diff --git a/DB_SCHEMA_MAP.md b/DB_SCHEMA_MAP.md index 3ec2db3..c5d0eea 100644 --- a/DB_SCHEMA_MAP.md +++ b/DB_SCHEMA_MAP.md @@ -398,10 +398,11 @@ Default channels created by trigger on space INSERT: `general`, `announcements`, | 030 | `certifications`, `member_certifications` + `certifications.manage` / `certifications.grant` permissions (the latter = Instructor). Additive default-deny RLS; grants soft-revoked + immutable (no DELETE policy); expiry snapshotted at grant; no anonymous path | | 031 | `secrets_select` additively also honors `ops.secrets.read` (previously admin/board OR per-secret `ops_acl` only). Reveal/list gates let RLS decide; writes unchanged. Access-neutral unless the permission is granted | | 032 | `classes`, `class_sessions`, `class_signups` + `classes.manage` / `classes.instruct` permissions. Additive default-deny RLS; signup/cancel via validated service-client action (no INSERT/DELETE policy); one non-cancelled signup per member+session; optional cert-on-completion via the normal certifications path | +| 033 | `equipment`, `equipment_reservations` + `equipment.manage` permission. Additive default-deny RLS; reserve/cancel via validated service-client action (no INSERT/DELETE policy) enforcing status + no-overlap + required-cert with manager override | --- -## Tables added by migrations 016-032 (quick map) +## Tables added by migrations 016-033 (quick map) | Table | Key columns | Purpose | |-------|-------------|---------| @@ -425,6 +426,8 @@ Default channels created by trigger on space INSERT: `general`, `announcements`, | `classes` | space_id, title, description, payment_link (http(s) only), capacity, is_active, grants_certification_id -> certifications | Class offering. SELECT = `classes.manage` (all) or member (`is_active`); writes = `classes.manage` | | `class_sessions` | class_id, space_id, starts_at, ends_at, location, capacity, status (scheduled/cancelled/completed), notes | Scheduled occurrence. SELECT = any space member; writes = `classes.manage` | | `class_signups` | session_id, space_id, member_id, status (registered/waitlisted/cancelled), attended, signed_up_at | Member signup. Partial UNIQUE = one non-cancelled signup per member+session. SELECT = manage/instruct (all) or member (own); UPDATE = `classes.instruct`; NO INSERT/DELETE policy (signup/cancel via validated service-client action) | +| `equipment` | space_id, name, description, location, status (available/maintenance/retired), required_certification_id -> certifications, asset_tag, is_active | Tool/equipment registry. SELECT = `equipment.manage` (all) or member (`is_active`); writes = `equipment.manage` | +| `equipment_reservations` | equipment_id, space_id, member_id, starts_at, ends_at, status (reserved/cancelled/completed), notes | Time-window reservation. SELECT = `equipment.manage` (all) or member (own); UPDATE = `equipment.manage`; NO INSERT/DELETE policy (reserve/cancel via validated service-client action; no-overlap + required-cert enforced there) | Column additions: `space_members.tier_id`, `onboarding_completed_at`, `onboarding_progress`; `secrets.encrypted_value`, `encryption_version`; `knowledge_base.render_markdown`, `is_meeting_minutes`, `meeting_date`. New enum `comment_entity_type`. diff --git a/docs/DATABASE_SCHEMA.md b/docs/DATABASE_SCHEMA.md index abd784c..9946866 100644 --- a/docs/DATABASE_SCHEMA.md +++ b/docs/DATABASE_SCHEMA.md @@ -686,7 +686,7 @@ CREATE INDEX idx_activity_space ON activity_log(space_id, created_at); --- -## Migrations 014-032 (additions since the 13-table baseline) +## Migrations 014-033 (additions since the 13-table baseline) `scripts/schema.sql` is the canonical idempotent schema; each numbered migration is mirrored as a section in it. Tables/columns added: @@ -712,6 +712,7 @@ migration is mirrored as a section in