latest

db/init-scripts/51-webhooks.sql

@@ -1,31 +1,42 @@
 BEGIN;
   -- Create pg_net extension
   CREATE EXTENSION IF NOT EXISTS pg_net SCHEMA extensions;
+  
   -- Create supabase_functions schema
-  CREATE SCHEMA supabase_functions AUTHORIZATION supabase_admin;
+  CREATE SCHEMA IF NOT EXISTS supabase_functions AUTHORIZATION postgres;
+  
+  -- Grant basic permissions
   GRANT USAGE ON SCHEMA supabase_functions TO postgres, anon, authenticated, service_role;
   ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON TABLES TO postgres, anon, authenticated, service_role;
   ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON FUNCTIONS TO postgres, anon, authenticated, service_role;
   ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON SEQUENCES TO postgres, anon, authenticated, service_role;
+  
   -- supabase_functions.migrations definition
-  CREATE TABLE supabase_functions.migrations (
+  CREATE TABLE IF NOT EXISTS supabase_functions.migrations (
     version text PRIMARY KEY,
     inserted_at timestamptz NOT NULL DEFAULT NOW()
   );
+  
   -- Initial supabase_functions migration
-  INSERT INTO supabase_functions.migrations (version) VALUES ('initial');
+  INSERT INTO supabase_functions.migrations (version) VALUES ('initial') ON CONFLICT DO NOTHING;
+  
   -- supabase_functions.hooks definition
-  CREATE TABLE supabase_functions.hooks (
+  CREATE TABLE IF NOT EXISTS supabase_functions.hooks (
     id bigserial PRIMARY KEY,
     hook_table_id integer NOT NULL,
     hook_name text NOT NULL,
     created_at timestamptz NOT NULL DEFAULT NOW(),
     request_id bigint
   );
-  CREATE INDEX supabase_functions_hooks_request_id_idx ON supabase_functions.hooks USING btree (request_id);
-  CREATE INDEX supabase_functions_hooks_h_table_id_h_name_idx ON supabase_functions.hooks USING btree (hook_table_id, hook_name);
+  
+  -- Create indexes if they don't exist
+  CREATE INDEX IF NOT EXISTS supabase_functions_hooks_request_id_idx ON supabase_functions.hooks USING btree (request_id);
+  CREATE INDEX IF NOT EXISTS supabase_functions_hooks_h_table_id_h_name_idx ON supabase_functions.hooks USING btree (hook_table_id, hook_name);
+  
   COMMENT ON TABLE supabase_functions.hooks IS 'Supabase Functions Hooks: Audit trail for triggered hooks.';
-  CREATE FUNCTION supabase_functions.http_request()
+  
+  -- Create the http_request function
+  CREATE OR REPLACE FUNCTION supabase_functions.http_request()
     RETURNS trigger
     LANGUAGE plpgsql
     AS $function$
@@ -100,109 +111,21 @@ BEGIN;
       RETURN NEW;
     END
   $function$;
-  -- Supabase super admin
-  DO
-  $$
-  BEGIN
-    IF NOT EXISTS (
-      SELECT 1
-      FROM pg_roles
-      WHERE rolname = 'supabase_functions_admin'
-    )
-    THEN
-      CREATE USER supabase_functions_admin NOINHERIT CREATEROLE LOGIN NOREPLICATION;
-    END IF;
-  END
-  $$;
-  GRANT ALL PRIVILEGES ON SCHEMA supabase_functions TO supabase_functions_admin;
-  GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA supabase_functions TO supabase_functions_admin;
-  GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA supabase_functions TO supabase_functions_admin;
-  ALTER USER supabase_functions_admin SET search_path = "supabase_functions";
-  ALTER table "supabase_functions".migrations OWNER TO supabase_functions_admin;
-  ALTER table "supabase_functions".hooks OWNER TO supabase_functions_admin;
-  ALTER function "supabase_functions".http_request() OWNER TO supabase_functions_admin;
-  GRANT supabase_functions_admin TO postgres;
-  -- Remove unused supabase_pg_net_admin role
-  DO
