728 lines
38 KiB
PL/PgSQL
728 lines
38 KiB
PL/PgSQL
-- =============================================================================
|
||
-- HACKERSPACE.SH — CANONICAL FRESH DEPLOYMENT SCHEMA
|
||
-- =============================================================================
|
||
-- This is the single source of truth for a fresh database setup.
|
||
-- Run this ONCE on a brand new Supabase project. It is fully idempotent.
|
||
--
|
||
-- Replaces all previous scripts (000–011). Those are kept as history only.
|
||
--
|
||
-- Execution order:
|
||
-- 1. Extensions
|
||
-- 2. Enums
|
||
-- 3. Helper functions (used in RLS policies)
|
||
-- 4. Tables (dependency order: spaces → space_members → everything else)
|
||
-- 5. Indexes
|
||
-- 6. Row Level Security (RLS) policies
|
||
-- 7. Triggers
|
||
-- 8. Auth hook (Supabase auth.users trigger)
|
||
-- =============================================================================
|
||
|
||
-- ─────────────────────────────────────────────────────────────────────────────
|
||
-- 1. EXTENSIONS
|
||
-- ─────────────────────────────────────────────────────────────────────────────
|
||
CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
|
||
|
||
|
||
-- ─────────────────────────────────────────────────────────────────────────────
|
||
-- 2. ENUMS
|
||
-- ─────────────────────────────────────────────────────────────────────────────
|
||
|
||
-- Member role within a space
|
||
DO $$ BEGIN
|
||
CREATE TYPE public.member_role AS ENUM ('admin', 'board', 'treasurer', 'member', 'associate');
|
||
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
|
||
|
||
-- Membership tier
|
||
DO $$ BEGIN
|
||
CREATE TYPE public.member_tier AS ENUM ('plus', 'basic', 'associate');
|
||
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
|
||
|
||
-- Membership lifecycle status
|
||
DO $$ BEGIN
|
||
CREATE TYPE public.member_status AS ENUM ('current', 'late', 'inactive', 'unverified');
|
||
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
|
||
|
||
-- Task completion status
|
||
-- NOTE: Both 'completed' AND 'done' are valid — 'done' is legacy, 'completed'
|
||
-- is canonical. Application code must treat both as finished.
|
||
DO $$ BEGIN
|
||
CREATE TYPE public.task_status AS ENUM (
|
||
'open', 'claimed', 'in_progress', 'overdue', 'due_today',
|
||
'completed', 'done', 'blocked'
|
||
);
|
||
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
|
||
|
||
-- Task category
|
||
DO $$ BEGIN
|
||
CREATE TYPE public.task_type AS ENUM ('chore', 'task');
|
||
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
|
||
|
||
-- Task / chore recurrence
|
||
DO $$ BEGIN
|
||
CREATE TYPE public.recurrence_type AS ENUM ('daily', 'weekly', 'biweekly', 'monthly', 'none');
|
||
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
|
||
|
||
-- Project lifecycle status
|
||
DO $$ BEGIN
|
||
CREATE TYPE public.project_status AS ENUM ('backlog', 'in_progress', 'review', 'done', 'blocked');
|
||
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
|
||
|
||
-- Payment platform source
|
||
DO $$ BEGIN
|
||
CREATE TYPE public.payment_platform AS ENUM ('paypal', 'zeffy', 'venmo', 'cash');
|
||
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
|
||
|
||
-- Whether a payment row has been matched to a member
|
||
DO $$ BEGIN
|
||
CREATE TYPE public.payment_link_status AS ENUM ('linked', 'unlinked');
|
||
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
|
||
|
||
-- Knowledge base article visibility
|
||
DO $$ BEGIN
|
||
CREATE TYPE public.kb_visibility AS ENUM ('all_members', 'board', 'admin_only');
|
||
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
|
||
|
||
-- Area lead assignment status
|
||
DO $$ BEGIN
|
||
CREATE TYPE public.area_lead_status AS ENUM ('active', 'vacant', 'handoff');
|
||
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
|
||
|
||
-- Contact / vendor type
|
||
DO $$ BEGIN
|
||
CREATE TYPE public.contact_type AS ENUM ('vendor', 'supplier', 'partner', 'landlord', 'city');
|
||
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
|
||
|
||
-- Chat channel category
|
||
DO $$ BEGIN
|
||
CREATE TYPE public.channel_type AS ENUM ('general', 'area', 'ops', 'project');
|
||
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
|
||
|
||
|
||
-- ─────────────────────────────────────────────────────────────────────────────
|
||
-- 3. HELPER FUNCTIONS
|
||
-- Must be created before tables so they can be referenced in RLS policies.
|
||
-- Both are SECURITY DEFINER + fixed search_path to prevent privilege escalation.
|
||
-- ─────────────────────────────────────────────────────────────────────────────
|
||
|
||
-- Returns all space_ids a given user belongs to.
|
||
-- Used in RLS policies to avoid recursive policy checks on space_members.
