feat: permissions, a console for everyone who manages something, and catalog management
Phase 1 of docs/console.md: permissions as resource:action strings in role bundles at a scope; the console for anyone controlling a catalog, product or room, with a tagged audit log scoped by permission and filters; catalog settings (rating ceiling, upload policy), key rotation, operators, membership (approval, invitations, bans) enforced when getting and wearing products, delisting, suspension, and the catalogs' changes feed. Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
dhkatzandClaude Opus 5.5 committed
1 parent
76497c9b41
commit
370ae0646a
29 files changed
+5657
-181
No files matched your search
@@ -0,0 +1,62 @@
|
||||
CREATE TABLE "catalog_change" (
|
||||
"id" serial PRIMARY KEY NOT NULL,
|
||||
"catalog_id" text NOT NULL,
|
||||
"data" jsonb NOT NULL,
|
||||
"created_at" timestamp with time zone DEFAULT now() NOT NULL
|
||||
);
|
||||
--> statement-breakpoint
|
||||
CREATE TABLE "catalog_invite" (
|
||||
"code" text PRIMARY KEY NOT NULL,
|
||||
"catalog_id" text NOT NULL,
|
||||
"created_by" text,
|
||||
"max_uses" integer,
|
||||
"uses" integer DEFAULT 0 NOT NULL,
|
||||
"expires_at" timestamp with time zone,
|
||||
"revoked_at" timestamp with time zone,
|
||||
"created_at" timestamp with time zone DEFAULT now() NOT NULL
|
||||
);
|
||||
--> statement-breakpoint
|
||||
CREATE TABLE "catalog_member" (
|
||||
"catalog_id" text NOT NULL,
|
||||
"user_id" text NOT NULL,
|
||||
"status" text NOT NULL,
|
||||
"invite" text,
|
||||
"decided_by" text,
|
||||
"created_at" timestamp with time zone DEFAULT now() NOT NULL,
|
||||
"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
|
||||
CONSTRAINT "catalog_member_catalog_id_user_id_pk" PRIMARY KEY("catalog_id","user_id")
|
||||
);
|
||||
--> statement-breakpoint
|
||||
CREATE TABLE "role_assignment" (
|
||||
"user_id" text NOT NULL,
|
||||
"role" text NOT NULL,
|
||||
"scope_type" text NOT NULL,
|
||||
"scope_id" text NOT NULL,
|
||||
"granted_by" text,
|
||||
"created_at" timestamp with time zone DEFAULT now() NOT NULL,
|
||||
CONSTRAINT "role_assignment_user_id_role_scope_type_scope_id_pk" PRIMARY KEY("user_id","role","scope_type","scope_id")
|
||||
);
|
||||
--> statement-breakpoint
|
||||
ALTER TABLE "audit" ADD COLUMN "tags" jsonb DEFAULT '{}'::jsonb NOT NULL;--> statement-breakpoint
|
||||
ALTER TABLE "catalog" ADD COLUMN "status_reason" text DEFAULT '' NOT NULL;--> statement-breakpoint
|
||||
ALTER TABLE "catalog" ADD COLUMN "max_rating" text DEFAULT 'adult' NOT NULL;--> statement-breakpoint
|
||||
ALTER TABLE "catalog" ADD COLUMN "uploads" text DEFAULT 'anyone' NOT NULL;--> statement-breakpoint
|
||||
ALTER TABLE "catalog" ADD COLUMN "mirrors" text DEFAULT 'approve' NOT NULL;--> statement-breakpoint
|
||||
ALTER TABLE "catalog" ADD COLUMN "updated_at" timestamp with time zone DEFAULT now() NOT NULL;--> statement-breakpoint
|
||||
ALTER TABLE "catalog_change" ADD CONSTRAINT "catalog_change_catalog_id_catalog_id_fk" FOREIGN KEY ("catalog_id") REFERENCES "public"."catalog"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
|
||||
ALTER TABLE "catalog_invite" ADD CONSTRAINT "catalog_invite_catalog_id_catalog_id_fk" FOREIGN KEY ("catalog_id") REFERENCES "public"."catalog"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
|
||||
ALTER TABLE "catalog_invite" ADD CONSTRAINT "catalog_invite_created_by_user_id_fk" FOREIGN KEY ("created_by") REFERENCES "public"."user"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
|
||||
ALTER TABLE "catalog_member" ADD CONSTRAINT "catalog_member_catalog_id_catalog_id_fk" FOREIGN KEY ("catalog_id") REFERENCES "public"."catalog"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
|
||||
ALTER TABLE "catalog_member" ADD CONSTRAINT "catalog_member_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
|
||||
ALTER TABLE "catalog_member" ADD CONSTRAINT "catalog_member_decided_by_user_id_fk" FOREIGN KEY ("decided_by") REFERENCES "public"."user"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
|
||||
ALTER TABLE "role_assignment" ADD CONSTRAINT "role_assignment_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
|
||||
ALTER TABLE "role_assignment" ADD CONSTRAINT "role_assignment_granted_by_user_id_fk" FOREIGN KEY ("granted_by") REFERENCES "public"."user"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