-  $$
-  BEGIN
-    IF EXISTS (
-      SELECT 1
-      FROM pg_roles
-      WHERE rolname = 'supabase_pg_net_admin'
-    )
-    THEN
-      REASSIGN OWNED BY supabase_pg_net_admin TO supabase_admin;
-      DROP OWNED BY supabase_pg_net_admin;
-      DROP ROLE supabase_pg_net_admin;
-    END IF;
-  END
-  $$;
-  -- pg_net grants when extension is already enabled
-  DO
-  $$
-  BEGIN
-    IF EXISTS (
-      SELECT 1
-      FROM pg_extension
-      WHERE extname = 'pg_net'
-    )
-    THEN
-      GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;
-      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
-      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
-      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
-      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
-      REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
-      REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
-      GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
-      GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
-    END IF;
-  END
-  $$;
-  -- Event trigger for pg_net
-  CREATE OR REPLACE FUNCTION extensions.grant_pg_net_access()
-  RETURNS event_trigger
-  LANGUAGE plpgsql
-  AS $$
-  BEGIN
-    IF EXISTS (
-      SELECT 1
-      FROM pg_event_trigger_ddl_commands() AS ev
-      JOIN pg_extension AS ext
-      ON ev.objid = ext.oid
-      WHERE ext.extname = 'pg_net'
-    )
-    THEN
-      GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;
-      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
-      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
-      ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
-      ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
-      REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
-      REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
-      GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
-      GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
-    END IF;
-  END;
-  $$;
-  COMMENT ON FUNCTION extensions.grant_pg_net_access IS 'Grants access to pg_net';
-  DO
-  $$
-  BEGIN
-    IF NOT EXISTS (
-      SELECT 1
-      FROM pg_event_trigger
-      WHERE evtname = 'issue_pg_net_access'
-    ) THEN
-      CREATE EVENT TRIGGER issue_pg_net_access ON ddl_command_end WHEN TAG IN ('CREATE EXTENSION')
-      EXECUTE PROCEDURE extensions.grant_pg_net_access();
-    END IF;
-  END
-  $$;
-  INSERT INTO supabase_functions.migrations (version) VALUES ('20210809183423_update_grants');
-  ALTER function supabase_functions.http_request() SECURITY DEFINER;
-  ALTER function supabase_functions.http_request() SET search_path = supabase_functions;
+  
+  -- Set function properties
+  ALTER FUNCTION supabase_functions.http_request() SECURITY DEFINER;
+  ALTER FUNCTION supabase_functions.http_request() SET search_path = supabase_functions;
+  
+  -- Grant execute permissions
   REVOKE ALL ON FUNCTION supabase_functions.http_request() FROM PUBLIC;
   GRANT EXECUTE ON FUNCTION supabase_functions.http_request() TO postgres, anon, authenticated, service_role;
+  
+  -- Grant pg_net permissions
+  GRANT USAGE ON SCHEMA net TO postgres, anon, authenticated, service_role;
+  GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO postgres, anon, authenticated, service_role;
+  GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO postgres, anon, authenticated, service_role;
+  
+  -- Add migration record
+  INSERT INTO supabase_functions.migrations (version) VALUES ('20210809183423_update_grants') ON CONFLICT DO NOTHING;
+  
 COMMIT;

