Maximilian Stubhan
901c5c426e
Reworks the app from a two-role (hr_admin/manager) model to a single HR-only role gated by profiles.is_active, fixes transfer/promote/karenz/ reorg RPCs to actually defer future-dated changes via a new pending_org_changes table instead of writing them immediately (applied by a daily Vercel Cron route), makes reorg undo append-only instead of deleting history, adds Karenz-return and history-date integrity guards, deprecates the salary column, and adds explicit schema grants + perf indexes needed to run against a fresh (non-hosted) Postgres instance. Adds vitest unit + integration test suites (the latter against a real local Supabase instance) covering all of the above, plus lint/typecheck/ build wiring (`npm run check`).
26 lines
1.6 KiB
SQL
26 lines
1.6 KiB
SQL
-- Explicit schema/table/sequence/routine grants for anon/authenticated/
|
|
-- service_role.
|
|
--
|
|
-- Found while standing up a local Supabase instance to run the integration
|
|
-- test suite (spec §17): every table in this schema
|
|
-- relies on RLS policies to restrict access, but RLS only ever *narrows*
|
|
-- what an already-GRANTed role may do — Postgres still checks ordinary
|
|
-- object privileges first, independent of a role's BYPASSRLS flag. On
|
|
-- Supabase's hosted platform this GRANT setup is applied automatically
|
|
-- during project provisioning, so it was invisible here: every previous
|
|
-- migration worked fine against the already-provisioned hosted project, but
|
|
-- the exact same migrations against a *fresh* Postgres (a new local dev
|
|
-- instance, a disaster-recovery restore, or CI) fail with "permission
|
|
-- denied for table X" even for the service role, since that grant was never
|
|
-- actually part of this repo's own migrations. Making it explicit here
|
|
-- makes the schema fully self-contained and reprovisionable from scratch.
|
|
grant usage on schema public to anon, authenticated, service_role;
|
|
|
|
grant all on all tables in schema public to anon, authenticated, service_role;
|
|
grant all on all sequences in schema public to anon, authenticated, service_role;
|
|
grant all on all routines in schema public to anon, authenticated, service_role;
|
|
|
|
alter default privileges in schema public grant all on tables to anon, authenticated, service_role;
|
|
alter default privileges in schema public grant all on sequences to anon, authenticated, service_role;
|
|
alter default privileges in schema public grant all on routines to anon, authenticated, service_role;
|