Jeffrey Smith
5836ddad21
Co-authored-by: Jeffrey Smith <jasafpro@gmail.com> Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>
86 lines
3.6 KiB
SQL
86 lines
3.6 KiB
SQL
-- ==========================================
|
|
-- Switchboard Core — 002 Teams & Access Control (SQLite)
|
|
-- ==========================================
|
|
|
|
CREATE TABLE IF NOT EXISTS teams (
|
|
id TEXT PRIMARY KEY,
|
|
name TEXT NOT NULL UNIQUE,
|
|
description TEXT DEFAULT '',
|
|
created_by TEXT NOT NULL REFERENCES users(id),
|
|
is_active INTEGER DEFAULT 1,
|
|
settings TEXT DEFAULT '{}',
|
|
created_at TEXT DEFAULT (datetime('now')),
|
|
updated_at TEXT DEFAULT (datetime('now'))
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_teams_active ON teams(is_active);
|
|
|
|
CREATE TRIGGER IF NOT EXISTS teams_updated_at AFTER UPDATE ON teams
|
|
FOR EACH ROW WHEN NEW.updated_at = OLD.updated_at
|
|
BEGIN UPDATE teams SET updated_at = datetime('now') WHERE id = NEW.id; END;
|
|
|
|
CREATE TABLE IF NOT EXISTS team_members (
|
|
id TEXT PRIMARY KEY,
|
|
team_id TEXT NOT NULL REFERENCES teams(id) ON DELETE CASCADE,
|
|
user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
|
role TEXT NOT NULL DEFAULT 'member' CHECK (role IN ('admin', 'member')),
|
|
joined_at TEXT DEFAULT (datetime('now')),
|
|
UNIQUE(team_id, user_id)
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_team_members_team ON team_members(team_id);
|
|
CREATE INDEX IF NOT EXISTS idx_team_members_user ON team_members(user_id);
|
|
|
|
CREATE TABLE IF NOT EXISTS groups (
|
|
id TEXT PRIMARY KEY,
|
|
name TEXT NOT NULL,
|
|
description TEXT NOT NULL DEFAULT '',
|
|
scope TEXT NOT NULL DEFAULT 'global' CHECK (scope IN ('global', 'team')),
|
|
team_id TEXT REFERENCES teams(id) ON DELETE CASCADE,
|
|
created_by TEXT REFERENCES users(id),
|
|
source TEXT NOT NULL DEFAULT 'manual' CHECK (source IN ('manual', 'oidc', 'system')),
|
|
permissions TEXT NOT NULL DEFAULT '[]',
|
|
created_at TEXT DEFAULT (datetime('now')),
|
|
updated_at TEXT DEFAULT (datetime('now'))
|
|
);
|
|
|
|
CREATE UNIQUE INDEX IF NOT EXISTS idx_groups_name_scope
|
|
ON groups(name, COALESCE(team_id, '00000000-0000-0000-0000-000000000000'));
|
|
|
|
CREATE TRIGGER IF NOT EXISTS groups_updated_at AFTER UPDATE ON groups
|
|
FOR EACH ROW WHEN NEW.updated_at = OLD.updated_at
|
|
BEGIN UPDATE groups SET updated_at = datetime('now') WHERE id = NEW.id; END;
|
|
|
|
CREATE TABLE IF NOT EXISTS group_members (
|
|
id TEXT PRIMARY KEY,
|
|
group_id TEXT NOT NULL REFERENCES groups(id) ON DELETE CASCADE,
|
|
user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
|
added_by TEXT NOT NULL REFERENCES users(id),
|
|
added_at TEXT DEFAULT (datetime('now')),
|
|
UNIQUE(group_id, user_id)
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_group_members_group ON group_members(group_id);
|
|
CREATE INDEX IF NOT EXISTS idx_group_members_user ON group_members(user_id);
|
|
|
|
INSERT OR IGNORE INTO groups (id, name, description, scope, created_by, source, permissions)
|
|
VALUES (
|
|
'00000000-0000-0000-0000-000000000001',
|
|
'Everyone',
|
|
'Implicit group — all authenticated users receive these permissions.',
|
|
'global', NULL, 'system',
|
|
'["extension.use","workflow.submit"]'
|
|
);
|
|
|
|
-- Seed Admins group — members receive full platform permissions.
|
|
-- Replaces the legacy users.role = 'admin' authorization check.
|
|
-- Membership is managed by bootstrap/seed logic at runtime.
|
|
INSERT OR IGNORE INTO groups (id, name, description, scope, created_by, source, permissions)
|
|
VALUES (
|
|
'00000000-0000-0000-0000-000000000002',
|
|
'Admins',
|
|
'Full platform access — replaces legacy admin role.',
|
|
'global', NULL, 'system',
|
|
'["surface.admin.access","extension.use","extension.install","workflow.create","workflow.submit","admin.view","token.unlimited"]'
|
|
);
|