Weei HanandClaude Sonnet 5
f539d43136
Adds db/schema.sql (12 tables), db/policies.sql (RLS on all 12,
audit_log append-only), db/auth-hook.sql (role/org_id into JWT per
AD-2), db/seed.sql (org + 3 departments, part 2 deferred to M1 auth).
Wires lib/supabase/{client,server,service}.ts per AD-3 and adds
/db-check page confirming DB connectivity and RLS deny-by-default.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FcktbLXSSXzx23GCue813e
276 lines
10 KiB
SQL
276 lines
10 KiB
SQL
-- RLS Policies — all 12 tables
|
|
-- Source: docs/04-database-schema.md section 3 (role matrix below), extended
|
|
-- consistently to 4 tables the matrix doesn't cover (orgs, departments,
|
|
-- sop_assignments, ai_log) — marked "(not in matrix)" at each one.
|
|
--
|
|
-- Coverage table (docs/04-database-schema.md section 3):
|
|
--
|
|
-- | Table | staff | editor | approver | admin |
|
|
-- |--------------------|--------------------------------|--------------------|---------------------|-------|
|
|
-- | sops (read) | published + assigned dept only | all in org | all in org | all |
|
|
-- | sops (write) | - | insert/update drafts | - | all |
|
|
-- | sop_versions | read if assigned | read | read | all |
|
|
-- | acknowledgements | insert own; read own | read | read | read |
|
|
-- | profiles | read own + names in org | read org | read org | all |
|
|
-- | audit_log | - | - | read | read |
|
|
-- | approvals | - | read | insert/read | all |
|
|
-- | translations | read | read/write | read | all |
|
|
-- | incidents | insert own; read own | read org | read/update org | all |
|
|
--
|
|
-- Workflow mutations (publish, approve, assign) run via the service-role
|
|
-- client inside /api routes so drafts can be snapshotted and audit rows
|
|
-- written in one transaction; RLS remains the safety net for direct reads.
|
|
-- Default pattern in this file: RLS grants READ access per role; WRITE
|
|
-- access via RLS is only granted where the matrix explicitly says so
|
|
-- (insert own, read/write, etc). Everything else is mutated exclusively
|
|
-- by service-role /api routes, which bypass RLS entirely.
|
|
|
|
-- ============================================================
|
|
-- orgs (not in matrix — read own org only, no client write)
|
|
-- ============================================================
|
|
alter table orgs enable row level security;
|
|
|
|
create policy orgs_read on orgs
|
|
for select using (
|
|
id = (auth.jwt() ->> 'org_id')::uuid
|
|
);
|
|
-- no insert/update/delete policy: single org, managed manually in Stage 1.
|
|
|
|
-- ============================================================
|
|
-- departments (not in matrix — read all in org, admin writes, FR-1.3)
|
|
-- ============================================================
|
|
alter table departments enable row level security;
|
|
|
|
create policy departments_read on departments
|
|
for select using (
|
|
org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
);
|
|
|
|
create policy departments_insert_admin on departments
|
|
for insert with check (
|
|
org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
and (auth.jwt() ->> 'role') = 'admin'
|
|
);
|
|
|
|
create policy departments_update_admin on departments
|
|
for update using (
|
|
org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
and (auth.jwt() ->> 'role') = 'admin'
|
|
);
|
|
|
|
create policy departments_delete_admin on departments
|
|
for delete using (
|
|
org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
and (auth.jwt() ->> 'role') = 'admin'
|
|
);
|
|
-- "delete blocked if department has users" (FR-1.3) is enforced by the
|
|
-- profiles.department_id foreign key, not by RLS.
|
|
|
|
-- ============================================================
|
|
-- profiles — own row always; org-wide read (table has no sensitive
|
|
-- fields beyond role/department, so org-wide read is a low-risk
|
|
-- simplification); admin writes via RLS as a safety net (actual
|
|
-- invites/role-changes go through the service-role /api/users route).
|
|
-- ============================================================
|
|
alter table profiles enable row level security;
|
|
|
|
create policy profiles_read on profiles
|
|
for select using (
|
|
org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
);
|
|
|
|
create policy profiles_update_admin on profiles
|
|
for update using (
|
|
org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
and (auth.jwt() ->> 'role') = 'admin'
|
|
);
|
|
-- no insert policy: profile rows are created by the signup flow
|
|
-- (service-role), not inserted directly by a client.
|
|
|
|
-- ============================================================
|
|
-- sops
|
|
-- ============================================================
|
|
alter table sops enable row level security;
|
|
|
|
create policy sops_read on sops
|
|
for select using (
|
|
org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
and (
|
|
(auth.jwt() ->> 'role') in ('admin','approver','editor')
|
|
or (
|
|
(auth.jwt() ->> 'role') = 'staff'
|
|
and status = 'published'
|
|
and exists (
|
|
select 1
|
|
from sop_assignments sa
|
|
join profiles p on p.department_id = sa.department_id
|
|
where sa.sop_id = sops.id
|
|
and p.id = auth.uid()
|
|
)
|
|
)
|
|
)
|
|
);
|
|
|
|
create policy sops_insert_editor on sops
|
|
for insert with check (
|
|
org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
and (auth.jwt() ->> 'role') in ('editor','admin')
|
|
);
|
|
|
|
create policy sops_update_editor on sops
|
|
for update using (
|
|
org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
and (
|
|
(auth.jwt() ->> 'role') = 'admin'
|
|
or ( (auth.jwt() ->> 'role') = 'editor' and status = 'draft' )
|
|
)
|
|
);
|
|
|
|
-- ============================================================
|
|
-- sop_versions — read only via RLS; every version is written by the
|
|
-- service-role publish route (AD-4), never directly, not even by admin.
