feat: permissions, a scoped console, and catalog management (#7)

Phase 1 of `docs/console.md` (builds on #6, whose docs commit it includes; merge #6 first).

**API**
- `permissions.ts`: `resource:action` permissions, built-in roles as bundles at a scope (hub, catalog, product), `can`/`require`, "may give" checks. A missing permission answers 403 with `missing: {permission, scope}`.
- Catalog management: settings (incl. rating ceiling, upload policy, mirroring), key rotation, operators, membership (open / approval / invite links, bans), delisting, suspension by moderators, and `GET /api/v1/catalog/changes` for catalogs.
- Membership is enforced: getting a product (403 `members_only` with the catalogs to join), the library list, and outfits relayed to others. Seeing products still needs no membership.
- Console for everyone who controls a catalog, product or hosted room; `/console/audit` (tagged entries, scoped by permission, with filters), `/console/permissions`; `/me` says whether the console is for them.
- Migration 0010: `role_assignment`, `catalog_member`, `catalog_invite`, `catalog_change`, catalog settings, audit `tags` (backfilled from old entries).

**Website**
- Console overview by what you manage; audit log page with filters; catalog list scoped to your teams; a catalog management page (settings, key, team, members, invitations, products, moderation, recent changes).
- Public catalog pages with join / ask / accept invitation / leave; product pages say "members only" and link the catalogs.

**Checked**: 43 API tests pass (8 new in `catalogs.test.ts`); API, web and db type checks; every new page rendered against a local hub for owner, operator, member, outsider and admin; the Eden DELETE-with-query calls tested against the API. Server-action forms weren't clicked through in a browser.

Not in this PR (later phases): catalog deletion requests (with cases), drafts and moderator product edits, notifications, API tokens, two-factor, imports, charts.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Phase 1 of `docs/console.md` (builds on #6, whose docs commit it includes; merge #6 first).

**API**
- `permissions.ts`: `resource:action` permissions, built-in roles as bundles at a scope (hub, catalog, product), `can`/`require`, "may give" checks. A missing permission answers 403 with `missing: {permission, scope}`.
- Catalog management: settings (incl. rating ceiling, upload policy, mirroring), key rotation, operators, membership (open / approval / invite links, bans), delisting, suspension by moderators, and `GET /api/v1/catalog/changes` for catalogs.
- Membership is enforced: getting a product (403 `members_only` with the catalogs to join), the library list, and outfits relayed to others. Seeing products still needs no membership.
- Console for everyone who controls a catalog, product or hosted room; `/console/audit` (tagged entries, scoped by permission, with filters), `/console/permissions`; `/me` says whether the console is for them.
- Migration 0010: `role_assignment`, `catalog_member`, `catalog_invite`, `catalog_change`, catalog settings, audit `tags` (backfilled from old entries).

**Website**
- Console overview by what you manage; audit log page with filters; catalog list scoped to your teams; a catalog management page (settings, key, team, members, invitations, products, moderation, recent changes).
- Public catalog pages with join / ask / accept invitation / leave; product pages say "members only" and link the catalogs.

**Checked**: 43 API tests pass (8 new in `catalogs.test.ts`); API, web and db type checks; every new page rendered against a local hub for owner, operator, member, outsider and admin; the Eden DELETE-with-query calls tested against the API. Server-action forms weren't clicked through in a browser.

Not in this PR (later phases): catalog deletion requests (with cases), drafts and moderator product edits, notifications, API tokens, two-factor, imports, charts.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: dhkatz <[email protected]>

packages/db/src/index.ts

@@ -11,7 +11,7 @@ import { fileURLToPath } from "node:url";
 import * as schema from "./schema";
 
 export { schema };
-export type { DecorationItem, FileEntry, ParentInfo, RoomModerator, SceneItem } from "./schema";
+export type { AuditTags, DecorationItem, FileEntry, ParentInfo, RoomModerator, SceneItem } from "./schema";
 export * from "drizzle-orm";
 
 const migrationsFolder = fileURLToPath(new URL("../drizzle", import.meta.url));

packages/db/src/schema.ts

@@ -221,10 +221,15 @@ export const audit = pgTable(
     action: text("action").notNull(),
     target: text("target").notNull().default(""),
     detail: jsonb("detail").$type<Record<string, unknown>>().notNull().default({}),
+    // The resources the change touches ({catalog, product, room, person}): who may see the entry (docs/console.md).
+    tags: jsonb("tags").$type<AuditTags>().notNull().default({}),
   },
-  (t) => [index("audit_at").on(t.at)],
+  (t) => [index("audit_at").on(t.at), index("audit_tags").using("gin", t.tags)],
 );
 
