
+           bool_or(can_read)   AS can_read,
+           bool_or(can_write)  AS can_write,
+           bool_or(can_update) AS can_update,
+           bool_or(can_delete) AS can_delete
+      FROM company_implied_per_role
+     GROUP BY company_id, resource
   ),
   company_expanded AS (
     SELECT company_id, resource,
@@ -481,22 +621,32 @@ AS $$
       ) u
      GROUP BY company_id, resource
   ),
-  -- Direct-only stays the source of truth for canAccessSection().
+  -- direct_<action> maps reflect the underlying row set on
+  -- rbac.role_permissions — NOT post-override. canAccessSection
+  -- asks "is there a direct row" for navigation purposes, not "does
+  -- the role effectively have the action" — those are different
+  -- questions and the UI needs both.
   system_perms AS (
-    SELECT resource,
-           can_read   AS direct_read,
-           can_write  AS direct_write,
-           can_update AS direct_update,
-           can_delete AS direct_delete
-      FROM system_direct
+    SELECT rp.resource,
+           bool_or(rp.can_read)   AS direct_read,
+           bool_or(rp.can_write)  AS direct_write,
+           bool_or(rp.can_update) AS direct_update,
+           bool_or(rp.can_delete) AS direct_delete
+      FROM rbac.user_system_roles usr
+      JOIN rbac.role_permissions rp ON rp.role_id = usr.role_id
+     WHERE usr.user_id = p_user_id
+     GROUP BY rp.resource
   ),
   company_perms AS (
-    SELECT company_id, resource,
-           can_read   AS direct_read,
-           can_write  AS direct_write,
-           can_update AS direct_update,
-           can_delete AS direct_delete
-      FROM company_direct
+    SELECT ucr.company_id, rp.resource,
+           bool_or(rp.can_read)   AS direct_read,
+           bool_or(rp.can_write)  AS direct_write,
+           bool_or(rp.can_update) AS direct_update,
+           bool_or(rp.can_delete) AS direct_delete
+      FROM rbac.user_company_roles ucr
+      JOIN rbac.role_permissions rp ON rp.role_id = ucr.role_id
+     WHERE ucr.user_id = p_user_id
+     GROUP BY ucr.company_id, rp.resource
   )
   SELECT jsonb_build_object(
     'user_id', p_user_id,
@@ -807,6 +957,15 @@ DO $$ BEGIN
     IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated') THEN
         EXECUTE 'GRANT EXECUTE ON FUNCTION rbac.is_super_admin() TO authenticated';
         EXECUTE 'GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA rbac TO authenticated';
+        -- 0.6.1+: ALTER DEFAULT PRIVILEGES so any future tables
+        -- added to the rbac schema (by adopters or by a later
+        -- version of this package) automatically get the same
+        -- authenticated CRUD grant. Prevents the
+        -- "rbac.role_permission_overrides missing UPDATE → upsert
+        -- silently rejected" class of bug that hit adopters who
+        -- ran 0001 on an existing DB before role_permission_overrides
+        -- existed.
+        EXECUTE 'ALTER DEFAULT PRIVILEGES IN SCHEMA rbac GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO authenticated';
     END IF;
     IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'service_role') THEN
         EXECUTE 'GRANT ALL ON ALL TABLES IN SCHEMA rbac TO service_role';
@@ -815,12 +974,27 @@ DO $$ BEGIN
     END IF;
 END $$;
 
