37 lines
1.7 KiB
SQL
37 lines
1.7 KiB
SQL
-- 020_permissions.sql
|
|
-- Fine-grained permissions on groups (v0.24.2)
|
|
|
|
-- Extend the groups.source CHECK to include 'system' (system-seeded groups).
|
|
ALTER TABLE groups DROP CONSTRAINT IF EXISTS groups_source_check;
|
|
ALTER TABLE groups ADD CONSTRAINT groups_source_check
|
|
CHECK (source IN ('manual', 'oidc', 'system'));
|
|
|
|
-- created_by is meaningless for system-seeded groups; allow NULL.
|
|
ALTER TABLE groups ALTER COLUMN created_by DROP NOT NULL;
|
|
|
|
ALTER TABLE groups
|
|
ADD COLUMN IF NOT EXISTS permissions JSONB NOT NULL DEFAULT '[]'::jsonb,
|
|
ADD COLUMN IF NOT EXISTS token_budget_daily BIGINT,
|
|
ADD COLUMN IF NOT EXISTS token_budget_monthly BIGINT,
|
|
ADD COLUMN IF NOT EXISTS allowed_models JSONB;
|
|
|
|
COMMENT ON COLUMN groups.permissions IS 'Array of permission strings granted to group members';
|
|
COMMENT ON COLUMN groups.token_budget_daily IS 'Daily token ceiling for members (NULL = unlimited)';
|
|
COMMENT ON COLUMN groups.token_budget_monthly IS 'Monthly token ceiling for members (NULL = unlimited)';
|
|
COMMENT ON COLUMN groups.allowed_models IS 'Array of model_id strings this group may use. NULL = unrestricted.';
|
|
|
|
-- Seed the Everyone group with a stable well-known ID.
|
|
-- All authenticated users receive its permissions implicitly (no membership row needed).
|
|
-- source='system' prevents deletion via the store guard.
|
|
INSERT INTO groups (id, name, description, scope, created_by, source, permissions)
|
|
VALUES (
|
|
'00000000-0000-0000-0000-000000000001',
|
|
'Everyone',
|
|
'Implicit group — all authenticated users receive these permissions.',
|
|
'global',
|
|
NULL,
|
|
'system',
|
|
'["model.use","kb.read","channel.create"]'::jsonb
|
|
)
|
|
ON CONFLICT (id) DO NOTHING;
|