+/** The resources an audit entry touches. */
+export type AuditTags = { catalog?: string; product?: string; room?: string; person?: string };
+
 // ---- Products (docs/products.md) ----
 
 export type FileEntry = { name: string; sha256: string; size: number };
@@ -259,13 +264,89 @@ export const catalog = pgTable(
     contact: text("contact").notNull(), // takedown and legal contact
     visibility: text("visibility").notNull().default("public"), // "public", "private"
     membership: text("membership").notNull().default("open"), // "open", "approval", "invite"
-    status: text("status").notNull().default("pending"), // "pending", "approved", "rejected"
+    status: text("status").notNull().default("pending"), // "pending", "approved", "rejected", "suspended"
+    statusReason: text("status_reason").notNull().default(""), // why it was rejected or suspended
+    maxRating: text("max_rating").notNull().default("adult"), // the highest rating it hosts: "general", "adult"
+    uploads: text("uploads").notNull().default("anyone"), // who may upload: "anyone", "members", "team"
+    mirrors: text("mirrors").notNull().default("approve"), // mirroring others' revisions: "auto", "approve", "off"
     keyHash: text("key_hash").notNull(), // sha256 of its key, hex
     createdAt: createdAt(),
+    updatedAt: updatedAt(),
   },
   (t) => [uniqueIndex("catalog_url").on(t.url)],
 );
 
+// A role given to a person at a scope (docs/console.md). Hub-wide roles are user.role; owners are derived (a
+// catalog's owner_id, a product's creator_id), so they're never here.
+export const roleAssignment = pgTable(
+  "role_assignment",
+  {
+    userId: text("user_id")
+      .notNull()
+      .references(() => user.id, { onDelete: "cascade" }),
+    role: text("role").notNull(), // e.g. "catalog-operator"
+    scopeType: text("scope_type").notNull(), // "catalog"
+    scopeId: text("scope_id").notNull(),
+    grantedBy: text("granted_by").references(() => user.id, { onDelete: "set null" }),
+    createdAt: createdAt(),
+  },
+  (t) => [
+    primaryKey({ columns: [t.userId, t.role, t.scopeType, t.scopeId] }),
+    index("role_assignment_scope").on(t.scopeType, t.scopeId),
+  ],
+);
+
+// A person's membership of a catalog: asked to join, a member, or banned from it.
+export const catalogMember = pgTable(
+  "catalog_member",
+  {
+    catalogId: text("catalog_id")
+      .notNull()
+      .references(() => catalog.id, { onDelete: "cascade" }),
+    userId: text("user_id")
+      .notNull()
+      .references(() => user.id, { onDelete: "cascade" }),
+    status: text("status").notNull(), // "requested", "member", "banned"
+    invite: text("invite"), // the invite code they joined with
+    decidedBy: text("decided_by").references(() => user.id, { onDelete: "set null" }),
+    createdAt: createdAt(),
+    updatedAt: updatedAt(),
+  },
+  (t) => [primaryKey({ columns: [t.catalogId, t.userId] }), index("catalog_member_user").on(t.userId)],
+);
+
+// An invitation to join a catalog: a code, used up to maxUses times (null: no limit) until it expires.
+export const catalogInvite = pgTable(
+  "catalog_invite",
+  {
+    code: text("code").primaryKey(),
+    catalogId: text("catalog_id")
+      .notNull()
+      .references(() => catalog.id, { onDelete: "cascade" }),
+    createdBy: text("created_by").references(() => user.id, { onDelete: "set null" }),
+    maxUses: integer("max_uses"),
+    uses: integer("uses").notNull().default(0),
+    expiresAt: timestamp("expires_at", { withTimezone: true }),
+    revokedAt: timestamp("revoked_at", { withTimezone: true }),
+    createdAt: createdAt(),
+  },
+  (t) => [index("catalog_invite_catalog").on(t.catalogId)],
+);
+
+// What a catalog must act on (GET /api/v1/catalog/changes): files to delete, revisions to mirror, its status.
+export const catalogChange = pgTable(
+  "catalog_change",
+  {
+    id: serial("id").primaryKey(),
+    catalogId: text("catalog_id")
+      .notNull()
+      .references(() => catalog.id, { onDelete: "cascade" }),
+    data: jsonb("data").$type<Record<string, unknown>>().notNull(), // {type, ...}
+    createdAt: createdAt(),
+  },
+  (t) => [index("catalog_change_catalog").on(t.catalogId, t.id)],
+);
+
 // A product: its info, owned by its creator. Its files are in revisions.
 export const product = pgTable(
   "product",