|
||||
CREATE INDEX "catalog_change_catalog" ON "catalog_change" USING btree ("catalog_id","id");--> statement-breakpoint
|
||||
CREATE INDEX "catalog_invite_catalog" ON "catalog_invite" USING btree ("catalog_id");--> statement-breakpoint
|
||||
CREATE INDEX "catalog_member_user" ON "catalog_member" USING btree ("user_id");--> statement-breakpoint
|
||||
CREATE INDEX "role_assignment_scope" ON "role_assignment" USING btree ("scope_type","scope_id");--> statement-breakpoint
|
||||
CREATE INDEX "audit_tags" ON "audit" USING gin ("tags");--> statement-breakpoint
|
||||
-- Tags for entries written before tags existed (target was the catalog, product or room).
|
||||
UPDATE "audit" SET "tags" = jsonb_build_object('catalog', "target") WHERE "action" LIKE 'catalog.%' AND "target" <> '';--> statement-breakpoint
|
||||
UPDATE "audit" SET "tags" = jsonb_build_object('product', "target") WHERE "action" LIKE 'product.%' AND "target" <> '';--> statement-breakpoint
|
||||
UPDATE "audit" SET "tags" = jsonb_build_object('room', "target") WHERE "action" LIKE 'hosted_room.%' AND "target" <> '';
|
||||
File diff suppressed because it is too large.
Load diff
@@ -71,6 +71,13 @@
|
||||
"when": 1793707706030,
|
||||
"tag": "0009_registration",
|
||||
"breakpoints": true
|
||||
},
|
||||
{
|
||||
"idx": 10,
|
||||
"version": "7",
|
||||
"when": 1793862017365,
|
||||
"tag": "0010_catalog_management",
|
||||
"breakpoints": true
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -11,7 +11,7 @@ import { fileURLToPath } from "node:url";
|
||||
import * as schema from "./schema";
|
||||
|
||||
export { schema };
|
||||
export type { DecorationItem, FileEntry, ParentInfo, RoomModerator, SceneItem } from "./schema";
|
||||
export type { AuditTags, DecorationItem, FileEntry, ParentInfo, RoomModerator, SceneItem } from "./schema";
|
||||
export * from "drizzle-orm";
|
||||
|
||||
const migrationsFolder = fileURLToPath(new URL("../drizzle", import.meta.url));
|
||||
|
||||
@@ -221,10 +221,15 @@ export const audit = pgTable(
|
||||
action: text("action").notNull(),
|
||||
target: text("target").notNull().default(""),
|
||||
detail: jsonb("detail").$type<Record<string, unknown>>().notNull().default({}),
|
||||
// The resources the change touches ({catalog, product, room, person}): who may see the entry (docs/console.md).
|
||||
tags: jsonb("tags").$type<AuditTags>().notNull().default({}),
|
||||
},
|
||||
(t) => [index("audit_at").on(t.at)],
|
||||
(t) => [index("audit_at").on(t.at), index("audit_tags").using("gin", t.tags)],
|
||||
);
|
||||
|
||||
/** The resources an audit entry touches. */
|
||||
export type AuditTags = { catalog?: string; product?: string; room?: string; person?: string };
|
||||
|
||||
// ---- Products (docs/products.md) ----
|
||||
|
||||
export type FileEntry = { name: string; sha256: string; size: number };
|
||||
@@ -259,13 +264,89 @@ export const catalog = pgTable(
|
||||
contact: text("contact").notNull(), // takedown and legal contact
|
||||
visibility: text("visibility").notNull().default("public"), // "public", "private"
|
||||
membership: text("membership").notNull().default("open"), // "open", "approval", "invite"
|
||||
status: text("status").notNull().default("pending"), // "pending", "approved", "rejected"
|
||||
status: text("status").notNull().default("pending"), // "pending", "approved", "rejected", "suspended"
|
||||
statusReason: text("status_reason").notNull().default(""), // why it was rejected or suspended
|
||||
maxRating: text("max_rating").notNull().default("adult"), // the highest rating it hosts: "general", "adult"
|
||||
uploads: text("uploads").notNull().default("anyone"), // who may upload: "anyone", "members", "team"
|
||||
mirrors: text("mirrors").notNull().default("approve"), // mirroring others' revisions: "auto", "approve", "off"
|
||||
keyHash: text("key_hash").notNull(), // sha256 of its key, hex
|
||||
createdAt: createdAt(),
|
||||
updatedAt: updatedAt(),
|
||||
},
|
||||
(t) => [uniqueIndex("catalog_url").on(t.url)],
|
||||
);
|
||||
|
||||
// A role given to a person at a scope (docs/console.md). Hub-wide roles are user.role; owners are derived (a
|
||||
// catalog's owner_id, a product's creator_id), so they're never here.