|
||
CREATE OR REPLACE FUNCTION public.get_user_space_ids(uid uuid)
|
||
RETURNS SETOF uuid
|
||
LANGUAGE sql
|
||
STABLE
|
||
SECURITY DEFINER
|
||
SET search_path = public
|
||
AS $$
|
||
SELECT space_id FROM public.space_members WHERE user_id = uid;
|
||
$$;
|
||
|
||
-- Returns true if a user has one of the allowed roles in a specific space.
|
||
-- Used in RLS policies that require elevated permissions (admin, board, etc.).
|
||
CREATE OR REPLACE FUNCTION public.user_has_role_in_space(
|
||
uid uuid,
|
||
sid uuid,
|
||
allowed_roles text[]
|
||
)
|
||
RETURNS boolean
|
||
LANGUAGE sql
|
||
STABLE
|
||
SECURITY DEFINER
|
||
SET search_path = public
|
||
AS $$
|
||
SELECT EXISTS (
|
||
SELECT 1 FROM public.space_members
|
||
WHERE user_id = uid
|
||
AND space_id = sid
|
||
AND role::text = ANY(allowed_roles)
|
||
);
|
||
$$;
|
||
|
||
|
||
-- ─────────────────────────────────────────────────────────────────────────────
|
||
-- 4. TABLES
|
||
-- ─────────────────────────────────────────────────────────────────────────────
|
||
|
||
-- ── spaces ───────────────────────────────────────────────────────────────────
|
||
-- Top-level tenant. Each hackerspace is one row.
|
||
CREATE TABLE IF NOT EXISTS public.spaces (
|
||
id uuid PRIMARY KEY DEFAULT uuid_generate_v4(),
|
||
name text NOT NULL,
|
||
slug text NOT NULL UNIQUE,
|
||
city text,
|
||
require_approval boolean NOT NULL DEFAULT true,
|
||
public_member_directory boolean NOT NULL DEFAULT false,
|
||
invite_code text NOT NULL UNIQUE,
|
||
webhook_secret text,
|
||
created_at timestamptz NOT NULL DEFAULT now(),
|
||
updated_at timestamptz NOT NULL DEFAULT now()
|
||
);
|
||
|
||
-- ── space_members ─────────────────────────────────────────────────────────────
|
||
-- One row per (user × space). A user may belong to multiple spaces.
|
||
CREATE TABLE IF NOT EXISTS public.space_members (
|
||
id uuid PRIMARY KEY DEFAULT uuid_generate_v4(),
|
||
space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE,
|
||
user_id uuid REFERENCES auth.users(id) ON DELETE SET NULL,
|
||
display_name text NOT NULL,
|
||
handle text,
|
||
email text,
|
||
phone text,
|
||
role member_role NOT NULL DEFAULT 'member',
|
||
tier member_tier NOT NULL DEFAULT 'basic',
|
||
status member_status NOT NULL DEFAULT 'current',
|
||
approved boolean NOT NULL DEFAULT true,
|
||
has_card_access boolean NOT NULL DEFAULT false,
|
||
payment_status text,
|
||
payment_note text,
|
||
last_payment_at timestamptz,
|
||
last_paid_at timestamptz,
|
||
joined_at timestamptz NOT NULL DEFAULT now()
|
||
);
|
||
|
||
-- ── tasks ────────────────────────────────────────────────────────────────────
|
||
CREATE TABLE IF NOT EXISTS public.tasks (
|
||
id uuid PRIMARY KEY DEFAULT uuid_generate_v4(),
|
||
space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE,
|
||
title text NOT NULL,
|
||
description text,
|
||
type task_type NOT NULL DEFAULT 'task',
|
||
task_type text NOT NULL DEFAULT 'chore', -- legacy text col, kept for compat
|
||
status task_status NOT NULL DEFAULT 'open',
|
||
area text,
|
||
recurrence recurrence_type NOT NULL DEFAULT 'none',
|
||
due_date timestamptz,
|
||
assigned_to uuid REFERENCES public.space_members(id) ON DELETE SET NULL,
|
||
assigned_to_name text,
|
||
claimed_by uuid REFERENCES public.space_members(id) ON DELETE SET NULL,
|
||
claimed_by_name text,
|
||
requested_by uuid REFERENCES public.space_members(id) ON DELETE SET NULL,
|
||
requested_by_name text,
|
||
subtask_total integer NOT NULL DEFAULT 0,
|
||
subtask_completed integer NOT NULL DEFAULT 0,
|
||
progress integer NOT NULL DEFAULT 0,
|
||
last_done_at timestamptz,
|
||
completed_at timestamptz,
|
||
created_at timestamptz NOT NULL DEFAULT now(),
|
||
updated_at timestamptz NOT NULL DEFAULT now()
|
||
);
|
||
|
||
-- ── projects ─────────────────────────────────────────────────────────────────
|
||
CREATE TABLE IF NOT EXISTS public.projects (
|
||
id uuid PRIMARY KEY DEFAULT uuid_generate_v4(),
|
||
space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE,
|
||
title text NOT NULL,
|
||
name text, -- legacy alias for title, kept for compat
|
||
description text,
|
||
status project_status NOT NULL DEFAULT 'backlog',
|
||
area text,
|
||
category text,
|
||
tags text[],
|
||
assignees text, -- free-form text list
|
||
assignee_names text[], -- structured array
|
||
task_count integer NOT NULL DEFAULT 0,
|
||
tasks_completed integer NOT NULL DEFAULT 0,
|
||
progress integer NOT NULL DEFAULT 0,
|
||
due_date timestamptz,
|
||
created_at timestamptz NOT NULL DEFAULT now(),
|
||
updated_at timestamptz NOT NULL DEFAULT now()
|
||
);
|
||
|
||
-- ── payments ─────────────────────────────────────────────────────────────────
|
||
-- One row per transaction. Imported from PayPal/Zeffy/Venmo or logged as cash.
