spine-framework 0.3.16 → 0.3.18

package/.framework/migrations/002_rls_and_functions.sql

@@ -0,0 +1,710 @@
+-- Migration 002: Functions, RLS Policies, Indexes, and Foreign Keys
+-- Consolidated from migrations 003, 004, 005, 006, 012, 014
+
+-- ============================================
+-- FUNCTIONS
+-- ============================================
+
+-- Account hierarchy traversal
+CREATE OR REPLACE FUNCTION public.get_accessible_accounts(actor_id uuid)
+RETURNS TABLE (account_id uuid) AS $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM public.people p
+    JOIN public.roles r ON p.role_id = r.id
+    WHERE p.id = actor_id AND r.slug = 'system_admin'
+  ) THEN
+    RETURN QUERY SELECT a.id FROM public.accounts a;
+    RETURN;
+  END IF;
+  RETURN QUERY
+  WITH RECURSIVE account_tree AS (
+    SELECT p.account_id as id FROM public.people p WHERE p.id = actor_id
+    UNION ALL
+    SELECT ap.descendant_id
+    FROM public.account_paths ap
+    JOIN account_tree at ON ap.ancestor_id = at.id
+  )
+  SELECT id FROM account_tree;
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER;
+
+-- Get current actor ID from auth
+CREATE OR REPLACE FUNCTION public.current_actor_id()
+RETURNS uuid AS $$
+DECLARE
+  v_auth_id UUID;
+  v_person_id UUID;
+BEGIN
+  v_auth_id := auth.uid();
+  
+  -- Look up internal person ID from auth_uid
+  SELECT p.id INTO v_person_id
+  FROM public.people p
+  WHERE p.auth_uid = v_auth_id::text AND p.is_active = true
+  LIMIT 1;
+  
+  RETURN v_person_id;
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER STABLE;
+
+-- Check if person is system admin
+CREATE OR REPLACE FUNCTION public.person_is_system_admin(person_uuid uuid)
+RETURNS boolean AS $$
+BEGIN
+  RETURN EXISTS (
+    SELECT 1 FROM public.people p
+    JOIN public.roles r ON p.role_id = r.id
+    WHERE p.id = person_uuid AND r.slug = 'system_admin'
+  );
+END;
+$$ LANGUAGE plpgsql STABLE;
+
+-- Update account paths on account changes
+CREATE OR REPLACE FUNCTION public.update_account_paths()
+RETURNS TRIGGER AS $$
+BEGIN
+  IF TG_OP = 'INSERT' THEN
+    IF NEW.parent_id IS NOT NULL THEN
+      INSERT INTO public.account_paths (ancestor_id, descendant_id, depth)
+      SELECT ancestor_id, NEW.id, depth + 1 FROM public.account_paths WHERE descendant_id = NEW.parent_id;
+      INSERT INTO public.account_paths (ancestor_id, descendant_id, depth) VALUES (NEW.parent_id, NEW.id, 1);
+    END IF;
+    RETURN NEW;
+  END IF;
+  IF TG_OP = 'UPDATE' AND OLD.parent_id IS DISTINCT FROM NEW.parent_id THEN
+    DELETE FROM public.account_paths WHERE descendant_id = NEW.id;
+    IF NEW.parent_id IS NOT NULL THEN
+      INSERT INTO public.account_paths (ancestor_id, descendant_id, depth)
+      SELECT ancestor_id, NEW.id, depth + 1 FROM public.account_paths WHERE descendant_id = NEW.parent_id;
+      INSERT INTO public.account_paths (ancestor_id, descendant_id, depth) VALUES (NEW.parent_id, NEW.id, 1);
+    END IF;
+    RETURN NEW;
+  END IF;
+  IF TG_OP = 'DELETE' THEN
+    DELETE FROM public.account_paths WHERE descendant_id = OLD.id;
+    RETURN OLD;
+  END IF;
+  RETURN NULL;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Trigger for account paths
+CREATE TRIGGER account_paths_trigger
+AFTER INSERT OR UPDATE OR DELETE ON public.accounts
+FOR EACH ROW EXECUTE FUNCTION public.update_account_paths();
+
+-- set_updated_at trigger function (from 014_webhook_registry.sql)
+CREATE OR REPLACE FUNCTION public.set_updated_at()
+RETURNS TRIGGER AS $$
+BEGIN
+  NEW.updated_at = now();
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- ============================================
+-- FOREIGN KEYS
+-- ============================================
+
+-- accounts FKs
+ALTER TABLE public.accounts ADD CONSTRAINT fk_accounts_parent 
+  FOREIGN KEY (parent_id) REFERENCES public.accounts(id) ON DELETE SET NULL;
