69 lines
2.6 KiB
SQL
69 lines
2.6 KiB
SQL
-- Administrator-managed allowlists for the 18 registered manual business routes.
|
|
-- Administrators always retain every route; team leads and ordinary users are
|
|
-- denied by default until an administrator grants explicit route IDs.
|
|
|
|
ALTER TABLE users
|
|
ADD COLUMN IF NOT EXISTS business_authorization_revision integer NOT NULL DEFAULT 0;
|
|
|
|
ALTER TABLE users
|
|
DROP CONSTRAINT IF EXISTS users_business_authorization_revision_check;
|
|
|
|
ALTER TABLE users
|
|
ADD CONSTRAINT users_business_authorization_revision_check
|
|
CHECK (business_authorization_revision >= 0);
|
|
|
|
CREATE UNIQUE INDEX IF NOT EXISTS users_organization_id_id_authorization_idx
|
|
ON users (organization_id, id);
|
|
|
|
CREATE TABLE IF NOT EXISTS user_business_route_authorizations (
|
|
organization_id uuid NOT NULL REFERENCES organizations(id) ON DELETE CASCADE,
|
|
user_id uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
|
route_id text NOT NULL,
|
|
granted_by uuid REFERENCES users(id),
|
|
granted_at timestamptz NOT NULL DEFAULT now(),
|
|
PRIMARY KEY (organization_id, user_id, route_id),
|
|
CONSTRAINT user_business_route_authorizations_route_check CHECK (route_id IN (
|
|
'team_order_create',
|
|
'team_order_batch_create',
|
|
'shared_plan_create',
|
|
'shared_child_order_create',
|
|
'passenger_list_import_independent',
|
|
'passenger_list_import_shared_child',
|
|
'arrangement_guide_create',
|
|
'arrangement_vehicle_create',
|
|
'arrangement_hotel_create',
|
|
'arrangement_transport_create',
|
|
'arrangement_other_create',
|
|
'order_update_shared_plan',
|
|
'order_update_shared_child',
|
|
'order_update_independent',
|
|
'arrangement_hotel_update',
|
|
'order_cancel',
|
|
'order_restore',
|
|
'confirmation_export'
|
|
))
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS user_business_route_authorizations_user_idx
|
|
ON user_business_route_authorizations (organization_id, user_id, route_id);
|
|
|
|
CREATE INDEX IF NOT EXISTS user_business_route_authorizations_route_idx
|
|
ON user_business_route_authorizations (organization_id, route_id, user_id);
|
|
|
|
ALTER TABLE user_business_route_authorizations
|
|
DROP CONSTRAINT IF EXISTS user_business_route_authorizations_user_scope_fkey;
|
|
|
|
ALTER TABLE user_business_route_authorizations
|
|
ADD CONSTRAINT user_business_route_authorizations_user_scope_fkey
|
|
FOREIGN KEY (organization_id, user_id)
|
|
REFERENCES users (organization_id, id)
|
|
ON DELETE CASCADE;
|
|
|
|
ALTER TABLE user_business_route_authorizations
|
|
DROP CONSTRAINT IF EXISTS user_business_route_authorizations_granter_scope_fkey;
|
|
|
|
ALTER TABLE user_business_route_authorizations
|
|
ADD CONSTRAINT user_business_route_authorizations_granter_scope_fkey
|
|
FOREIGN KEY (organization_id, granted_by)
|
|
REFERENCES users (organization_id, id);
|