|
||
CREATE TABLE IF NOT EXISTS public.payments (
|
||
id uuid PRIMARY KEY DEFAULT uuid_generate_v4(),
|
||
space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE,
|
||
platform payment_platform NOT NULL,
|
||
amount numeric(10, 2) NOT NULL,
|
||
from_identifier text, -- email, @handle, or name from source platform
|
||
from_note text, -- memo / note from sender
|
||
member_id uuid REFERENCES public.space_members(id) ON DELETE SET NULL,
|
||
member_name text,
|
||
link_status payment_link_status NOT NULL DEFAULT 'unlinked',
|
||
transaction_date timestamptz NOT NULL,
|
||
created_at timestamptz NOT NULL DEFAULT now()
|
||
);
|
||
|
||
-- ── contacts ─────────────────────────────────────────────────────────────────
|
||
CREATE TABLE IF NOT EXISTS public.contacts (
|
||
id uuid PRIMARY KEY DEFAULT uuid_generate_v4(),
|
||
space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE,
|
||
name text NOT NULL,
|
||
code text NOT NULL, -- short identifier
|
||
contact_type contact_type NOT NULL,
|
||
email text,
|
||
phone text,
|
||
details text,
|
||
note text,
|
||
group_label text,
|
||
tags text[],
|
||
created_at timestamptz NOT NULL DEFAULT now(),
|
||
updated_at timestamptz NOT NULL DEFAULT now()
|
||
);
|
||
|
||
-- ── knowledge_base ────────────────────────────────────────────────────────────
|
||
CREATE TABLE IF NOT EXISTS public.knowledge_base (
|
||
id uuid PRIMARY KEY DEFAULT uuid_generate_v4(),
|
||
space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE,
|
||
title text NOT NULL,
|
||
description text,
|
||
content text,
|
||
icon text,
|
||
visibility kb_visibility NOT NULL DEFAULT 'all_members',
|
||
access_level text NOT NULL DEFAULT 'all_members', -- legacy text col
|
||
area text,
|
||
tags text[],
|
||
is_pinned boolean NOT NULL DEFAULT false,
|
||
pinned boolean NOT NULL DEFAULT false, -- legacy alias
|
||
updated_by_id uuid REFERENCES public.space_members(id) ON DELETE SET NULL,
|
||
updated_by_name text,
|
||
updated_by text, -- legacy text col
|
||
created_at timestamptz NOT NULL DEFAULT now(),
|
||
updated_at timestamptz NOT NULL DEFAULT now()
|
||
);
|
||
|
||
-- ── secrets ──────────────────────────────────────────────────────────────────
|
||
-- Shared credentials vault. Only admins can write; board+ can read.
|
||
CREATE TABLE IF NOT EXISTS public.secrets (
|
||
id uuid PRIMARY KEY DEFAULT uuid_generate_v4(),
|
||
space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE,
|
||
title text NOT NULL,
|
||
icon text,
|
||
description text,
|
||
value text NOT NULL, -- stored as plain text; encryption is a future enhancement
|
||
area text,
|
||
created_at timestamptz NOT NULL DEFAULT now(),
|
||
updated_at timestamptz NOT NULL DEFAULT now()
|
||
);
|
||
|
||
-- ── area_leads ───────────────────────────────────────────────────────────────
|
||
CREATE TABLE IF NOT EXISTS public.area_leads (
|
||
id uuid PRIMARY KEY DEFAULT uuid_generate_v4(),
|
||
space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE,
|
||
area_name text NOT NULL,
|
||
area_code text NOT NULL,
|
||
lead_id uuid REFERENCES public.space_members(id) ON DELETE SET NULL,
|
||
lead_handle text,
|
||
status area_lead_status NOT NULL DEFAULT 'active',
|
||
created_at timestamptz NOT NULL DEFAULT now(),
|
||
updated_at timestamptz NOT NULL DEFAULT now()
|
||
);
|
||
|
||
-- ── integrations ─────────────────────────────────────────────────────────────
|
||
-- Payment platform credentials and other third-party configs.
|
||
-- config JSONB stores platform-specific keys (e.g. { client_id, client_secret }).