db/init-scripts/52-jwt.sql

@@ -1,5 +1,6 @@
-\set jwt_secret `echo "$JWT_SECRET"`
-\set jwt_exp `echo "$JWT_EXP"`
+-- Set JWT configuration for the database
+-- These settings will be configured through environment variables in the Supabase setup
 
-ALTER DATABASE postgres SET "app.settings.jwt_secret" TO :'jwt_secret';
-ALTER DATABASE postgres SET "app.settings.jwt_exp" TO :'jwt_exp';
+-- Note: JWT configuration is handled by Supabase's internal configuration
+-- This file is kept for reference but the actual JWT settings are managed
+-- through the Supabase configuration and environment variables

db/init-scripts/52-roles.sql

@@ -1,8 +1,11 @@
 -- NOTE: change to your own passwords for production environments
-\set pgpass `echo "$POSTGRES_PASSWORD"`
+-- Password configuration is handled by Supabase's internal setup
+-- This file is kept for reference but the actual password settings are managed
+-- through the Supabase configuration and environment variables
 
-ALTER USER authenticator WITH PASSWORD :'pgpass';
-ALTER USER pgbouncer WITH PASSWORD :'pgpass';
-ALTER USER supabase_auth_admin WITH PASSWORD :'pgpass';
-ALTER USER supabase_functions_admin WITH PASSWORD :'pgpass';
-ALTER USER supabase_storage_admin WITH PASSWORD :'pgpass';
+-- The following users are created and configured by Supabase automatically:
+-- - authenticator
+-- - pgbouncer  
+-- - supabase_auth_admin
+-- - supabase_functions_admin
+-- - supabase_storage_admin

db/migrations/core/60-create-databases.sql

@@ -1,25 +0,0 @@
--- Create Keycloak schema if it doesn't exist
-create schema if not exists keycloak;
-
--- Create Keycloak user if it doesn't exist
-do $$
-begin
-    if not exists (select 1 from pg_roles where rolname = 'keycloak') then
-        create user keycloak with password 'keycloak';
-    end if;
-end
-$$;
-
--- Grant schema usage and ownership to Keycloak user
-alter schema keycloak owner to keycloak;
-grant usage on schema keycloak to keycloak;
-
--- Grant all privileges on all tables in keycloak schema to keycloak user
-grant all privileges on all tables in schema keycloak to keycloak;
-
--- Grant all privileges on all sequences in keycloak schema to keycloak user
-grant all privileges on all sequences in schema keycloak to keycloak;
-
--- Set default privileges for future tables and sequences
-alter default privileges in schema keycloak grant all on tables to keycloak;
-alter default privileges in schema keycloak grant all on sequences to keycloak; 

db/migrations/core/61-core-schema.sql

@@ -1,7 +1,7 @@
 --[ Database Schema Version ]--
 -- Version: 1.0.0
 -- Last Updated: 2024-02-24
--- Description: Core schema setup for ClassConcepts
+-- Description: Core schema setup for ClassConcepts with neoFS filesystem integration
 -- Dependencies: auth.users (Supabase Auth)
 
 --[ Validation ]--
@@ -47,108 +47,58 @@ begin
 end;
 $$ language plpgsql security definer;
 