+ALTER TABLE public.accounts ADD CONSTRAINT fk_accounts_type 
+  FOREIGN KEY (type_id) REFERENCES public.types(id) ON DELETE RESTRICT;
+ALTER TABLE public.accounts ADD CONSTRAINT fk_accounts_app 
+  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE SET NULL;
+ALTER TABLE public.accounts ADD CONSTRAINT fk_accounts_created_by 
+  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
+ALTER TABLE public.accounts ADD CONSTRAINT fk_accounts_updated_by 
+  FOREIGN KEY (updated_by) REFERENCES public.people(id) ON DELETE SET NULL;
+
+-- people FKs
+ALTER TABLE public.people ADD CONSTRAINT people_account_id_fkey 
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
+ALTER TABLE public.people ADD CONSTRAINT people_app_id_fkey 
+  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE SET NULL;
+ALTER TABLE public.people ADD CONSTRAINT people_role_id_fkey 
+  FOREIGN KEY (role_id) REFERENCES public.roles(id) ON DELETE SET NULL;
+ALTER TABLE public.people ADD CONSTRAINT people_type_id_fkey 
+  FOREIGN KEY (type_id) REFERENCES public.types(id) ON DELETE RESTRICT;
+ALTER TABLE public.people ADD CONSTRAINT people_created_by_fkey 
+  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
+
+-- types FK
+ALTER TABLE public.types ADD CONSTRAINT fk_types_app 
+  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE SET NULL;
+
+-- apps FKs
+ALTER TABLE public.apps ADD CONSTRAINT fk_apps_account 
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE SET NULL;
+ALTER TABLE public.apps ADD CONSTRAINT fk_apps_owner_account 
+  FOREIGN KEY (owner_account_id) REFERENCES public.accounts(id) ON DELETE SET NULL;
+
+-- roles FKs
+ALTER TABLE public.roles ADD CONSTRAINT fk_roles_app 
+  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE CASCADE;
+ALTER TABLE public.roles ADD CONSTRAINT fk_roles_account 
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
+
+-- items FKs
+ALTER TABLE public.items ADD CONSTRAINT fk_items_type 
+  FOREIGN KEY (type_id) REFERENCES public.types(id) ON DELETE RESTRICT;
+ALTER TABLE public.items ADD CONSTRAINT fk_items_account 
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
+ALTER TABLE public.items ADD CONSTRAINT fk_items_app 
+  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE SET NULL;
+ALTER TABLE public.items ADD CONSTRAINT fk_items_created_by 
+  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
+ALTER TABLE public.items ADD CONSTRAINT fk_items_updated_by 
+  FOREIGN KEY (updated_by) REFERENCES public.people(id) ON DELETE SET NULL;
+
+-- threads FKs
+ALTER TABLE public.threads ADD CONSTRAINT fk_threads_type 
+  FOREIGN KEY (type_id) REFERENCES public.types(id) ON DELETE RESTRICT;
+ALTER TABLE public.threads ADD CONSTRAINT fk_threads_account 
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
+ALTER TABLE public.threads ADD CONSTRAINT fk_threads_created_by 
+  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
+ALTER TABLE public.threads ADD CONSTRAINT fk_threads_updated_by 
+  FOREIGN KEY (updated_by) REFERENCES public.people(id) ON DELETE SET NULL;
+
+-- messages FKs
+ALTER TABLE public.messages ADD CONSTRAINT fk_messages_type 
+  FOREIGN KEY (type_id) REFERENCES public.types(id) ON DELETE RESTRICT;
+ALTER TABLE public.messages ADD CONSTRAINT fk_messages_thread 
+  FOREIGN KEY (thread_id) REFERENCES public.threads(id) ON DELETE CASCADE;
+ALTER TABLE public.messages ADD CONSTRAINT fk_messages_person 
+  FOREIGN KEY (person_id) REFERENCES public.people(id) ON DELETE SET NULL;
+ALTER TABLE public.messages ADD CONSTRAINT fk_messages_created_by 
+  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
+
+-- links FKs
+ALTER TABLE public.links ADD CONSTRAINT fk_links_type 
+  FOREIGN KEY (type_id) REFERENCES public.types(id) ON DELETE RESTRICT;
+ALTER TABLE public.links ADD CONSTRAINT fk_links_account 
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
