MahdiandCursor
af1e217a68
Introduce permission catalog, PermissionsGuard, JWT/me payload with role+permissions, and gate all module controllers. Admins CRUD accepts role/permissions with safety rules; migrate existing users to super_admin. Co-authored-by: Cursor <cursoragent@cursor.com>
26 lines
732 B
SQL
26 lines
732 B
SQL
-- Replace unused UserRole.viewer with admin + permissions JSON
|
|
|
|
CREATE TYPE "UserRole_new" AS ENUM ('super_admin', 'admin');
|
|
|
|
ALTER TABLE "users" ALTER COLUMN "role" DROP DEFAULT;
|
|
|
|
ALTER TABLE "users"
|
|
ALTER COLUMN "role" TYPE "UserRole_new"
|
|
USING (
|
|
CASE
|
|
WHEN "role"::text = 'viewer' THEN 'admin'::"UserRole_new"
|
|
ELSE "role"::text::"UserRole_new"
|
|
END
|
|
);
|
|
|
|
DROP TYPE "UserRole";
|
|
|
|
ALTER TYPE "UserRole_new" RENAME TO "UserRole";
|
|
|
|
ALTER TABLE "users" ALTER COLUMN "role" SET DEFAULT 'super_admin'::"UserRole";
|
|
|
|
ALTER TABLE "users" ADD COLUMN IF NOT EXISTS "permissions" JSONB NOT NULL DEFAULT '[]';
|
|
|
|
-- Existing managers keep full access
|
|
UPDATE "users" SET "role" = 'super_admin', "permissions" = '[]'::jsonb;
|