+-- Create completed_at trigger function for document artefacts
+create or replace function public.set_completed_at()
+returns trigger as $$
+begin
+    if NEW.status = 'completed' and OLD.status != 'completed' then
+        NEW.completed_at = now();
+    end if;
+    return NEW;
+end;
+$$ language plpgsql security definer;
+
 --[ 5. Core Tables ]--
 -- Base user profiles
 create table if not exists public.profiles (
     id uuid primary key references auth.users(id) on delete cascade,
     email text not null unique,
-    user_type text not null check (user_type in ('admin', 'email_teacher', 'email_student')),
+    user_type text not null check (
+        user_type in (
+            'teacher',
+            'student',
+            'email_teacher',
+            'email_student',
+            'developer',
+            'superadmin'
+        )
+    ),
     username text not null unique,
     full_name text,
     display_name text,
     metadata jsonb default '{}'::jsonb,
+    user_db_name text,
+    school_db_name text,
+    neo4j_sync_status text default 'pending' check (neo4j_sync_status in ('pending', 'ready', 'failed')),
+    neo4j_synced_at timestamp with time zone,
     last_login timestamp with time zone,
     created_at timestamp with time zone default timezone('utc'::text, now()),
     updated_at timestamp with time zone default timezone('utc'::text, now())
 );
 comment on table public.profiles is 'User profiles linked to Supabase auth.users';
-comment on column public.profiles.user_type is 'Type of user: admin, teacher, or student';
-
--- Institute import data
-create table if not exists public.institute_imports (
-    id uuid primary key default uuid_generate_v4(),
-    urn text unique,
-    establishment_name text not null,
-    la_code text,
-    la_name text,
-    establishment_number text,
-    establishment_type text,
-    establishment_type_group text,
-    establishment_status text,
-    reason_establishment_opened text,
-    open_date date,
-    reason_establishment_closed text,
-    close_date date,
-    phase_of_education text,
-    statutory_low_age integer,
-    statutory_high_age integer,
-    boarders text,
-    nursery_provision text,
-    official_sixth_form text,
-    gender text,
-    religious_character text,
-    religious_ethos text,
-    diocese text,
-    admissions_policy text,
-    school_capacity integer,
-    special_classes text,
-    census_date date,
-    number_of_pupils integer,
-    number_of_boys integer,
-    number_of_girls integer,
-    percentage_fsm numeric(5,2),
-    trust_school_flag text,
-    trusts_name text,
-    school_sponsor_flag text,
-    school_sponsors_name text,
-    federation_flag text,
-    federations_name text,
-    ukprn text,
-    fehe_identifier text,
-    further_education_type text,
-    ofsted_last_inspection date,
-    last_changed_date date,
-    street text,
-    locality text,
-    address3 text,
-    town text,
-    county text,
-    postcode text,
-    school_website text,
-    telephone_num text,
-    head_title text,
-    head_first_name text,
-    head_last_name text,
-    head_preferred_job_title text,
-    gssla_code text,
-    parliamentary_constituency text,
-    urban_rural text,
-    rsc_region text,
-    country text,
-    uprn text,
-    sen_stat boolean,
-    sen_no_stat boolean,
-    sen_unit_on_roll integer,
-    sen_unit_capacity integer,
-    resourced_provision_on_roll integer,
-    resourced_provision_capacity integer,
-    metadata jsonb default '{}'::jsonb,
-    imported_at timestamp with time zone default timezone('utc'::text, now()),
-    updated_at timestamp with time zone default timezone('utc'::text, now())
-);
-comment on table public.institute_imports is 'Raw institute data imported from external sources';
+comment on column public.profiles.user_type is 'Type of user: teacher or student';
 
 -- Active institutes
 create table if not exists public.institutes (
     id uuid primary key default uuid_generate_v4(),
-    import_id uuid references public.institute_imports(id),
     name text not null,
     urn text unique,
     status text not null default 'active' check (status in ('active', 'inactive', 'pending')),
     address jsonb default '{}'::jsonb,
     website text,
     metadata jsonb default '{}'::jsonb,
-    neo4j_unique_id text,
+    geo_coordinates jsonb default '{}'::jsonb,
+    neo4j_uuid_string text,
     neo4j_public_sync_status text default 'pending' check (neo4j_public_sync_status in ('pending', 'synced', 'failed')),
     neo4j_public_sync_at timestamp with time zone,
     neo4j_private_sync_status text default 'not_started' check (neo4j_private_sync_status in ('not_started', 'pending', 'synced', 'failed')),
@@ -157,14 +107,104 @@ create table if not exists public.institutes (
     updated_at timestamp with time zone default timezone('utc'::text, now())
 );
 comment on table public.institutes is 'Active institutes in the system';
+comment on column public.institutes.geo_coordinates is 'Geospatial coordinates from OSM search (latitude, longitude, boundingbox)';
 