|
||
CREATE TABLE IF NOT EXISTS public.integrations (
|
||
id uuid PRIMARY KEY DEFAULT uuid_generate_v4(),
|
||
space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE,
|
||
name text NOT NULL,
|
||
platform text NOT NULL,
|
||
description text,
|
||
is_connected boolean NOT NULL DEFAULT false,
|
||
config jsonb,
|
||
created_at timestamptz NOT NULL DEFAULT now(),
|
||
updated_at timestamptz NOT NULL DEFAULT now(),
|
||
UNIQUE (space_id, platform)
|
||
);
|
||
|
||
-- ── comms_channels ───────────────────────────────────────────────────────────
|
||
CREATE TABLE IF NOT EXISTS public.comms_channels (
|
||
id uuid PRIMARY KEY DEFAULT uuid_generate_v4(),
|
||
space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE,
|
||
name text NOT NULL,
|
||
icon text,
|
||
channel_type channel_type NOT NULL DEFAULT 'general',
|
||
area_reference text, -- links an 'area' channel to an area code
|
||
project_id uuid REFERENCES public.projects(id) ON DELETE SET NULL,
|
||
member_count integer NOT NULL DEFAULT 0,
|
||
unread_count integer NOT NULL DEFAULT 0,
|
||
created_at timestamptz NOT NULL DEFAULT now(),
|
||
UNIQUE (space_id, name)
|
||
);
|
||
|
||
-- ── comms_messages ───────────────────────────────────────────────────────────
|
||
CREATE TABLE IF NOT EXISTS public.comms_messages (
|
||
id uuid PRIMARY KEY DEFAULT uuid_generate_v4(),
|
||
channel_id uuid NOT NULL REFERENCES public.comms_channels(id) ON DELETE CASCADE,
|
||
space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE,
|
||
user_id uuid REFERENCES auth.users(id) ON DELETE SET NULL,
|
||
display_name text NOT NULL,
|
||
handle text,
|
||
content text NOT NULL,
|
||
created_at timestamptz NOT NULL DEFAULT now()
|
||
);
|
||
|
||
-- ── activity_log ─────────────────────────────────────────────────────────────
|
||
CREATE TABLE IF NOT EXISTS public.activity_log (
|
||
id uuid PRIMARY KEY DEFAULT uuid_generate_v4(),
|
||
space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE,
|
||
user_id uuid REFERENCES auth.users(id) ON DELETE SET NULL,
|
||
display_name text,
|
||
action text NOT NULL,
|
||
entity_type text,
|
||
entity_id uuid,
|
||
details text,
|
||
created_at timestamptz NOT NULL DEFAULT now()
|
||
);
|
||
|
||
|
||
-- ─────────────────────────────────────────────────────────────────────────────
|
||
-- 5. INDEXES
|
||
-- ─────────────────────────────────────────────────────────────────────────────
|
||
CREATE INDEX IF NOT EXISTS idx_space_members_user_id ON public.space_members (user_id);
|
||
CREATE INDEX IF NOT EXISTS idx_space_members_space_id ON public.space_members (space_id);
|
||
CREATE INDEX IF NOT EXISTS idx_tasks_space_id ON public.tasks (space_id);
|
||
CREATE INDEX IF NOT EXISTS idx_tasks_status ON public.tasks (status);
|
||
CREATE INDEX IF NOT EXISTS idx_tasks_assigned_to ON public.tasks (assigned_to);
|
||
CREATE INDEX IF NOT EXISTS idx_tasks_claimed_by ON public.tasks (claimed_by);
|
||
CREATE INDEX IF NOT EXISTS idx_projects_space_id ON public.projects (space_id);
|
||
CREATE INDEX IF NOT EXISTS idx_payments_space_id ON public.payments (space_id);
|
||
CREATE INDEX IF NOT EXISTS idx_payments_platform ON public.payments (platform);
|
||
CREATE INDEX IF NOT EXISTS idx_payments_link_status ON public.payments (link_status);
|
||
CREATE INDEX IF NOT EXISTS idx_payments_transaction_date ON public.payments (transaction_date DESC);
|
||
CREATE INDEX IF NOT EXISTS idx_comms_messages_channel ON public.comms_messages (channel_id, created_at DESC);
|
||
CREATE INDEX IF NOT EXISTS idx_comms_messages_space ON public.comms_messages (space_id);
|
||
CREATE INDEX IF NOT EXISTS idx_kb_space_id ON public.knowledge_base (space_id);
|
||
CREATE INDEX IF NOT EXISTS idx_secrets_space_id ON public.secrets (space_id);
|
||
CREATE INDEX IF NOT EXISTS idx_contacts_space_id ON public.contacts (space_id);
|
||
CREATE INDEX IF NOT EXISTS idx_area_leads_space_id ON public.area_leads (space_id);
|
||
CREATE INDEX IF NOT EXISTS idx_integrations_space_id ON public.integrations (space_id);
|
||
CREATE INDEX IF NOT EXISTS idx_activity_log_space_id ON public.activity_log (space_id);
|
||
CREATE INDEX IF NOT EXISTS idx_activity_log_created_at ON public.activity_log (created_at DESC);
|
||
|
||
|
||
-- ─────────────────────────────────────────────────────────────────────────────
|
||
-- 6. ROW LEVEL SECURITY
|
||
-- ─────────────────────────────────────────────────────────────────────────────
|
||
-- Pattern: Every table has RLS enabled.