+ALTER TABLE public.links ADD CONSTRAINT fk_links_link_type 
+  FOREIGN KEY (link_type_id) REFERENCES public.link_types(id) ON DELETE SET NULL;
+ALTER TABLE public.links ADD CONSTRAINT fk_links_created_by 
+  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
+ALTER TABLE public.links ADD CONSTRAINT fk_links_updated_by 
+  FOREIGN KEY (updated_by) REFERENCES public.people(id) ON DELETE SET NULL;
+
+-- attachments FKs
+ALTER TABLE public.attachments ADD CONSTRAINT fk_attachments_type 
+  FOREIGN KEY (type_id) REFERENCES public.types(id) ON DELETE RESTRICT;
+ALTER TABLE public.attachments ADD CONSTRAINT fk_attachments_account 
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
+ALTER TABLE public.attachments ADD CONSTRAINT fk_attachments_uploaded_by 
+  FOREIGN KEY (uploaded_by) REFERENCES public.people(id) ON DELETE SET NULL;
+ALTER TABLE public.attachments ADD CONSTRAINT fk_attachments_created_by 
+  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
+
+-- watchers FKs
+ALTER TABLE public.watchers ADD CONSTRAINT fk_watchers_type 
+  FOREIGN KEY (type_id) REFERENCES public.types(id) ON DELETE RESTRICT;
+ALTER TABLE public.watchers ADD CONSTRAINT fk_watchers_account 
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
+ALTER TABLE public.watchers ADD CONSTRAINT fk_watchers_person 
+  FOREIGN KEY (person_id) REFERENCES public.people(id) ON DELETE CASCADE;
+ALTER TABLE public.watchers ADD CONSTRAINT fk_watchers_created_by 
+  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
+
+-- link_types FK
+ALTER TABLE public.link_types ADD CONSTRAINT fk_link_types_app 
+  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE CASCADE;
+
+-- pipelines FKs
+ALTER TABLE public.pipelines ADD CONSTRAINT fk_pipelines_app 
+  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE CASCADE;
+ALTER TABLE public.pipelines ADD CONSTRAINT fk_pipelines_account 
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
+ALTER TABLE public.pipelines ADD CONSTRAINT fk_pipelines_created_by 
+  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
+
+-- pipeline_executions FKs
+ALTER TABLE public.pipeline_executions ADD CONSTRAINT fk_pe_pipeline 
+  FOREIGN KEY (pipeline_id) REFERENCES public.pipelines(id) ON DELETE CASCADE;
+ALTER TABLE public.pipeline_executions ADD CONSTRAINT fk_pe_account 
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
+ALTER TABLE public.pipeline_executions ADD CONSTRAINT fk_pe_created_by 
+  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
+
+-- triggers FKs
+ALTER TABLE public.triggers ADD CONSTRAINT fk_triggers_app 
+  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE CASCADE;
+ALTER TABLE public.triggers ADD CONSTRAINT fk_triggers_account 
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
+ALTER TABLE public.triggers ADD CONSTRAINT fk_triggers_pipeline 
+  FOREIGN KEY (pipeline_id) REFERENCES public.pipelines(id) ON DELETE SET NULL;
+ALTER TABLE public.triggers ADD CONSTRAINT fk_triggers_created_by 
+  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
+
+-- trigger_executions FK
+ALTER TABLE public.trigger_executions ADD CONSTRAINT fk_te_trigger 
+  FOREIGN KEY (trigger_id) REFERENCES public.triggers(id) ON DELETE CASCADE;
+
+-- timers FKs
+ALTER TABLE public.timers ADD CONSTRAINT fk_timers_app 
+  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE CASCADE;
+ALTER TABLE public.timers ADD CONSTRAINT fk_timers_account 
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
+ALTER TABLE public.timers ADD CONSTRAINT fk_timers_pipeline 
+  FOREIGN KEY (pipeline_id) REFERENCES public.pipelines(id) ON DELETE SET NULL;
+ALTER TABLE public.timers ADD CONSTRAINT fk_timers_created_by 
+  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
+
+-- ai_agents FKs
+ALTER TABLE public.ai_agents ADD CONSTRAINT fk_ai_agents_app 
+  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE CASCADE;