---[ 6. Relationship Tables ]--
+--[ 6. neoFS Filesystem Tables ]--
+-- File cabinets for organizing files
+create table if not exists public.file_cabinets (
+    id uuid primary key default uuid_generate_v4(),
+    user_id uuid not null references public.profiles(id) on delete cascade,
+    name text not null,
+    created_at timestamp with time zone default timezone('utc'::text, now())
+);
+comment on table public.file_cabinets is 'User file cabinets for organizing documents and files';
+
+-- Files stored in cabinets
+create table if not exists public.files (
+    id uuid primary key default uuid_generate_v4(),
+    cabinet_id uuid not null references public.file_cabinets(id) on delete cascade,
+    name text not null,
+    path text not null,
+    bucket text default 'file-cabinets' not null,
+    created_at timestamp with time zone default timezone('utc'::text, now()),
+    mime_type text,
+    metadata jsonb default '{}'::jsonb,
+    size text,
+    category text generated always as (
+        case
+            when mime_type like 'image/%' then 'image'
+            when mime_type = 'application/pdf' then 'document'
+            when mime_type in ('application/msword', 'application/vnd.openxmlformats-officedocument.wordprocessingml.document') then 'document'
+            when mime_type in ('application/vnd.ms-excel', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet') then 'spreadsheet'
+            when mime_type in ('application/vnd.ms-powerpoint', 'application/vnd.openxmlformats-officedocument.presentationml.presentation') then 'presentation'
+            when mime_type like 'audio/%' then 'audio'
+            when mime_type like 'video/%' then 'video'
+            else 'other'
+        end
+    ) stored
+);
+comment on table public.files is 'Files stored in user cabinets with automatic categorization';
+comment on column public.files.category is 'Automatically determined file category based on MIME type';
+
+-- AI brains for processing files
+create table if not exists public.brains (
+    id uuid primary key default uuid_generate_v4(),
+    user_id uuid not null references public.profiles(id) on delete cascade,
+    name text not null,
+    purpose text,
+    created_at timestamp with time zone default timezone('utc'::text, now())
+);
+comment on table public.brains is 'AI brains for processing and analyzing user files';
+
+-- Brain-file associations
+create table if not exists public.brain_files (
+    brain_id uuid not null references public.brains(id) on delete cascade,
+    file_id uuid not null references public.files(id) on delete cascade,
+    primary key (brain_id, file_id)
+);
+comment on table public.brain_files is 'Associations between AI brains and files for processing';
+
+-- Document artefacts from file processing
+create table if not exists public.document_artefacts (
+    id uuid primary key default uuid_generate_v4(),
+    file_id uuid references public.files(id) on delete cascade,
+    page_number integer default 0 not null,
+    type text not null,
+    rel_path text not null,
+    size_tag text,
+    language text,
+    chunk_index integer,
+    extra jsonb,
+    created_at timestamp with time zone default timezone('utc'::text, now()),
+    status text default 'completed' not null check (status in ('pending', 'processing', 'completed', 'failed')),
+    started_at timestamp with time zone default timezone('utc'::text, now()),
+    completed_at timestamp with time zone,
+    error_message text
+);
+comment on table public.document_artefacts is 'Extracted artefacts from document processing';
+comment on column public.document_artefacts.status is 'Extraction status: pending, processing, completed, or failed';
+comment on column public.document_artefacts.started_at is 'Timestamp when extraction process started';
+comment on column public.document_artefacts.completed_at is 'Timestamp when extraction process completed (success or failure)';
+comment on column public.document_artefacts.error_message is 'Error details if extraction failed';
+
+-- Function execution logs
+create table if not exists public.function_logs (
+    id serial primary key,
+    file_id uuid references public.files(id) on delete cascade,
+    timestamp timestamp with time zone default timezone('utc'::text, now()),
+    step text,
+    message text,
+    data jsonb
+);
+comment on table public.function_logs is 'Logs of function executions and processing steps';
+
+--[ 7. Relationship Tables ]--
 -- Institute memberships
 create table if not exists public.institute_memberships (
     id uuid primary key default uuid_generate_v4(),
     profile_id uuid references public.profiles(id) on delete cascade,
     institute_id uuid references public.institutes(id) on delete cascade,
-    role text not null check (role in ('admin', 'teacher', 'student')),
+    role text not null check (role in ('teacher', 'student')),
     tldraw_preferences jsonb default '{}'::jsonb,
     metadata jsonb default '{}'::jsonb,
     created_at timestamp with time zone default timezone('utc'::text, now()),
@@ -186,7 +226,7 @@ create table if not exists public.institute_membership_requests (
 );
 comment on table public.institute_membership_requests is 'Tracks requests to join institutes';
 