it. Tables/columns added: | 030 | `certifications` (per-space cert types; optional `validity_months`; `is_active` archive) + `member_certifications` (per-member grants; `expires_at` snapshotted at grant time; soft `revoked_at`/`revoked_by`; partial unique on one active grant per member+cert). RLS additive + default-deny: certifications SELECT = any space member, write = `certifications.manage`; member_certifications SELECT = `certifications.manage`/`certifications.grant` (all) or member (own), INSERT/UPDATE = `certifications.grant`, NO DELETE policy (history immutable). New `certifications.manage` + `certifications.grant` permissions (the latter = the Instructor capability) seeded to board + backfilled. No anonymous path | | 031 | `secrets_select` additively also honors the `ops.secrets.read` role permission (was admin/board OR per-secret `ops_acl` only; the permission was never consulted). Access-neutral unless an admin has granted the permission. Reveal/list server-side gates updated to let RLS be the boundary; write paths unchanged | | 032 | `classes`, `class_sessions`, `class_signups` (class offerings, scheduled sessions, member signups; optional `payment_link` and `grants_certification_id`; partial unique = one non-cancelled signup per member+session). RLS additive + default-deny: classes SELECT = `classes.manage` (all) or member (`is_active`), class_sessions SELECT = any space member, class_signups SELECT = manage/instruct (all) or member (own), UPDATE = `classes.instruct`, NO INSERT/DELETE policy (signup/cancel via a validated service-client action enforcing capacity/waitlist/dedupe). New `classes.manage` + `classes.instruct` permissions seeded to board + backfilled. Cert-on-completion uses the normal certifications path (still needs `certifications.grant`). No anonymous path | +| 033 | `equipment` (registry; status available/maintenance/retired; optional `required_certification_id`; `is_active` archive) + `equipment_reservations` (member time-window reservation; denormalized space_id; no DB overlap constraint). RLS additive + default-deny: equipment SELECT = `equipment.manage` (all) or member (`is_active`), reservations SELECT = `equipment.manage` (all) or member (own), UPDATE = `equipment.manage`, NO INSERT/DELETE policy (reserve/cancel via validated service-client action enforcing status + no-overlap + required-cert, manager override). New `equipment.manage` permission seeded to board + backfilled. No anonymous path | New enum: `comment_entity_type` = `forum_thread | proposal | incident | policy`. diff --git a/lib/permissions-catalog.ts b/lib/permissions-catalog.ts index 24a2a66..0327ca4 100644 --- a/lib/permissions-catalog.ts +++ b/lib/permissions-catalog.ts @@ -26,6 +26,7 @@ export const PERMISSIONS = [ { code: 'certifications.grant', group: 'Certifications', label: 'Award and revoke certifications (Instructor)' }, { code: 'classes.manage', group: 'Classes', label: 'Manage classes and schedule sessions' }, { code: 'classes.instruct', group: 'Classes', label: 'Run classes: attendance, completion, attendees' }, + { code: 'equipment.manage', group: 'Equipment', label: 'Manage equipment and reservations' }, { code: 'customize.manage', group: 'Admin', label: 'Customize roles, tiers, areas, invites, onboarding' }, { code: 'settings.manage', group: 'Admin', label: 'Space settings, integrations, webhooks' }, ] as const @@ -47,6 +48,7 @@ export const DEFAULT_ROLE_PERMISSIONS: Record = { 'forum.moderate', 'forms.manage', 'certifications.manage', 'certifications.grant', 'classes.manage', 'classes.instruct', + 'equipment.manage', 'customize.manage', 'settings.manage', ], treasurer: ['payments.manage', 'ops.kb.read', 'ops.process.read'], diff --git a/scripts/033_equipment.sql b/scripts/033_equipment.sql new file mode 100644 index 0000000..7bbb763 --- /dev/null +++ b/scripts/033_equipment.sql @@ -0,0 +1,146 @@ +-- ============================================================================= +-- 033: Equipment registry + reservations +-- ============================================================================= +-- Two tables: +-- +-- equipment a per-space tool/equipment record: name, +-- description, location, operational status +-- (available/maintenance/retired), optional +-- required_certification_id (reserving a cert-gated +-- tool requires the member hold that certification), +-- asset_tag, is_active archive flag. +-- equipment_reservations a member's time-window reservation of one piece of +-- equipment (reserved/cancelled/completed). +-- space_id is denormalized for RLS without a join. +-- Active reservations for the same equipment may not +-- overlap (enforced in the validated action). +-- +-- One new permission code (lib/permissions-catalog.ts, group "Equipment"): +-- +-- equipment.manage registry CRUD, status/maintenance, and adjusting or +-- cancelling any reservation (the override). +-- +-- Reserving needs no permission, only space membership: it is gated by the +-- equipment being available and, when set, by the member holding the +-- required certification (manager override allowed). The cert check uses the +-- normal certifications data; no service-role bypass of that surface. +-- +-- RLS posture (additive, default-deny; the guarded surface): +-- +-- * equipment SELECT: equipment.manage holders see all; ordinary members +-- see only is_active (mirrors classes_select). Writes: equipment.manage. +-- * equipment_reservations SELECT: equipment.manage (all in space) or the +-- member (own). UPDATE: equipment.manage. NO INSERT/DELETE policy: +-- reserve/cancel funnels through one validated service-client action +-- that enforces status, the no-overlap rule and the required-cert gate +-- (same pattern as class_signups / form_submissions). No anonymous path. +-- +-- Extends seed_default_role_permissions() so new spaces seed the code to +-- board, and backfills board -> equipment.manage for existing spaces. +-- +-- Idempotent: CREATE TABLE/INDEX IF NOT EXISTS, DROP POLICY IF EXISTS then +-- CREATE, CREATE OR REPLACE FUNCTION, ON CONFLICT DO NOTHING backfill. +-- ============================================================================= + +CREATE TABLE IF NOT EXISTS public.equipment ( + id uuid PRIMARY KEY DEFAULT uuid_generate_v4(), + space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE, + name text NOT NULL CHECK (char_length(name) BETWEEN 1 AND 200), + description text, + location text, + status text NOT NULL DEFAULT 'available' + CHECK (status IN ('available','maintenance','retired')), + required_certification_id uuid REFERENCES public.certifications(id) ON DELETE SET NULL, + asset_tag text, + is_active boolean NOT NULL DEFAULT true, + created_by uuid REFERENCES public.space_members(id) ON DELETE SET NULL, + created_at timestamptz NOT NULL DEFAULT now(), + updated_at timestamptz NOT NULL DEFAULT now() +); +CREATE INDEX IF NOT EXISTS idx_equipment_space ON public.equipment (space_id, is_active); + +CREATE TABLE IF NOT EXISTS public.equipment_reservations ( + id uuid PRIMARY KEY DEFAULT uuid_generate_v4(), + equipment_id uuid NOT NULL REFERENCES public.equipment(id) ON DELETE CASCADE, + space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE, + member_id uuid NOT NULL REFERENCES public.space_members(id) ON DELETE CASCADE, + starts_at timestamptz NOT NULL, + ends_at timestamptz NOT NULL CHECK (ends_at > starts_at), + status text NOT NULL DEFAULT 'reserved' + CHECK (status IN ('reserved','cancelled','completed')), + notes text, + created_by uuid REFERENCES public.space_members(id) ON DELETE SET NULL, + created_at timestamptz NOT NULL DEFAULT now() +); +CREATE INDEX IF NOT EXISTS