|
||
-- SELECT policies: any space member can read their own space's data.
|
||
-- WRITE policies: elevated roles required (admin/board/treasurer as appropriate).
|
||
-- The helper functions above prevent recursive policy evaluation.
|
||
-- ─────────────────────────────────────────────────────────────────────────────
|
||
|
||
ALTER TABLE public.spaces ENABLE ROW LEVEL SECURITY;
|
||
ALTER TABLE public.space_members ENABLE ROW LEVEL SECURITY;
|
||
ALTER TABLE public.tasks ENABLE ROW LEVEL SECURITY;
|
||
ALTER TABLE public.projects ENABLE ROW LEVEL SECURITY;
|
||
ALTER TABLE public.payments ENABLE ROW LEVEL SECURITY;
|
||
ALTER TABLE public.contacts ENABLE ROW LEVEL SECURITY;
|
||
ALTER TABLE public.knowledge_base ENABLE ROW LEVEL SECURITY;
|
||
ALTER TABLE public.secrets ENABLE ROW LEVEL SECURITY;
|
||
ALTER TABLE public.area_leads ENABLE ROW LEVEL SECURITY;
|
||
ALTER TABLE public.integrations ENABLE ROW LEVEL SECURITY;
|
||
ALTER TABLE public.comms_channels ENABLE ROW LEVEL SECURITY;
|
||
ALTER TABLE public.comms_messages ENABLE ROW LEVEL SECURITY;
|
||
ALTER TABLE public.activity_log ENABLE ROW LEVEL SECURITY;
|
||
|
||
-- ── spaces ───────────────────────────────────────────────────────────────────
|
||
DROP POLICY IF EXISTS spaces_select_members ON public.spaces;
|
||
DROP POLICY IF EXISTS spaces_insert_authenticated ON public.spaces;
|
||
DROP POLICY IF EXISTS spaces_update_admins ON public.spaces;
|
||
DROP POLICY IF EXISTS spaces_delete_admins ON public.spaces;
|
||
|
||
CREATE POLICY spaces_select_members ON public.spaces
|
||
FOR SELECT USING (id IN (SELECT get_user_space_ids(auth.uid())));
|
||
|
||
CREATE POLICY spaces_insert_authenticated ON public.spaces
|
||
FOR INSERT WITH CHECK (auth.uid() IS NOT NULL);
|
||
|
||
CREATE POLICY spaces_update_admins ON public.spaces
|
||
FOR UPDATE USING (user_has_role_in_space(auth.uid(), id, ARRAY['admin']));
|
||
|
||
CREATE POLICY spaces_delete_admins ON public.spaces
|
||
FOR DELETE USING (user_has_role_in_space(auth.uid(), id, ARRAY['admin']));
|
||
|
||
-- ── space_members ─────────────────────────────────────────────────────────────
|
||
DROP POLICY IF EXISTS space_members_select_own ON public.space_members;
|
||
DROP POLICY IF EXISTS space_members_select_same_space ON public.space_members;
|
||
DROP POLICY IF EXISTS space_members_insert_authenticated ON public.space_members;
|
||
DROP POLICY IF EXISTS space_members_update_admins ON public.space_members;
|
||
DROP POLICY IF EXISTS space_members_delete_admins ON public.space_members;
|
||
|
||
-- Own row always visible (needed for get_user_space_ids bootstrapping)
|
||
CREATE POLICY space_members_select_own ON public.space_members
|
||
FOR SELECT USING (user_id = auth.uid());
|
||
|
||
-- All members of the same space can see each other
|
||
CREATE POLICY space_members_select_same_space ON public.space_members
|
||
FOR SELECT USING (space_id IN (SELECT get_user_space_ids(auth.uid())));
|
||
|
||
-- A user may insert their own row, or admins/board may insert on behalf of others
|
||
CREATE POLICY space_members_insert_authenticated ON public.space_members
|
||
FOR INSERT WITH CHECK (
|
||
user_id = auth.uid()
|
||
OR user_has_role_in_space(auth.uid(), space_id, ARRAY['admin', 'board'])
|
||
);
|
||
|
||
-- Members may update their own profile; admins may update anyone
|
||
CREATE POLICY space_members_update_admins ON public.space_members
|
||
FOR UPDATE USING (
|
||
user_id = auth.uid()
|
||
OR user_has_role_in_space(auth.uid(), space_id, ARRAY['admin'])
|
||
);
|
||
|
||
CREATE POLICY space_members_delete_admins ON public.space_members
|
||
FOR DELETE USING (user_has_role_in_space(auth.uid(), space_id, ARRAY['admin']));
|
||
|
||
-- ── tasks ────────────────────────────────────────────────────────────────────
|
||
DROP POLICY IF EXISTS tasks_select_members ON public.tasks;
|
||
DROP POLICY IF EXISTS tasks_insert_members ON public.tasks;
|
||
