114 lines
4.8 KiB
SQL
114 lines
4.8 KiB
SQL
-- ==========================================
|
|
-- Chat Switchboard — 002 Teams & Access Control
|
|
-- ==========================================
|
|
-- Teams, team membership, groups (with permissions, budgets, source),
|
|
-- group membership, Everyone group seed.
|
|
-- Consolidated v0.28.0: merges 002 + 019 (source) + 020 (permissions).
|
|
-- ==========================================
|
|
|
|
-- =========================================
|
|
-- TEAMS
|
|
-- =========================================
|
|
|
|
CREATE TABLE IF NOT EXISTS teams (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
name VARCHAR(200) NOT NULL UNIQUE,
|
|
description TEXT DEFAULT '',
|
|
created_by UUID NOT NULL REFERENCES users(id) ON DELETE RESTRICT,
|
|
is_active BOOLEAN DEFAULT true,
|
|
settings JSONB DEFAULT '{}'::jsonb,
|
|
created_at TIMESTAMPTZ DEFAULT NOW(),
|
|
updated_at TIMESTAMPTZ DEFAULT NOW()
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_teams_active ON teams(is_active) WHERE is_active = true;
|
|
DROP TRIGGER IF EXISTS teams_updated_at ON teams;
|
|
CREATE TRIGGER teams_updated_at BEFORE UPDATE ON teams
|
|
FOR EACH ROW EXECUTE FUNCTION update_updated_at();
|
|
|
|
COMMENT ON COLUMN teams.settings IS 'Team policies: {"require_private_providers": false}';
|
|
|
|
CREATE TABLE IF NOT EXISTS team_members (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
team_id UUID NOT NULL REFERENCES teams(id) ON DELETE CASCADE,
|
|
user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
|
role VARCHAR(20) NOT NULL DEFAULT 'member'
|
|
CHECK (role IN ('admin', 'member')),
|
|
joined_at TIMESTAMPTZ DEFAULT NOW(),
|
|
UNIQUE(team_id, user_id)
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_team_members_team ON team_members(team_id);
|
|
CREATE INDEX IF NOT EXISTS idx_team_members_user ON team_members(user_id);
|
|
|
|
|
|
-- =========================================
|
|
-- GROUPS (ACLs + Permissions)
|
|
-- =========================================
|
|
|
|
CREATE TABLE IF NOT EXISTS groups (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
name VARCHAR(100) NOT NULL,
|
|
description TEXT NOT NULL DEFAULT '',
|
|
scope VARCHAR(20) NOT NULL DEFAULT 'global'
|
|
CHECK (scope IN ('global', 'team')),
|
|
team_id UUID REFERENCES teams(id) ON DELETE CASCADE,
|
|
created_by UUID REFERENCES users(id), -- nullable for system-seeded
|
|
source VARCHAR(20) NOT NULL DEFAULT 'manual'
|
|
CHECK (source IN ('manual', 'oidc', 'system')),
|
|
|
|
-- Fine-grained permissions (v0.24.2)
|
|
permissions JSONB NOT NULL DEFAULT '[]'::jsonb,
|
|
token_budget_daily BIGINT,
|
|
token_budget_monthly BIGINT,
|
|
allowed_models JSONB,
|
|
|
|
created_at TIMESTAMPTZ DEFAULT NOW(),
|
|
updated_at TIMESTAMPTZ DEFAULT NOW(),
|
|
|
|
CONSTRAINT groups_scope_team CHECK (
|
|
(scope = 'global' AND team_id IS NULL) OR
|
|
(scope = 'team' AND team_id IS NOT NULL)
|
|
)
|
|
);
|
|
|
|
CREATE UNIQUE INDEX IF NOT EXISTS idx_groups_name_scope
|
|
ON groups(name, COALESCE(team_id, '00000000-0000-0000-0000-000000000000'));
|
|
|
|
DROP TRIGGER IF EXISTS groups_updated_at ON groups;
|
|
CREATE TRIGGER groups_updated_at BEFORE UPDATE ON groups
|
|
FOR EACH ROW EXECUTE FUNCTION update_updated_at();
|
|
|
|
COMMENT ON TABLE groups IS 'Access-control groups with permission grants. Decouple resource visibility from team membership.';
|
|
COMMENT ON COLUMN groups.scope IS 'global: admin-managed. team: team-admin-managed.';
|
|
COMMENT ON COLUMN groups.source IS 'manual=admin-created, oidc=synced from IdP, system=platform-seeded';
|
|
COMMENT ON COLUMN groups.permissions IS 'Array of permission strings granted to group members';
|
|
COMMENT ON COLUMN groups.token_budget_daily IS 'Daily token ceiling for members (NULL = unlimited)';
|
|
COMMENT ON COLUMN groups.token_budget_monthly IS 'Monthly token ceiling for members (NULL = unlimited)';
|
|
COMMENT ON COLUMN groups.allowed_models IS 'Array of model_id strings this group may use. NULL = unrestricted.';
|
|
|
|
CREATE TABLE IF NOT EXISTS group_members (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
group_id UUID NOT NULL REFERENCES groups(id) ON DELETE CASCADE,
|
|
user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
|
added_by UUID NOT NULL REFERENCES users(id),
|
|
added_at TIMESTAMPTZ DEFAULT NOW(),
|
|
UNIQUE(group_id, user_id)
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_group_members_group ON group_members(group_id);
|
|
CREATE INDEX IF NOT EXISTS idx_group_members_user ON group_members(user_id);
|
|
|
|
-- Seed the Everyone group with a stable well-known ID.
|
|
INSERT INTO groups (id, name, description, scope, created_by, source, permissions)
|
|
VALUES (
|
|
'00000000-0000-0000-0000-000000000001',
|
|
'Everyone',
|
|
'Implicit group — all authenticated users receive these permissions.',
|
|
'global',
|
|
NULL,
|
|
'system',
|
|
'["model.use","kb.read","channel.create"]'::jsonb
|
|
)
|
|
ON CONFLICT (id) DO NOTHING;
|