mirror of
https://github.com/renee-png/acmcc.git
synced 2026-06-21 09:50:01 +00:00
103 lines
3.9 KiB
SQL
103 lines
3.9 KiB
SQL
|
|
-- Project comments/discussion table
|
|
CREATE TABLE public.project_comments (
|
|
id UUID NOT NULL DEFAULT gen_random_uuid() PRIMARY KEY,
|
|
project_id UUID NOT NULL REFERENCES public.projects(id) ON DELETE CASCADE,
|
|
user_id UUID NOT NULL,
|
|
content TEXT NOT NULL,
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
|
updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
);
|
|
|
|
ALTER TABLE public.project_comments ENABLE ROW LEVEL SECURITY;
|
|
|
|
-- Project files table
|
|
CREATE TABLE public.project_files (
|
|
id UUID NOT NULL DEFAULT gen_random_uuid() PRIMARY KEY,
|
|
project_id UUID NOT NULL REFERENCES public.projects(id) ON DELETE CASCADE,
|
|
user_id UUID NOT NULL,
|
|
file_name TEXT NOT NULL,
|
|
file_url TEXT NOT NULL,
|
|
file_size BIGINT,
|
|
mime_type TEXT,
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
);
|
|
|
|
ALTER TABLE public.project_files ENABLE ROW LEVEL SECURITY;
|
|
|
|
-- Storage bucket for project files
|
|
INSERT INTO storage.buckets (id, name, public) VALUES ('project-files', 'project-files', true);
|
|
|
|
-- Enable realtime for comments
|
|
ALTER PUBLICATION supabase_realtime ADD TABLE public.project_comments;
|
|
|
|
-- RLS for project_comments: authenticated users can read all, insert own
|
|
CREATE POLICY "Authenticated users can read project comments"
|
|
ON public.project_comments FOR SELECT TO authenticated USING (true);
|
|
|
|
CREATE POLICY "Authenticated users can insert own comments"
|
|
ON public.project_comments FOR INSERT TO authenticated
|
|
WITH CHECK (auth.uid() = user_id);
|
|
|
|
CREATE POLICY "Users can update own comments"
|
|
ON public.project_comments FOR UPDATE TO authenticated
|
|
USING (auth.uid() = user_id);
|
|
|
|
CREATE POLICY "Users can delete own comments"
|
|
ON public.project_comments FOR DELETE TO authenticated
|
|
USING (auth.uid() = user_id);
|
|
|
|
-- RLS for project_files: authenticated users can read all, insert own
|
|
CREATE POLICY "Authenticated users can read project files"
|
|
ON public.project_files FOR SELECT TO authenticated USING (true);
|
|
|
|
CREATE POLICY "Authenticated users can upload files"
|
|
ON public.project_files FOR INSERT TO authenticated
|
|
WITH CHECK (auth.uid() = user_id);
|
|
|
|
CREATE POLICY "Users can delete own files"
|
|
ON public.project_files FOR DELETE TO authenticated
|
|
USING (auth.uid() = user_id);
|
|
|
|
-- Admin/manager can delete any file
|
|
CREATE POLICY "Admins can delete any file"
|
|
ON public.project_files FOR DELETE TO authenticated
|
|
USING (public.has_role(auth.uid(), 'admin') OR public.has_role(auth.uid(), 'manager'));
|
|
|
|
-- Storage policies for project-files bucket
|
|
CREATE POLICY "Authenticated users can read project files storage"
|
|
ON storage.objects FOR SELECT TO authenticated
|
|
USING (bucket_id = 'project-files');
|
|
|
|
CREATE POLICY "Authenticated users can upload project files storage"
|
|
ON storage.objects FOR INSERT TO authenticated
|
|
WITH CHECK (bucket_id = 'project-files');
|
|
|
|
CREATE POLICY "Users can delete own project files storage"
|
|
ON storage.objects FOR DELETE TO authenticated
|
|
USING (bucket_id = 'project-files');
|
|
|
|
-- Update projects RLS: drop old policy, add new ones allowing clients to create and view
|
|
DROP POLICY IF EXISTS "Staff full access on projects" ON public.projects;
|
|
|
|
-- Admins/managers full access
|
|
CREATE POLICY "Admin manager full access on projects"
|
|
ON public.projects FOR ALL TO authenticated
|
|
USING (public.has_role(auth.uid(), 'admin') OR public.has_role(auth.uid(), 'manager'))
|
|
WITH CHECK (public.has_role(auth.uid(), 'admin') OR public.has_role(auth.uid(), 'manager'));
|
|
|
|
-- All authenticated can read projects
|
|
CREATE POLICY "Authenticated users can view projects"
|
|
ON public.projects FOR SELECT TO authenticated
|
|
USING (true);
|
|
|
|
-- All authenticated can create projects
|
|
CREATE POLICY "Authenticated users can create projects"
|
|
ON public.projects FOR INSERT TO authenticated
|
|
WITH CHECK (auth.uid() = created_by);
|
|
|
|
-- Users can update own projects (but not status to completed - enforced in app)
|
|
CREATE POLICY "Users can update own projects"
|
|
ON public.projects FOR UPDATE TO authenticated
|
|
USING (auth.uid() = created_by);
|