DROP POLICY IF EXISTS tasks_update_members ON public.tasks;
|
||
DROP POLICY IF EXISTS tasks_delete_members ON public.tasks;
|
||
|
||
CREATE POLICY tasks_select_members ON public.tasks
|
||
FOR SELECT USING (space_id IN (SELECT get_user_space_ids(auth.uid())));
|
||
|
||
CREATE POLICY tasks_insert_members ON public.tasks
|
||
FOR INSERT WITH CHECK (space_id IN (SELECT get_user_space_ids(auth.uid())));
|
||
|
||
CREATE POLICY tasks_update_members ON public.tasks
|
||
FOR UPDATE USING (space_id IN (SELECT get_user_space_ids(auth.uid())));
|
||
|
||
CREATE POLICY tasks_delete_members ON public.tasks
|
||
FOR DELETE USING (space_id IN (SELECT get_user_space_ids(auth.uid())));
|
||
|
||
-- ── projects ─────────────────────────────────────────────────────────────────
|
||
DROP POLICY IF EXISTS projects_select_members ON public.projects;
|
||
DROP POLICY IF EXISTS projects_insert_members ON public.projects;
|
||
DROP POLICY IF EXISTS projects_update_members ON public.projects;
|
||
DROP POLICY IF EXISTS projects_delete_members ON public.projects;
|
||
|
||
CREATE POLICY projects_select_members ON public.projects
|
||
FOR SELECT USING (space_id IN (SELECT get_user_space_ids(auth.uid())));
|
||
|
||
CREATE POLICY projects_insert_members ON public.projects
|
||
FOR INSERT WITH CHECK (space_id IN (SELECT get_user_space_ids(auth.uid())));
|
||
|
||
CREATE POLICY projects_update_members ON public.projects
|
||
FOR UPDATE USING (space_id IN (SELECT get_user_space_ids(auth.uid())));
|
||
|
||
CREATE POLICY projects_delete_members ON public.projects
|
||
FOR DELETE USING (space_id IN (SELECT get_user_space_ids(auth.uid())));
|
||
|
||
-- ── payments ─────────────────────────────────────────────────────────────────
|
||
DROP POLICY IF EXISTS payments_select_treasurer ON public.payments;
|
||
DROP POLICY IF EXISTS payments_modify_treasurer ON public.payments;
|
||
|
||
CREATE POLICY payments_select_treasurer ON public.payments
|
||
FOR SELECT USING (
|
||
user_has_role_in_space(auth.uid(), space_id, ARRAY['admin', 'board', 'treasurer'])
|
||
);
|
||
|
||
CREATE POLICY payments_modify_treasurer ON public.payments
|
||
FOR ALL USING (
|
||
user_has_role_in_space(auth.uid(), space_id, ARRAY['admin', 'treasurer'])
|
||
);
|
||
|
||
-- ── contacts ─────────────────────────────────────────────────────────────────
|
||
DROP POLICY IF EXISTS contacts_select_members ON public.contacts;
|
||
DROP POLICY IF EXISTS contacts_modify_members ON public.contacts;
|
||
|
||
CREATE POLICY contacts_select_members ON public.contacts
|
||
FOR SELECT USING (space_id IN (SELECT get_user_space_ids(auth.uid())));
|
||
|
||
CREATE POLICY contacts_modify_members ON public.contacts
|
||
FOR ALL USING (space_id IN (SELECT get_user_space_ids(auth.uid())));
|
||
|
||
-- ── knowledge_base ────────────────────────────────────────────────────────────
|
||
DROP POLICY IF EXISTS kb_select_members ON public.knowledge_base;
|
||
DROP POLICY IF EXISTS kb_insert_members ON public.knowledge_base;
|
||
DROP POLICY IF EXISTS kb_update_members ON public.knowledge_base;
|
||
DROP POLICY IF EXISTS kb_delete_board ON public.knowledge_base;
|
||
|
||
CREATE POLICY kb_select_members ON public.knowledge_base
|
||
FOR SELECT USING (space_id IN (SELECT get_user_space_ids(auth.uid())));
|
||
|
||
CREATE POLICY kb_insert_members ON public.knowledge_base
|
||
FOR INSERT WITH CHECK (space_id IN (SELECT get_user_space_ids(auth.uid())));
|
||
|
||
CREATE POLICY kb_update_members ON public.knowledge_base
|
||
FOR UPDATE USING (space_id IN (SELECT get_user_space_ids(auth.uid())));
|
||
|
||
CREATE POLICY kb_delete_board ON public.knowledge_base
|
||
FOR DELETE USING (user_has_role_in_space(auth.uid(), space_id, ARRAY['admin', 'board']));
|
||
|
||
-- ── secrets ──────────────────────────────────────────────────────────────────
|
||
DROP POLICY IF EXISTS secrets_select_admins ON public.secrets;
|
||
DROP POLICY IF EXISTS secrets_modify_admins ON public.secrets;