---[ 7. Audit Tables ]--
+--[ 8. Audit Tables ]--
 -- System audit logs
 create table if not exists public.audit_logs (
     id uuid primary key default uuid_generate_v4(),
@@ -197,4 +237,54 @@ create table if not exists public.audit_logs (
     changes jsonb,
     created_at timestamp with time zone default timezone('utc'::text, now())
 );
-comment on table public.audit_logs is 'System-wide audit trail for important operations'; 
+comment on table public.audit_logs is 'System-wide audit trail for important operations';
+
+--[ 9. Indexes ]--
+-- Document artefacts indexes
+create index if not exists idx_document_artefacts_file_status on public.document_artefacts(file_id, status);
+create index if not exists idx_document_artefacts_file_type on public.document_artefacts(file_id, type);
+create index if not exists idx_document_artefacts_status on public.document_artefacts(status);
+
+-- File indexes
+create index if not exists idx_files_cabinet_id on public.files(cabinet_id);
+create index if not exists idx_files_mime_type on public.files(mime_type);
+create index if not exists idx_files_category on public.files(category);
+
+-- Brain indexes
+create index if not exists idx_brains_user_id on public.brains(user_id);
+
+--[ 10. Triggers ]--
+-- Set completed_at when document artefact status changes to completed
+create trigger trigger_set_completed_at
+    before update on public.document_artefacts
+    for each row
+    execute function public.set_completed_at();
+
+-- Set updated_at on profile updates
+create trigger trigger_profiles_updated_at
+    before update on public.profiles
+    for each row
+    execute function public.handle_updated_at();
+
+-- Set updated_at on institute updates
+create trigger trigger_institutes_updated_at
+    before update on public.institutes
+    for each row
+    execute function public.handle_updated_at();
+
+-- Set updated_at on institute_memberships updates
+create trigger trigger_institute_memberships_updated_at
+    before update on public.institute_memberships
+    for each row
+    execute function public.handle_updated_at();
+
+-- Set updated_at on institute_membership_requests updates
+create trigger trigger_institute_membership_requests_updated_at
+    before update on public.institute_memberships
+    for each row
+    execute function public.handle_updated_at();
+
+--[ 11. Additional Indexes ]--
+-- Index for geospatial queries
+create index if not exists idx_institutes_geo_coordinates on public.institutes using gin(geo_coordinates);
+create index if not exists idx_institutes_urn on public.institutes(urn); 

db/migrations/core/62-functions-triggers.sql

@@ -1,6 +1,6 @@
 --[ 8. Auth Functions ]--
 -- Create a secure function to check admin status
-create or replace function auth.is_admin()
+create or replace function public.is_admin()
 returns boolean as $$
   select coalesce(
     (select true
@@ -12,32 +12,24 @@ returns boolean as $$
 $$ language sql security definer;
 
 -- Create a secure function to check super admin status
-create or replace function auth.is_super_admin()
+create or replace function public.is_super_admin()
 returns boolean as $$
   select coalesce(
-    (select role = 'supabase_admin'
-     from auth.users
-     where id = auth.uid()),
+    (select true
+     from public.profiles
+     where id = auth.uid()
+     and user_type = 'admin'),
     false
   );
 $$ language sql security definer;
 
--- Create public wrappers for the auth functions
-create or replace function public.is_admin()
-returns boolean as $$
-  select auth.is_admin();
-$$ language sql security definer;
-
-create or replace function public.is_super_admin()
-returns boolean as $$
-  select auth.is_super_admin();
-$$ language sql security definer;
+-- Create public wrapper functions
+-- Note: These are now the main implementation functions, not wrappers
+-- The original auth schema functions have been moved to public schema
 
 -- Grant execute permissions
 grant execute on function public.is_admin to authenticated;
 grant execute on function public.is_super_admin to authenticated;
-grant execute on function auth.is_admin to authenticated;
-grant execute on function auth.is_super_admin to authenticated;
 