idx_equipment_res_space ON public.equipment_reservations (space_id); +CREATE INDEX IF NOT EXISTS idx_equipment_res_equipment ON public.equipment_reservations (equipment_id, starts_at); +CREATE INDEX IF NOT EXISTS idx_equipment_res_member ON public.equipment_reservations (member_id); + +ALTER TABLE public.equipment ENABLE ROW LEVEL SECURITY; +ALTER TABLE public.equipment_reservations ENABLE ROW LEVEL SECURITY; + +DROP POLICY IF EXISTS equipment_select ON public.equipment; +DROP POLICY IF EXISTS equipment_insert ON public.equipment; +DROP POLICY IF EXISTS equipment_update ON public.equipment; +DROP POLICY IF EXISTS equipment_delete ON public.equipment; +CREATE POLICY equipment_select ON public.equipment FOR SELECT + USING ( + public.user_has_permission(auth.uid(), space_id, 'equipment.manage') + OR ( + space_id IN (SELECT public.get_user_space_ids(auth.uid())) + AND is_active + ) + ); +CREATE POLICY equipment_insert ON public.equipment FOR INSERT + WITH CHECK (public.user_has_permission(auth.uid(), space_id, 'equipment.manage')); +CREATE POLICY equipment_update ON public.equipment FOR UPDATE + USING (public.user_has_permission(auth.uid(), space_id, 'equipment.manage')); +CREATE POLICY equipment_delete ON public.equipment FOR DELETE + USING (public.user_has_permission(auth.uid(), space_id, 'equipment.manage')); + +DROP POLICY IF EXISTS equipment_reservations_select ON public.equipment_reservations; +DROP POLICY IF EXISTS equipment_reservations_update ON public.equipment_reservations; +CREATE POLICY equipment_reservations_select ON public.equipment_reservations FOR SELECT + USING ( + public.user_has_permission(auth.uid(), space_id, 'equipment.manage') + OR member_id IN ( + SELECT id FROM public.space_members + WHERE user_id = auth.uid() AND space_id = equipment_reservations.space_id + ) + ); +CREATE POLICY equipment_reservations_update ON public.equipment_reservations FOR UPDATE + USING (public.user_has_permission(auth.uid(), space_id, 'equipment.manage')); +-- No INSERT/DELETE policy: reserve/cancel via a validated service-client action. + +DROP TRIGGER IF EXISTS trg_equipment_touch ON public.equipment; +CREATE TRIGGER trg_equipment_touch + BEFORE UPDATE ON public.equipment + FOR EACH ROW EXECUTE FUNCTION public.touch_updated_at(); + +CREATE OR REPLACE FUNCTION public.seed_default_role_permissions() + RETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path = public +AS $$ +BEGIN + INSERT INTO public.space_role_permissions (space_id, subject, permission) + SELECT NEW.id, d.subject, d.permission + FROM (VALUES + ('board','ops.kb.read'),('board','ops.kb.write'),('board','ops.process.read'), + ('board','ops.process.write'),('board','ops.secrets.read'),('board','ops.secrets.write'), + ('board','ops.arealeads.manage'),('board','members.manage'),('board','payments.manage'), + ('board','governance.manage'),('board','forum.moderate'),('board','forms.manage'), + ('board','certifications.manage'),('board','certifications.grant'), + ('board','classes.manage'),('board','classes.instruct'), + ('board','equipment.manage'), + ('board','customize.manage'),('board','settings.manage'), + ('treasurer','payments.manage'),('treasurer','ops.kb.read'),('treasurer','ops.process.read'), + ('member','ops.kb.read'),('member','ops.process.read'), + ('associate','ops.kb.read') + ) AS d(subject, permission) + ON CONFLICT (space_id, subject, permission) DO NOTHING; + RETURN NEW; +END; +$$; + +INSERT INTO public.space_role_permissions (space_id, subject, permission) +SELECT id, 'board', 'equipment.manage' FROM public.spaces +ON CONFLICT (space_id, subject, permission) DO NOTHING; diff --git a/scripts/schema.sql b/scripts/schema.sql index ca50ccd..455f544 100644 --- a/scripts/schema.sql +++ b/scripts/schema.sql @@ -1829,6 +1829,7 @@ BEGIN ('board','governance.manage'),('board','forum.moderate'),('board','forms.manage'), ('board','certifications.manage'),('board','certifications.grant'), ('board','classes.manage'),('board','classes.instruct'), + ('board','equipment.manage'), ('board','customize.manage'),('board','settings.manage'), ('treasurer','payments.manage'),('treasurer','ops.kb.read'),('treasurer','ops.process.read'), ('member','ops.kb.read'),('member','ops.process.read'), @@ -2220,3 +2221,100 @@ ON CONFLICT (space_id, subject, permission) DO NOTHING; INSERT INTO public.space_role_permissions (space_id, subject, permission) SELECT id, 'board', 'classes.instruct' FROM public.spaces ON CONFLICT (space_id, subject, permission) DO NOTHING; + + +-- ============================================================================= +-- 20. Equipment registry + reservations +-- (equivalent to scripts/033_equipment.sql). +-- +-- equipment (registry; status available/maintenance/retired; optional +-- required_certification_id -> certifications; is_active archive), +-- equipment_reservations (member time-window reservation; space_id +-- denormalized; no DB overlap constraint -- enforced in the validated +-- action). Permission equipment.manage (group Equipment). RLS additive/ +-- default-deny: equipment SELECT = manager (all) or member (is_active); +-- equipment_reservations SELECT = manager (all) or member (own), UPDATE = +-- equipment.manage, NO INSERT/DELETE policy (reserve/cancel via a +-- validated service-client action enforcing status + no-overlap + +-- required-cert). No anonymous path. seed_default_role_permissions() +-- above already seeds the code; the backfill below covers existing spaces. +-- ============================================================================= + +CREATE TABLE IF NOT EXISTS public.equipment ( + id uuid PRIMARY KEY DEFAULT uuid_generate_v4(), + space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE, + name text NOT NULL CHECK (char_length(name) BETWEEN 1 AND 200), + description text, + location text, + status text NOT NULL DEFAULT 'available' + CHECK (status IN ('available','maintenance','retired')), + required_certification_id uuid REFERENCES public.certifications(id) ON DELETE SET NULL, + asset_tag text, + is_active boolean NOT NULL DEFAULT true, + created_by uuid REFERENCES public.space_members(id) ON DELETE SET NULL, + created_at timestamptz NOT NULL DEFAULT now(), + updated_at timestamptz NOT NULL DEFAULT now() +); +CREATE INDEX IF NOT EXISTS idx_equipment_space ON public.equipment (space_id, is_active); + +CREATE TABLE IF NOT EXISTS public.equipment_reservations ( + id uuid PRIMARY KEY DEFAULT uuid_generate_v4(), + equipment_id uuid NOT NULL REFERENCES public.equipment(id) ON DELETE CASCADE, + space_id uuid NOT NULL REFERENCES public.spaces(id) ON DELETE CASCADE, + member_id uuid NOT NULL REFERENCES public.space_members(id) ON DELETE CASCADE, + starts_at timestamptz NOT NULL, + ends_at timestamptz NOT NULL CHECK (ends_at > starts_at), + status text NOT NULL DEFAULT 'reserved' + CHECK (status IN ('reserved','cancelled','completed')), + notes text, + created_by uuid REFERENCES public.space_members(id) ON DELETE SET NULL, + created_at timestamptz NOT NULL DEFAULT now() +); +CREATE INDEX IF NOT EXISTS idx_equipment_res_space ON public.equipment_reservations (space_id); +CREATE INDEX IF NOT EXISTS idx_equipment_res_equipment ON public.equipment_reservations (equipment_id, starts_at); +CREATE INDEX IF NOT EXISTS idx_equipment_res_member ON public.equipment_reservations (member_id); + +ALTER TABLE public.equipment ENABLE ROW LEVEL SECURITY; +ALTER TABLE public.equipment_reservations ENABLE ROW LEVEL SECURITY; + +DROP POLICY IF EXISTS equipment_select ON public.equipment; +DROP POLICY IF EXISTS equipment_insert ON public.equipment; +DROP POLICY IF EXISTS equipment_update ON public.equipment; +DROP POLICY IF