|
|
-- ============================================================
|
|
alter table sop_versions enable row level security;
|
|
|
|
create policy sop_versions_read on sop_versions
|
|
for select using (
|
|
org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
and (
|
|
(auth.jwt() ->> 'role') in ('admin','approver','editor')
|
|
or (
|
|
(auth.jwt() ->> 'role') = 'staff'
|
|
and exists (
|
|
select 1
|
|
from sop_assignments sa
|
|
join profiles p on p.department_id = sa.department_id
|
|
where sa.sop_id = sop_versions.sop_id
|
|
and p.id = auth.uid()
|
|
)
|
|
)
|
|
)
|
|
);
|
|
|
|
-- ============================================================
|
|
-- approvals — a decision, once made, is never editable or deletable.
|
|
-- ============================================================
|
|
alter table approvals enable row level security;
|
|
|
|
create policy approvals_read on approvals
|
|
for select using (
|
|
org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
and (auth.jwt() ->> 'role') in ('editor','approver','admin')
|
|
);
|
|
|
|
create policy approvals_insert on approvals
|
|
for insert with check (
|
|
org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
and (auth.jwt() ->> 'role') in ('approver','admin')
|
|
and decided_by = auth.uid()
|
|
);
|
|
|
|
-- ============================================================
|
|
-- sop_assignments (not in matrix — read all in org, no client write;
|
|
-- set only via the service-role /api/sops/:id/assign route)
|
|
-- ============================================================
|
|
alter table sop_assignments enable row level security;
|
|
|
|
create policy sop_assignments_read on sop_assignments
|
|
for select using (
|
|
org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
);
|
|
|
|
-- ============================================================
|
|
-- acknowledgements — immutable once written (FR-4.3): insert only,
|
|
-- never update or delete.
|
|
-- ============================================================
|
|
alter table acknowledgements enable row level security;
|
|
|
|
create policy ack_insert_own on acknowledgements
|
|
for insert with check (
|
|
user_id = auth.uid()
|
|
and org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
);
|
|
|
|
create policy ack_read on acknowledgements
|
|
for select using (
|
|
org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
and ( user_id = auth.uid()
|
|
or (auth.jwt() ->> 'role') in ('admin','approver','editor') )
|
|
);
|
|
|
|
-- ============================================================
|
|
-- sop_translations
|
|
-- ============================================================
|
|
alter table sop_translations enable row level security;
|
|
|
|
create policy translations_read on sop_translations
|
|
for select using (
|
|
org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
);
|
|
|
|
create policy translations_insert_editor on sop_translations
|
|
for insert with check (
|
|
org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
and (auth.jwt() ->> 'role') in ('editor','admin')
|
|
);
|
|
|
|
create policy translations_update_editor on sop_translations
|
|
for update using (
|
|
org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
and (auth.jwt() ->> 'role') in ('editor','admin')
|
|
);
|
|
|
|
-- ============================================================
|
|
-- audit_log — append-only. INSERT + SELECT policies only.
|
|
-- No UPDATE policy. No DELETE policy. Ever. (FR-3.4)
|
|
-- ============================================================
|
|
alter table audit_log enable row level security;
|
|
|
|
create policy audit_read on audit_log
|
|
for select using (
|
|
org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
and (auth.jwt() ->> 'role') in ('approver','admin')
|
|
);
|
|
|
|
create policy audit_insert on audit_log
|
|
for insert with check (
|
|
org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
);
|
|
|
|
-- ============================================================
|
|
-- ai_log (not in matrix — admin-only read for cost tracking, no FRD
|
|
-- screen for it; no client write, only the service-role AI routes write)
|
|
-- ============================================================
|
|
alter table ai_log enable row level security;
|
|
|
|
create policy ai_log_read_admin on ai_log
|
|
for select using (
|
|
org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
and (auth.jwt() ->> 'role') = 'admin'
|
|
);
|
|
|
|
-- ============================================================
|
|
-- incidents — FR-7.1 says "staff+" (any role) can report, so insert-own
|
|
-- is granted to every role, not just staff.
|
|
-- ============================================================
|
|
alter table incidents enable row level security;
|
|
|
|
create policy incidents_insert_own on incidents
|
|
for insert with check (
|
|
reporter_id = auth.uid()
|
|
and org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
);
|
|
|
|
create policy incidents_read on incidents
|
|
for select using (
|
|
org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
and ( reporter_id = auth.uid()
|
|
or (auth.jwt() ->> 'role') in ('editor','approver','admin') )
|
|
);
|
|
|
|
create policy incidents_update on incidents
|
|
for update using (
|
|
org_id = (auth.jwt() ->> 'org_id')::uuid
|
|
and (auth.jwt() ->> 'role') in ('approver','admin')
|
|
);
|