|
||||
export const roleAssignment = pgTable(
|
||||
"role_assignment",
|
||||
{
|
||||
userId: text("user_id")
|
||||
.notNull()
|
||||
.references(() => user.id, { onDelete: "cascade" }),
|
||||
role: text("role").notNull(), // e.g. "catalog-operator"
|
||||
scopeType: text("scope_type").notNull(), // "catalog"
|
||||
scopeId: text("scope_id").notNull(),
|
||||
grantedBy: text("granted_by").references(() => user.id, { onDelete: "set null" }),
|
||||
createdAt: createdAt(),
|
||||
},
|
||||
(t) => [
|
||||
primaryKey({ columns: [t.userId, t.role, t.scopeType, t.scopeId] }),
|
||||
index("role_assignment_scope").on(t.scopeType, t.scopeId),
|
||||
],
|
||||
);
|
||||
|
||||
// A person's membership of a catalog: asked to join, a member, or banned from it.
|
||||
export const catalogMember = pgTable(
|
||||
"catalog_member",
|
||||
{
|
||||
catalogId: text("catalog_id")
|
||||
.notNull()
|
||||
.references(() => catalog.id, { onDelete: "cascade" }),
|
||||
userId: text("user_id")
|
||||
.notNull()
|
||||
.references(() => user.id, { onDelete: "cascade" }),
|
||||
status: text("status").notNull(), // "requested", "member", "banned"
|
||||
invite: text("invite"), // the invite code they joined with
|
||||
decidedBy: text("decided_by").references(() => user.id, { onDelete: "set null" }),
|
||||
createdAt: createdAt(),
|
||||
updatedAt: updatedAt(),
|
||||
},
|
||||
(t) => [primaryKey({ columns: [t.catalogId, t.userId] }), index("catalog_member_user").on(t.userId)],
|
||||
);
|
||||
|
||||
// An invitation to join a catalog: a code, used up to maxUses times (null: no limit) until it expires.
|
||||
export const catalogInvite = pgTable(
|
||||
"catalog_invite",
|
||||
{
|
||||
code: text("code").primaryKey(),
|
||||
catalogId: text("catalog_id")
|
||||
.notNull()
|
||||
.references(() => catalog.id, { onDelete: "cascade" }),
|
||||
createdBy: text("created_by").references(() => user.id, { onDelete: "set null" }),
|
||||
maxUses: integer("max_uses"),
|
||||
uses: integer("uses").notNull().default(0),
|
||||
expiresAt: timestamp("expires_at", { withTimezone: true }),
|
||||
revokedAt: timestamp("revoked_at", { withTimezone: true }),
|
||||
createdAt: createdAt(),
|
||||
},
|
||||
(t) => [index("catalog_invite_catalog").on(t.catalogId)],
|
||||
);
|
||||
|
||||
// What a catalog must act on (GET /api/v1/catalog/changes): files to delete, revisions to mirror, its status.
|
||||
export const catalogChange = pgTable(
|
||||
"catalog_change",
|
||||
{
|
||||
id: serial("id").primaryKey(),
|
||||
catalogId: text("catalog_id")
|
||||
.notNull()
|
||||
.references(() => catalog.id, { onDelete: "cascade" }),
|
||||
data: jsonb("data").$type<Record<string, unknown>>().notNull(), // {type, ...}
|
||||
createdAt: createdAt(),
|
||||
},
|
||||
(t) => [index("catalog_change_catalog").on(t.catalogId, t.id)],
|
||||
);
|
||||
|
||||
// A product: its info, owned by its creator. Its files are in revisions.
|
||||
export const product = pgTable(
|
||||
"product",
|
||||
|
||||
Reference in new issue
Block a user