EXISTS equipment_delete ON public.equipment; +CREATE POLICY equipment_select ON public.equipment FOR SELECT + USING ( + public.user_has_permission(auth.uid(), space_id, 'equipment.manage') + OR ( + space_id IN (SELECT public.get_user_space_ids(auth.uid())) + AND is_active + ) + ); +CREATE POLICY equipment_insert ON public.equipment FOR INSERT + WITH CHECK (public.user_has_permission(auth.uid(), space_id, 'equipment.manage')); +CREATE POLICY equipment_update ON public.equipment FOR UPDATE + USING (public.user_has_permission(auth.uid(), space_id, 'equipment.manage')); +CREATE POLICY equipment_delete ON public.equipment FOR DELETE + USING (public.user_has_permission(auth.uid(), space_id, 'equipment.manage')); + +DROP POLICY IF EXISTS equipment_reservations_select ON public.equipment_reservations; +DROP POLICY IF EXISTS equipment_reservations_update ON public.equipment_reservations; +CREATE POLICY equipment_reservations_select ON public.equipment_reservations FOR SELECT + USING ( + public.user_has_permission(auth.uid(), space_id, 'equipment.manage') + OR member_id IN ( + SELECT id FROM public.space_members + WHERE user_id = auth.uid() AND space_id = equipment_reservations.space_id + ) + ); +CREATE POLICY equipment_reservations_update ON public.equipment_reservations FOR UPDATE + USING (public.user_has_permission(auth.uid(), space_id, 'equipment.manage')); +-- No INSERT/DELETE policy: reserve/cancel via a validated service-client action. + +DROP TRIGGER IF EXISTS trg_equipment_touch ON public.equipment; +CREATE TRIGGER trg_equipment_touch + BEFORE UPDATE ON public.equipment + FOR EACH ROW EXECUTE FUNCTION public.touch_updated_at(); + +INSERT INTO public.space_role_permissions (space_id, subject, permission) +SELECT id, 'board', 'equipment.manage' FROM public.spaces +ON CONFLICT (space_id, subject, permission) DO NOTHING; diff --git a/types/database.ts b/types/database.ts index e7976f9..49242a3 100644 --- a/types/database.ts +++ b/types/database.ts @@ -136,6 +136,18 @@ export type Database = { Update: { id?: string; session_id?: string; space_id?: string; member_id?: string; status?: string; attended?: boolean; signed_up_at?: string; created_at?: string } Relationships: [] } + equipment: { + Row: { id: string; space_id: string; name: string; description: string | null; location: string | null; status: string; required_certification_id: string | null; asset_tag: string | null; is_active: boolean; created_by: string | null; created_at: string; updated_at: string } + Insert: { id?: string; space_id: string; name: string; description?: string | null; location?: string | null; status?: string; required_certification_id?: string | null; asset_tag?: string | null; is_active?: boolean; created_by?: string | null; created_at?: string; updated_at?: string } + Update: { id?: string; space_id?: string; name?: string; description?: string | null; location?: string | null; status?: string; required_certification_id?: string | null; asset_tag?: string | null; is_active?: boolean; created_by?: string | null; created_at?: string; updated_at?: string } + Relationships: [] + } + equipment_reservations: { + Row: { id: string; equipment_id: string; space_id: string; member_id: string; starts_at: string; ends_at: string; status: string; notes: string | null; created_by: string | null; created_at: string } + Insert: { id?: string; equipment_id: string; space_id: string; member_id: string; starts_at: string; ends_at: string; status?: string; notes?: string | null; created_by?: string | null; created_at?: string } + Update: { id?: string; equipment_id?: string; space_id?: string; member_id?: string; starts_at?: string; ends_at?: string; status?: string; notes?: string | null; created_by?: string | null; created_at?: string } + Relationships: [] + } activity_log: { Row: { action: string