 -- Initial admin setup function
 create or replace function public.setup_initial_admin(admin_email text)
@@ -48,7 +40,7 @@ as $$
 declare
     result json;
 begin
-    -- Only allow this to run as service role or supabase_admin
+    -- Only allow this to run as service role or superuser
     if not (
         current_user = 'service_role' 
         or exists (
@@ -84,7 +76,7 @@ $$;
 
 -- Grant execute permissions
 revoke execute on function public.setup_initial_admin from public;
-grant execute on function public.setup_initial_admin to authenticated, service_role, supabase_admin;
+grant execute on function public.setup_initial_admin to authenticated, service_role;
 
 -- Create RPC wrapper for REST API access
 create or replace function rpc.setup_initial_admin(admin_email text)
@@ -98,7 +90,7 @@ end;
 $$;
 
 -- Grant execute permissions for RPC wrapper
-grant execute on function rpc.setup_initial_admin to authenticated, service_role, supabase_admin;
+grant execute on function rpc.setup_initial_admin to authenticated, service_role;
 
 --[ 9. Utility Functions ]--
 -- Check if database is ready

db/migrations/core/63-storage-policies.sql

@@ -1,50 +1,20 @@
--- Enable RLS on storage.buckets
-alter table if exists storage.buckets enable row level security;
+-- Storage policies configuration for Supabase
+-- Note: Storage bucket policies are managed by Supabase internally
+-- This file provides guidance on what should be configured
 
--- Drop existing policies if they exist
-drop policy if exists "Super admin has full access to buckets" on storage.buckets;
-drop policy if exists "Users can create their own buckets" on storage.buckets;
-drop policy if exists "Users can view their own buckets" on storage.buckets;
+-- Storage bucket policies should be configured through:
+-- 1. Supabase Dashboard > Storage > Policies
+-- 2. Or via SQL with proper permissions (requires service_role or owner access)
 
--- Create new policies with proper permissions
-create policy "Super admin has full access to buckets"
-on storage.buckets for all
-using (
-    current_user = 'service_role' 
-    or current_user = 'supabase_admin' 
-    or exists (
-        select 1 from public.profiles 
-        where id = auth.uid() 
-        and user_type = 'admin'
-    )
-);
+-- Recommended policies for storage.buckets:
+-- - Super admin has full access to buckets
+-- - Users can create their own buckets  
+-- - Users can view their own buckets or public buckets
 
--- Allow authenticated users to create buckets
-create policy "Users can create their own buckets"
-on storage.buckets for insert
-to authenticated
-with check (
-    owner::text = auth.uid()::text
-    or exists (
-        select 1 from public.profiles 
-        where id = auth.uid() 
-        and user_type = 'admin'
-    )
-);
+-- Recommended policies for storage.objects:
+-- - Users can upload to buckets they own
+-- - Users can view objects in public buckets
+-- - Users can manage objects in buckets they own
 
--- Allow users to view buckets they own or public buckets
-create policy "Users can view their own buckets"
-on storage.buckets for select
-to authenticated
-using (
-    owner::text = auth.uid()::text
-    or exists (
-        select 1 from public.profiles 
-        where id = auth.uid() 
-        and user_type = 'admin'
-    )
-);
-
--- Grant necessary permissions
-grant all on storage.buckets to authenticated;
-grant all on storage.objects to authenticated; 
+-- Note: These policies require the service_role or appropriate permissions
+-- to be applied to the storage schema tables 

db/migrations/core/64-initial-admin.sql

@@ -1,31 +1,20 @@
+-- Initial admin setup for ClassroomCopilot
+-- This file handles basic database setup and permissions
+
 -- Ensure uuid-ossp extension is enabled
 create extension if not exists "uuid-ossp" schema extensions;
 
--- Function to set up initial admin
-create or replace function public.setup_initial_admin()
-returns void
-language plpgsql
-security definer
-set search_path = public, extensions
-as $$
-begin
-    -- Check if admin already exists
-    if exists (
-        select 1 from public.profiles 
-        where user_type = 'admin'
-    ) then
-        return;
-    end if;
+-- Grant basic permissions to authenticated users for public schema
+-- Note: These permissions are granted to allow users to work with the application
+grant usage on schema public to authenticated;
+grant all on all tables in schema public to authenticated;
+grant all on all sequences in schema public to authenticated;
+grant all on all functions in schema public to authenticated;
 
