大交通检索修复

control-plane/migrations/025_arrangement_ledger.sql

@@ -0,0 +1,40 @@
+-- Successful arrangement history belongs to an employee/group, not a task.
+-- Source task/execution identifiers deliberately have NO task foreign key:
+-- force deletion must not erase the business record or its receipt snapshot.
+CREATE TABLE arrangement_ledger_owners (
+  organization_id uuid NOT NULL REFERENCES organizations(id),
+  owner_user_id uuid NOT NULL,
+  backfilled_at timestamptz,
+  PRIMARY KEY (organization_id, owner_user_id),
+  FOREIGN KEY (organization_id, owner_user_id) REFERENCES users(organization_id, id)
+);
+
+CREATE TABLE arrangement_ledger_events (
+  id bigserial PRIMARY KEY,
+  organization_id uuid NOT NULL REFERENCES organizations(id),
+  owner_user_id uuid NOT NULL,
+  group_key text NOT NULL,
+  action text NOT NULL CHECK (action IN (
+    'arrangement_guide', 'arrangement_vehicle', 'arrangement_hotel',
+    'arrangement_transport', 'arrangement_other'
+  )),
+  source_task_id text NOT NULL,
+  execution_id text NOT NULL,
+  effective_at timestamptz NOT NULL,
+  recorded_at timestamptz NOT NULL,
+  source_task_deleted_at timestamptz,
+  detail_ciphertext text NOT NULL,
+  UNIQUE (organization_id, owner_user_id, execution_id),
+  FOREIGN KEY (organization_id, owner_user_id) REFERENCES users(organization_id, id)
+);
+CREATE INDEX arrangement_ledger_group_idx ON arrangement_ledger_events
+  (organization_id, owner_user_id, group_key, effective_at, id);
+CREATE INDEX arrangement_ledger_source_task_idx ON arrangement_ledger_events
+  (organization_id, owner_user_id, source_task_id);
+
+CREATE TRIGGER arrangement_ledger_owner_not_admin
+BEFORE INSERT OR UPDATE OF organization_id, owner_user_id ON arrangement_ledger_owners
+FOR EACH ROW EXECUTE FUNCTION reject_admin_task_principal('owner_user_id', 'arrangement_ledger_owner_not_admin');
+CREATE TRIGGER arrangement_ledger_event_owner_not_admin
+BEFORE INSERT OR UPDATE OF organization_id, owner_user_id ON arrangement_ledger_events
+FOR EACH ROW EXECUTE FUNCTION reject_admin_task_principal('owner_user_id', 'arrangement_ledger_event_owner_not_admin');