|
||
|
||
-- Board/treasurer can read; only admins can write
|
||
CREATE POLICY secrets_select_admins ON public.secrets
|
||
FOR SELECT USING (
|
||
user_has_role_in_space(auth.uid(), space_id, ARRAY['admin', 'board', 'treasurer'])
|
||
);
|
||
|
||
CREATE POLICY secrets_modify_admins ON public.secrets
|
||
FOR ALL USING (user_has_role_in_space(auth.uid(), space_id, ARRAY['admin']));
|
||
|
||
-- ── area_leads ───────────────────────────────────────────────────────────────
|
||
DROP POLICY IF EXISTS area_leads_select_members ON public.area_leads;
|
||
DROP POLICY IF EXISTS area_leads_modify_board ON public.area_leads;
|
||
|
||
CREATE POLICY area_leads_select_members ON public.area_leads
|
||
FOR SELECT USING (space_id IN (SELECT get_user_space_ids(auth.uid())));
|
||
|
||
CREATE POLICY area_leads_modify_board ON public.area_leads
|
||
FOR ALL USING (user_has_role_in_space(auth.uid(), space_id, ARRAY['admin', 'board']));
|
||
|
||
-- ── integrations ─────────────────────────────────────────────────────────────
|
||
DROP POLICY IF EXISTS integrations_select_admins ON public.integrations;
|
||
DROP POLICY IF EXISTS integrations_modify_admins ON public.integrations;
|
||
|
||
CREATE POLICY integrations_select_admins ON public.integrations
|
||
FOR SELECT USING (user_has_role_in_space(auth.uid(), space_id, ARRAY['admin']));
|
||
|
||
CREATE POLICY integrations_modify_admins ON public.integrations
|
||
FOR ALL USING (user_has_role_in_space(auth.uid(), space_id, ARRAY['admin']));
|
||
|
||
-- ── comms_channels ───────────────────────────────────────────────────────────
|
||
DROP POLICY IF EXISTS channels_select_members ON public.comms_channels;
|
||
DROP POLICY IF EXISTS channels_insert_board ON public.comms_channels;
|
||
DROP POLICY IF EXISTS channels_update_board ON public.comms_channels;
|
||
DROP POLICY IF EXISTS channels_delete_board ON public.comms_channels;
|
||
|
||
CREATE POLICY channels_select_members ON public.comms_channels
|
||
FOR SELECT USING (space_id IN (SELECT get_user_space_ids(auth.uid())));
|
||
|
||
CREATE POLICY channels_insert_board ON public.comms_channels
|
||
FOR INSERT WITH CHECK (user_has_role_in_space(auth.uid(), space_id, ARRAY['admin', 'board']));
|
||
|
||
CREATE POLICY channels_update_board ON public.comms_channels
|
||
FOR UPDATE USING (user_has_role_in_space(auth.uid(), space_id, ARRAY['admin', 'board']));
|
||
|
||
CREATE POLICY channels_delete_board ON public.comms_channels
|
||
FOR DELETE USING (user_has_role_in_space(auth.uid(), space_id, ARRAY['admin', 'board']));
|
||
|
||
-- ── comms_messages ───────────────────────────────────────────────────────────
|
||
DROP POLICY IF EXISTS messages_select_members ON public.comms_messages;
|
||
DROP POLICY IF EXISTS messages_insert_members ON public.comms_messages;
|
||
|
||
CREATE POLICY messages_select_members ON public.comms_messages
|
||
FOR SELECT USING (space_id IN (SELECT get_user_space_ids(auth.uid())));
|
||
|
||
-- Users may only insert messages attributed to themselves
|
||
CREATE POLICY messages_insert_members ON public.comms_messages
|
||
FOR INSERT WITH CHECK (
|
||
space_id IN (SELECT get_user_space_ids(auth.uid()))
|
||
AND user_id = auth.uid()
|
||
);
|
||
|
||
-- ── activity_log ─────────────────────────────────────────────────────────────
|
||
DROP POLICY IF EXISTS activity_select_members ON public.activity_log;
|
||
DROP POLICY IF EXISTS activity_insert_members ON public.activity_log;
|
||
|
||
CREATE POLICY activity_select_members ON public.activity_log
|
||
FOR SELECT USING (space_id IN (SELECT get_user_space_ids(auth.uid())));
|
||
|
||
CREATE POLICY activity_insert_members ON public.activity_log
|
||
FOR INSERT WITH CHECK (space_id IN (SELECT get_user_space_ids(auth.uid())));
|
||
|
||
|
||
-- ─────────────────────────────────────────────────────────────────────────────
|
||
-- 7. TRIGGERS
|
||
-- ─────────────────────────────────────────────────────────────────────────────
