fix(capa): field-level auth split, status gate, RLS tightening, audit old_value, hide form on pending_verification

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-07-23 12:10:53 +08:00
parent 938eb7e08d
commit 509ed90fe7
3 changed files with 25 additions and 3 deletions
@@ -0,0 +1,6 @@
+-- Tighten capa_update_owner RLS policy: remove department clause so only the
+-- assigned owner can UPDATE their own CAPA row directly. Route-level auth
+-- enforces field-level restrictions; this ensures DB-level enforcement matches.
+DROP POLICY IF EXISTS "capa_update_owner" ON capa_actions;
+CREATE POLICY "capa_update_owner" ON capa_actions FOR UPDATE
+  USING (owner_user_id = auth.uid());