+ALTER TABLE public.ai_agents ADD CONSTRAINT fk_ai_agents_account 
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
+ALTER TABLE public.ai_agents ADD CONSTRAINT fk_ai_agents_created_by 
+  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
+
+-- embeddings FK
+ALTER TABLE public.embeddings ADD CONSTRAINT fk_embeddings_account 
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
+
+-- integrations FKs
+ALTER TABLE public.integrations ADD CONSTRAINT fk_integrations_app 
+  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE CASCADE;
+ALTER TABLE public.integrations ADD CONSTRAINT fk_integrations_account 
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
+ALTER TABLE public.integrations ADD CONSTRAINT fk_integrations_created_by 
+  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
+
+-- prompt_configs FKs
+ALTER TABLE public.prompt_configs ADD CONSTRAINT fk_prompt_configs_app 
+  FOREIGN KEY (app_id) REFERENCES public.apps(id) ON DELETE CASCADE;
+ALTER TABLE public.prompt_configs ADD CONSTRAINT fk_prompt_configs_account 
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
+ALTER TABLE public.prompt_configs ADD CONSTRAINT fk_prompt_configs_created_by 
+  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
+
+-- api_keys FKs
+ALTER TABLE public.api_keys ADD CONSTRAINT fk_api_keys_integration 
+  FOREIGN KEY (integration_id) REFERENCES public.integrations(id) ON DELETE SET NULL;
+ALTER TABLE public.api_keys ADD CONSTRAINT fk_api_keys_account 
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
+ALTER TABLE public.api_keys ADD CONSTRAINT fk_api_keys_created_by 
+  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
+
+-- api_key_usage_logs FKs
+ALTER TABLE public.api_key_usage_logs ADD CONSTRAINT fk_akul_api_key 
+  FOREIGN KEY (api_key_id) REFERENCES public.api_keys(id) ON DELETE CASCADE;
+ALTER TABLE public.api_key_usage_logs ADD CONSTRAINT fk_akul_account 
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
+
+-- logs FKs
+ALTER TABLE public.logs ADD CONSTRAINT fk_logs_person 
+  FOREIGN KEY (person_id) REFERENCES public.people(id) ON DELETE SET NULL;
+ALTER TABLE public.logs ADD CONSTRAINT fk_logs_account 
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
+
+-- actions FKs
+ALTER TABLE public.actions ADD CONSTRAINT fk_actions_account 
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
+ALTER TABLE public.actions ADD CONSTRAINT fk_actions_machine_principal 
+  FOREIGN KEY (default_machine_principal_id) REFERENCES public.api_keys(id) ON DELETE SET NULL;
+ALTER TABLE public.actions ADD CONSTRAINT fk_actions_created_by 
+  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
+
+-- schedules FKs
+ALTER TABLE public.schedules ADD CONSTRAINT fk_schedules_account 
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
+ALTER TABLE public.schedules ADD CONSTRAINT fk_schedules_action 
+  FOREIGN KEY (action_id) REFERENCES public.actions(id) ON DELETE CASCADE;
+ALTER TABLE public.schedules ADD CONSTRAINT fk_schedules_machine 
+  FOREIGN KEY (machine_principal_id) REFERENCES public.api_keys(id) ON DELETE SET NULL;
+ALTER TABLE public.schedules ADD CONSTRAINT fk_schedules_created_by 
+  FOREIGN KEY (created_by) REFERENCES public.people(id) ON DELETE SET NULL;
+
+-- schedule_executions FKs
+ALTER TABLE public.schedule_executions ADD CONSTRAINT fk_se_schedule 
+  FOREIGN KEY (schedule_id) REFERENCES public.schedules(id) ON DELETE CASCADE;
+ALTER TABLE public.schedule_executions ADD CONSTRAINT fk_se_account 
+  FOREIGN KEY (account_id) REFERENCES public.accounts(id) ON DELETE CASCADE;
+ALTER TABLE public.schedule_executions ADD CONSTRAINT fk_se_machine 
+  FOREIGN KEY (machine_principal_id) REFERENCES public.api_keys(id) ON DELETE SET NULL;
+
+-- ============================================
+-- INDEXES
+-- ============================================
+
+-- account_paths indexes