-ALTER TABLE rbac.companies          ENABLE ROW LEVEL SECURITY;
-ALTER TABLE rbac.resources          ENABLE ROW LEVEL SECURITY;
-ALTER TABLE rbac.roles              ENABLE ROW LEVEL SECURITY;
-ALTER TABLE rbac.role_permissions   ENABLE ROW LEVEL SECURITY;
-ALTER TABLE rbac.user_system_roles  ENABLE ROW LEVEL SECURITY;
-ALTER TABLE rbac.user_company_roles ENABLE ROW LEVEL SECURITY;
+-- 0.6.1+: explicit per-table re-grant for the two 0.4.0+ tables.
+-- Belt-and-braces for adopters whose DB has the tables but whose
+-- earlier 0001 run pre-dated the tables (so the schema-wide GRANT
+-- above didn't cover them, and ALTER DEFAULT PRIVILEGES only
+-- applies to tables created AFTER it). Idempotent — re-granting
+-- existing privileges is a no-op.
+DO $$ BEGIN
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated') THEN
+        EXECUTE 'GRANT SELECT, INSERT, UPDATE, DELETE ON rbac.resource_dependencies     TO authenticated';
+        EXECUTE 'GRANT SELECT, INSERT, UPDATE, DELETE ON rbac.role_permission_overrides TO authenticated';
+    END IF;
+END $$;
+
+ALTER TABLE rbac.companies                 ENABLE ROW LEVEL SECURITY;
+ALTER TABLE rbac.resources                 ENABLE ROW LEVEL SECURITY;
+ALTER TABLE rbac.roles                     ENABLE ROW LEVEL SECURITY;
+ALTER TABLE rbac.role_permissions          ENABLE ROW LEVEL SECURITY;
+ALTER TABLE rbac.user_system_roles         ENABLE ROW LEVEL SECURITY;
+ALTER TABLE rbac.user_company_roles        ENABLE ROW LEVEL SECURITY;
+ALTER TABLE rbac.resource_dependencies     ENABLE ROW LEVEL SECURITY;
+ALTER TABLE rbac.role_permission_overrides ENABLE ROW LEVEL SECURITY;
 
 -- READ — open to any authenticated user for static config tables;
 -- own-row only on assignment tables (super-admin sees all).
@@ -870,6 +1044,31 @@ DROP POLICY IF EXISTS rbac_user_company_roles_write ON rbac.user_company_roles;
 CREATE POLICY rbac_user_company_roles_write ON rbac.user_company_roles FOR ALL TO authenticated
   USING (rbac.is_super_admin()) WITH CHECK (rbac.is_super_admin());
 
+-- 0.4.0+ rbac.resource_dependencies — readable to any authenticated
+-- user (the admin matrix UI consults it on every render to compute
+-- implied state). Direct writes are super-admin only as defence-in-
+-- depth; in practice the SECURITY DEFINER RPC
+-- rbac.replace_resource_dependencies handles every write.
+DROP POLICY IF EXISTS rbac_resource_dependencies_read     ON rbac.resource_dependencies;
+CREATE POLICY rbac_resource_dependencies_read     ON rbac.resource_dependencies
+  FOR SELECT TO authenticated USING (true);
+
+DROP POLICY IF EXISTS rbac_resource_dependencies_write    ON rbac.resource_dependencies;
+CREATE POLICY rbac_resource_dependencies_write    ON rbac.resource_dependencies
+  FOR ALL TO authenticated
+  USING (rbac.is_super_admin()) WITH CHECK (rbac.is_super_admin());
+
+-- 0.6.0+ rbac.role_permission_overrides — same read-anyone /
+-- write-super-admin pattern as the rest of the matrix tables.
+DROP POLICY IF EXISTS rbac_role_permission_overrides_read  ON rbac.role_permission_overrides;
+CREATE POLICY rbac_role_permission_overrides_read  ON rbac.role_permission_overrides
+  FOR SELECT TO authenticated USING (true);
+
+DROP POLICY IF EXISTS rbac_role_permission_overrides_write ON rbac.role_permission_overrides;
+CREATE POLICY rbac_role_permission_overrides_write ON rbac.role_permission_overrides
+  FOR ALL TO authenticated
+  USING (rbac.is_super_admin()) WITH CHECK (rbac.is_super_admin());
+
 COMMIT;
 
 -- Tell PostgREST to refresh schema cache so the policies + grants