|
||
|
||
-- Auto-creates default channels when a new space is created
|
||
CREATE OR REPLACE FUNCTION public.create_default_channels()
|
||
RETURNS trigger
|
||
LANGUAGE plpgsql
|
||
SECURITY DEFINER
|
||
SET search_path = public
|
||
AS $$
|
||
BEGIN
|
||
INSERT INTO public.comms_channels (space_id, name, channel_type) VALUES
|
||
(NEW.id, 'general', 'general'),
|
||
(NEW.id, 'announcements', 'general'),
|
||
(NEW.id, 'random', 'general'),
|
||
(NEW.id, 'facilities', 'ops')
|
||
ON CONFLICT (space_id, name) DO NOTHING;
|
||
RETURN NEW;
|
||
END;
|
||
$$;
|
||
|
||
DROP TRIGGER IF EXISTS on_space_created ON public.spaces;
|
||
CREATE TRIGGER on_space_created
|
||
AFTER INSERT ON public.spaces
|
||
FOR EACH ROW EXECUTE FUNCTION public.create_default_channels();
|
||
|
||
|
||
-- ─────────────────────────────────────────────────────────────────────────────
|
||
-- 8. AUTH HOOK — fires on every new auth.users signup
|
||
-- ─────────────────────────────────────────────────────────────────────────────
|
||
-- Reads metadata passed at signup time to either:
|
||
-- • Create a new space and add the user as admin (space_action = 'create')
|
||
-- • Join an existing space via invite code (space_action = 'join')
|
||
--
|
||
-- Required signup metadata:
|
||
-- create: { space_action, space_name, space_slug, space_city, invite_code, full_name }
|
||
-- join: { space_action:'join', join_invite_code, full_name }
|
||
-- ─────────────────────────────────────────────────────────────────────────────
|
||
|
||
CREATE OR REPLACE FUNCTION public.handle_space_signup()
|
||
RETURNS trigger
|
||
LANGUAGE plpgsql
|
||
SECURITY DEFINER
|
||
SET search_path = public
|
||
AS $$
|
||
DECLARE
|
||
v_space_id uuid;
|
||
v_action text;
|
||
v_name text;
|
||
v_slug text;
|
||
v_city text;
|
||
v_invite_code text;
|
||
BEGIN
|
||
v_action := COALESCE(NEW.raw_user_meta_data ->> 'space_action', '');
|
||
|
||
IF v_action = 'create' THEN
|
||
v_name := NEW.raw_user_meta_data ->> 'space_name';
|
||
v_slug := NEW.raw_user_meta_data ->> 'space_slug';
|
||
v_city := NEW.raw_user_meta_data ->> 'space_city';
|
||
v_invite_code := NEW.raw_user_meta_data ->> 'invite_code';
|
||
|
||
INSERT INTO public.spaces (name, slug, city, invite_code)
|
||
VALUES (v_name, v_slug, v_city, v_invite_code)
|
||
RETURNING id INTO v_space_id;
|
||
|
||
INSERT INTO public.space_members
|
||
(space_id, user_id, display_name, email, role, tier, status, approved)
|
||
VALUES (
|
||
v_space_id, NEW.id,
|
||
COALESCE(NEW.raw_user_meta_data ->> 'full_name', 'Admin'),
|
||
NEW.email,
|
||
'admin', 'plus', 'current', true
|
||
);
|
||
|
||
ELSIF v_action = 'join' THEN
|
||
v_invite_code := NEW.raw_user_meta_data ->> 'join_invite_code';
|
||
SELECT id INTO v_space_id FROM public.spaces WHERE invite_code = v_invite_code;
|
||
|
||
IF v_space_id IS NOT NULL THEN
|
||
INSERT INTO public.space_members
|
||
(space_id, user_id, display_name, email, role, tier, status, approved)
|
||
SELECT
|
||
v_space_id, NEW.id,
|
||
COALESCE(NEW.raw_user_meta_data ->> 'full_name', 'Member'),
|
||
NEW.email,
|
||
'member', 'basic',
|
||
CASE WHEN s.require_approval THEN 'unverified' ELSE 'current' END,
|
||
CASE WHEN s.require_approval THEN false ELSE true END
|
||
FROM public.spaces s WHERE s.id = v_space_id;
|
||
END IF;
|
||
END IF;
|
||
|
||
RETURN NEW;
|
||
END;
|
||
$$;
|
||
|
||
-- Wire the auth hook (must exist in auth schema, not public)
|
||
DROP TRIGGER IF EXISTS on_auth_user_created ON auth.users;
|
||
CREATE TRIGGER on_auth_user_created
|
||
AFTER INSERT ON auth.users
|
||
FOR EACH ROW EXECUTE FUNCTION public.handle_space_signup();
|
||
|
||
|
||
-- ─────────────────────────────────────────────────────────────────────────────
|
||
-- DONE.
|
||
-- For a fresh deployment, this is the only script you need to run.
|
||
-- ─────────────────────────────────────────────────────────────────────────────
|