+CREATE INDEX idx_account_paths_ancestor ON public.account_paths(ancestor_id);
+CREATE INDEX idx_account_paths_descendant ON public.account_paths(descendant_id);
+
+-- accounts
+CREATE INDEX idx_accounts_parent_id ON public.accounts(parent_id);
+CREATE INDEX idx_accounts_type_id ON public.accounts(type_id);
+CREATE INDEX idx_accounts_active ON public.accounts(is_active);
+
+-- people
+CREATE INDEX idx_people_account ON public.people(account_id);
+CREATE INDEX idx_people_auth_uid ON public.people(auth_uid);
+CREATE INDEX idx_people_email ON public.people(email);
+CREATE INDEX idx_people_role ON public.people(role_id);
+CREATE INDEX idx_people_active ON public.people(is_active);
+
+-- types
+CREATE INDEX idx_types_slug ON public.types(slug);
+CREATE INDEX idx_types_kind ON public.types(kind);
+
+-- apps
+CREATE INDEX idx_apps_slug ON public.apps(slug);
+CREATE INDEX idx_apps_owner ON public.apps(owner_account_id);
+CREATE UNIQUE INDEX idx_apps_route_prefix ON public.apps(route_prefix) 
+  WHERE is_active = true AND route_prefix IS NOT NULL;
+
+-- roles
+CREATE INDEX idx_roles_slug ON public.roles(slug);
+
+-- items
+CREATE INDEX idx_items_type ON public.items(type_id);
+CREATE INDEX idx_items_account ON public.items(account_id);
+CREATE INDEX idx_items_active ON public.items(is_active);
+CREATE INDEX idx_items_created_at ON public.items(created_at);
+
+-- threads
+CREATE INDEX idx_threads_type ON public.threads(type_id);
+CREATE INDEX idx_threads_account ON public.threads(account_id);
+CREATE INDEX idx_threads_target ON public.threads(target_type, target_id);
+CREATE INDEX idx_threads_active ON public.threads(is_active);
+
+-- messages
+CREATE INDEX idx_messages_thread ON public.messages(thread_id);
+CREATE INDEX idx_messages_type ON public.messages(type_id);
+CREATE INDEX idx_messages_person ON public.messages(person_id);
+
+-- links
+CREATE INDEX idx_links_type ON public.links(type_id);
+CREATE INDEX idx_links_account ON public.links(account_id);
+CREATE INDEX idx_links_source ON public.links(source_type, source_id);
+CREATE INDEX idx_links_target ON public.links(target_type, target_id);
+
+-- attachments
+CREATE INDEX idx_attachments_type ON public.attachments(type_id);
+CREATE INDEX idx_attachments_account ON public.attachments(account_id);
+
+-- watchers
+CREATE INDEX idx_watchers_type ON public.watchers(type_id);
+CREATE INDEX idx_watchers_target ON public.watchers(target_type, target_id);
+CREATE INDEX idx_watchers_person ON public.watchers(person_id);
+
+-- link_types
+CREATE INDEX idx_link_types_slug ON public.link_types(slug);
+
+-- pipelines
+CREATE INDEX idx_pipelines_app ON public.pipelines(app_id);
+CREATE INDEX idx_pipelines_account ON public.pipelines(account_id);
+
+-- pipeline_executions
+CREATE INDEX idx_pe_pipeline ON public.pipeline_executions(pipeline_id);
+CREATE INDEX idx_pe_account ON public.pipeline_executions(account_id);
+CREATE INDEX idx_pe_status ON public.pipeline_executions(status);
+
+-- triggers
+CREATE INDEX idx_triggers_app ON public.triggers(app_id);
+CREATE INDEX idx_triggers_account ON public.triggers(account_id);
+CREATE INDEX idx_triggers_pipeline ON public.triggers(pipeline_id);
+
+-- trigger_executions
+CREATE INDEX idx_te_trigger ON public.trigger_executions(trigger_id);
+
+-- timers
+CREATE INDEX idx_timers_app ON public.timers(app_id);
+CREATE INDEX idx_timers_account ON public.timers(account_id);
+CREATE INDEX idx_timers_pipeline ON public.timers(pipeline_id);
+
+-- ai_agents
+CREATE INDEX idx_ai_agents_app ON public.ai_agents(app_id);
+CREATE INDEX idx_ai_agents_account ON public.ai_agents(account_id);
+
+-- embeddings
+CREATE INDEX idx_embeddings_account ON public.embeddings(account_id);
+CREATE INDEX idx_embeddings_model_doc ON public.embeddings(model_id, document_id);
+
+-- integrations
+CREATE INDEX idx_integrations_app ON public.integrations(app_id);
+CREATE INDEX idx_integrations_account ON public.integrations(account_id);
+
+-- prompt_configs
+CREATE INDEX idx_prompt_configs_slug ON public.prompt_configs(slug);
+CREATE INDEX idx_prompt_configs_app ON public.prompt_configs(app_id);
+CREATE INDEX idx_prompt_configs_account ON public.prompt_configs(account_id);
+
+-- api_keys
+CREATE INDEX idx_api_keys_integration ON public.api_keys(integration_id);
+CREATE INDEX idx_api_keys_account ON public.api_keys(account_id);
+CREATE INDEX idx_api_keys_key_value ON public.api_keys(key_value);
+
+-- api_key_usage_logs
+CREATE INDEX idx_akul_api_key ON public.api_key_usage_logs(api_key_id);
+CREATE INDEX idx_akul_account ON public.api_key_usage_logs(account_id);
+CREATE INDEX idx_akul_created ON public.api_key_usage_logs(created_at);
+
+-- logs
+CREATE INDEX idx_logs_account ON public.logs(account_id);
+CREATE INDEX idx_logs_level ON public.logs(level);
+CREATE INDEX idx_logs_created ON public.logs(created_at);
+CREATE INDEX idx_logs_source ON public.logs(source_type, source_id);
+
+-- actions
+CREATE INDEX idx_actions_account ON public.actions(account_id);
+CREATE INDEX idx_actions_slug ON public.actions(slug);
+
+-- schedules
+CREATE INDEX idx_schedules_account ON public.schedules(account_id);
+CREATE INDEX idx_schedules_action ON public.schedules(action_id);
+CREATE INDEX idx_schedules_next_run ON public.schedules(next_run_at);
+
+-- schedule_executions
+CREATE INDEX idx_se_schedule ON public.schedule_executions(schedule_id);
+CREATE INDEX idx_se_account ON public.schedule_executions(account_id);
+
+-- test tables
+CREATE INDEX idx_test_results_run_id ON public.test_results(run_id);
+CREATE INDEX idx_test_runs_suite ON public.test_runs(suite);
+CREATE INDEX idx_test_runs_started_at ON public.test_runs(started_at DESC);
+
+-- item_progress
+CREATE INDEX idx_item_progress_person ON public.item_progress(person_id);
+CREATE INDEX idx_item_progress_item ON public.item_progress(item_id);
+CREATE INDEX idx_item_progress_account ON public.item_progress(account_id);
+CREATE INDEX idx_item_progress_type ON public.item_progress(type_id);
+CREATE INDEX idx_item_progress_status ON public.item_progress(status);
+CREATE INDEX idx_item_progress_data_gin ON public.item_progress USING gin(data);
+CREATE INDEX idx_item_progress_active ON public.item_progress(account_id, is_active) WHERE is_active = true;
+
+-- webhook_handlers
+CREATE INDEX idx_webhook_handlers_name ON public.webhook_handlers(name) WHERE is_active = true AND is_deleted = false;
+CREATE INDEX idx_webhook_handlers_account ON public.webhook_handlers(account_id) WHERE is_deleted = false;
+CREATE INDEX idx_webhook_handlers_events ON public.webhook_handlers USING GIN(events) WHERE is_active = true;
+
+-- ============================================
+-- ENABLE RLS ON ALL TABLES
+-- ============================================
+
+ALTER TABLE public.accounts ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.people ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.types ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.apps ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.roles ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.items ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.threads ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.messages ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.links ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.attachments ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.watchers ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.link_types ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.pipelines ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.pipeline_executions ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.triggers ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.trigger_executions ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.timers ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.ai_agents ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.embeddings ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.integrations ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.prompt_configs ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.api_keys ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.api_key_usage_logs ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.logs ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.actions ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.schedules ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.schedule_executions ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.item_progress ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.webhook_handlers ENABLE ROW LEVEL SECURITY;
+
+-- ============================================
+-- RLS POLICIES
+-- ============================================
+
+-- accounts
+CREATE POLICY accounts_access ON public.accounts FOR ALL
+  USING (id IN (SELECT public.get_accessible_accounts(public.current_actor_id()))
+         OR public.current_actor_id() IS NULL);
+
+-- people
+CREATE POLICY people_access ON public.people FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id()))
+         OR public.current_actor_id() IS NULL);
+
+-- types
+CREATE POLICY types_access ON public.types FOR ALL
+  USING (public.current_actor_id() IS NOT NULL OR true);
+
+-- apps
+CREATE POLICY apps_access ON public.apps FOR ALL
+  USING (is_system = true OR owner_account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
+         OR auth.uid() IS NULL);
+
+-- roles
+CREATE POLICY roles_read ON public.roles FOR SELECT USING (true);
+CREATE POLICY roles_modify ON public.roles FOR ALL
+  USING ((is_system = true AND public.person_is_system_admin(public.current_actor_id()))
+         OR is_system = false OR public.current_actor_id() IS NULL);
+
+-- items (with platform scope visibility from 012_rls_scope.sql)
+CREATE POLICY items_access ON public.items FOR ALL
+  USING (
+    account_id IN (SELECT public.get_accessible_accounts(public.current_actor_id()))
+    OR (design_schema->>'scope' = 'platform' AND public.current_actor_id() IS NOT NULL)
+    OR public.current_actor_id() IS NULL
+  );
+
+-- threads (with platform scope visibility from 012_rls_scope.sql)
+CREATE POLICY threads_access ON public.threads FOR ALL
+  USING (
+    account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
+    OR (design_schema->>'scope' = 'platform' AND auth.uid() IS NOT NULL)
+    OR auth.uid() IS NULL
+  );
+
+-- messages
+CREATE POLICY messages_access ON public.messages FOR ALL
+  USING (EXISTS (SELECT 1 FROM public.threads t
+                 WHERE t.id = messages.thread_id
+                 AND t.account_id IN (SELECT public.get_accessible_accounts(auth.uid())))
+         OR auth.uid() IS NULL);
+
+-- links (with platform scope visibility from 012_rls_scope.sql)
+CREATE POLICY links_access ON public.links FOR ALL
+  USING (
+    account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
+    OR (design_schema->>'scope' = 'platform' AND auth.uid() IS NOT NULL)
+    OR auth.uid() IS NULL
+  );
+
+-- attachments (with platform scope visibility from 012_rls_scope.sql)
+CREATE POLICY attachments_access ON public.attachments FOR ALL
+  USING (
+    account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
+    OR (design_schema->>'scope' = 'platform' AND auth.uid() IS NOT NULL)
+    OR auth.uid() IS NULL
+  );
+
+-- watchers
+CREATE POLICY watchers_access ON public.watchers FOR ALL
+  USING (auth.uid() IS NOT NULL OR true);
+
+-- link_types
+CREATE POLICY link_types_access ON public.link_types FOR ALL
+  USING (app_id IS NULL
+         OR EXISTS (SELECT 1 FROM public.apps a WHERE a.id = link_types.app_id
+                    AND a.owner_account_id IN (SELECT public.get_accessible_accounts(auth.uid())))
+         OR auth.uid() IS NULL);
+
+-- pipelines
+CREATE POLICY pipelines_access ON public.pipelines FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
+         OR auth.uid() IS NULL);
+
+-- pipeline_executions
+CREATE POLICY pe_access ON public.pipeline_executions FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
+         OR auth.uid() IS NULL);
+
+-- triggers
+CREATE POLICY triggers_access ON public.triggers FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
+         OR auth.uid() IS NULL);
+
+-- trigger_executions
+CREATE POLICY te_access ON public.trigger_executions FOR ALL
+  USING (EXISTS (SELECT 1 FROM public.triggers t
+                 WHERE t.id = trigger_executions.trigger_id
+                 AND t.account_id IN (SELECT public.get_accessible_accounts(auth.uid())))
+         OR auth.uid() IS NULL);
+
+-- timers
+CREATE POLICY timers_access ON public.timers FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
+         OR auth.uid() IS NULL);
+
+-- ai_agents
+CREATE POLICY ai_agents_access ON public.ai_agents FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
+         OR auth.uid() IS NULL);
+
+-- embeddings
+CREATE POLICY embeddings_access ON public.embeddings FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
+         OR auth.uid() IS NULL);
+
+-- integrations
+CREATE POLICY integrations_access ON public.integrations FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
+         OR auth.uid() IS NULL);
+
+-- prompt_configs
+CREATE POLICY prompt_configs_access ON public.prompt_configs FOR ALL
+  USING ((app_id IS NULL OR EXISTS (SELECT 1 FROM public.apps a
+          WHERE a.id = prompt_configs.app_id
+          AND a.owner_account_id IN (SELECT public.get_accessible_accounts(auth.uid()))))
+         OR auth.uid() IS NULL);
+
+-- api_keys
+CREATE POLICY api_keys_access ON public.api_keys FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
+         OR id = auth.uid() OR auth.uid() IS NULL);
+
+-- api_key_usage_logs
+CREATE POLICY akul_access ON public.api_key_usage_logs FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
+         OR auth.uid() IS NULL);
+
+-- logs
+CREATE POLICY logs_access ON public.logs FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
+         OR auth.uid() IS NULL);
+
+-- actions
+CREATE POLICY actions_access ON public.actions FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
+         OR auth.uid() IS NULL);
+
+-- schedules
+CREATE POLICY schedules_access ON public.schedules FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
+         OR auth.uid() IS NULL);
+
+-- schedule_executions
+CREATE POLICY se_access ON public.schedule_executions FOR ALL
+  USING (account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
+         OR auth.uid() IS NULL);
+
+-- item_progress
+CREATE POLICY item_progress_access ON public.item_progress FOR ALL
+  USING (
+    account_id IN (SELECT public.get_accessible_accounts(auth.uid()))
+    OR auth.uid() IS NULL
+  );
+
+-- webhook_handlers
+CREATE POLICY webhook_handlers_system_admin ON public.webhook_handlers
+  FOR ALL
+  TO authenticated
+  USING (
+    (SELECT raw_user_meta_data->>'role' FROM auth.users WHERE id = auth.uid()) = 'system_admin'
+  )
+  WITH CHECK (
+    (SELECT raw_user_meta_data->>'role' FROM auth.users WHERE id = auth.uid()) = 'system_admin'
+  );
+
+CREATE POLICY webhook_handlers_service_role ON public.webhook_handlers
+  FOR ALL
+  TO service_role
+  USING (true)
+  WITH CHECK (true);
+
+-- ============================================
+-- TRIGGERS FOR UPDATED_AT
+-- ============================================
+
+CREATE TRIGGER webhook_handlers_updated_at
+  BEFORE UPDATE ON public.webhook_handlers
+  FOR EACH ROW
+  EXECUTE FUNCTION public.set_updated_at();