-    -- Grant necessary permissions
-    grant all on all tables in schema public to authenticated;
-    grant all on all sequences in schema public to authenticated;
-    grant all on all functions in schema public to authenticated;
-end;
-$$;
+-- Set default privileges for future objects
+alter default privileges in schema public grant all on tables to authenticated;
+alter default privileges in schema public grant all on sequences to authenticated;
+alter default privileges in schema public grant all on functions to authenticated;
 
--- Execute the function
-select public.setup_initial_admin();
-
--- Drop the function after execution
-drop function public.setup_initial_admin(); 
+-- Note: The setup_initial_admin function is defined in 62-functions-triggers.sql
+-- and should be called with an admin email parameter when needed 

db/migrations/core/65-filesystem-augments.sql

@@ -0,0 +1,95 @@
+-- Files table augments and storage GC hooks
+
+-- 1) Add columns to files if missing
+do $$
+begin
+    if not exists (
+        select 1 from information_schema.columns
+        where table_schema='public' and table_name='files' and column_name='uploaded_by'
+    ) then
+        alter table public.files add column uploaded_by uuid references public.profiles(id);
+    end if;
+    if not exists (
+        select 1 from information_schema.columns
+        where table_schema='public' and table_name='files' and column_name='size_bytes'
+    ) then
+        alter table public.files add column size_bytes bigint;
+    end if;
+    if not exists (
+        select 1 from information_schema.columns
+        where table_schema='public' and table_name='files' and column_name='source'
+    ) then
+        alter table public.files add column source text default 'uploader-web';
+    end if;
+end $$;
+
+-- 2) Unique index for cabinet/path combo
+create unique index if not exists uq_files_cabinet_path on public.files(cabinet_id, path);
+
+-- 3) Storage GC helpers (ported from neoFS with storage schema)
+create or replace function public._delete_storage_objects(p_bucket text, p_path text)
+returns void
+language plpgsql security definer
+set search_path to 'public', 'storage'
+as $$
+begin
+  if p_bucket is null or p_path is null then
+    return;
+  end if;
+  delete from storage.objects where bucket_id = p_bucket and name = p_path;
+  delete from storage.objects where bucket_id = p_bucket and name like p_path || '/%';
+end
+$$;
+
+create or replace function public._storage_gc_sql()
+returns trigger
+language plpgsql security definer
+set search_path to 'public', 'storage'
+as $$
+begin
+  if tg_op = 'DELETE' then
+    perform public._delete_storage_objects(old.bucket, old.path);
+  elsif tg_op = 'UPDATE' then
+    if (old.bucket is distinct from new.bucket) or (old.path is distinct from new.path) then
+      perform public._delete_storage_objects(old.bucket, old.path);
+    end if;
+  end if;
+  return null;
+end
+$$;
+
+-- 4) Attach GC trigger to files bucket/path changes
+drop trigger if exists trg_files_gc on public.files;
+create trigger trg_files_gc
+after delete or update of bucket, path on public.files
+for each row execute function public._storage_gc_sql();
+
+-- 5) Document artefacts GC: remove artefact objects from storage when rows change/delete
+create or replace function public._artefact_gc_sql()
+returns trigger
+language plpgsql security definer
+set search_path to 'public', 'storage'
+as $$
+declare
+  v_bucket text;
+begin
+  if tg_op = 'DELETE' then
+    select f.bucket into v_bucket from public.files f where f.id = old.file_id;
+    perform public._delete_storage_objects(v_bucket, old.rel_path);
+    return old;
+  elsif tg_op = 'UPDATE' then
+    if (old.rel_path is distinct from new.rel_path) or (old.file_id is distinct from new.file_id) then
+      select f.bucket into v_bucket from public.files f where f.id = old.file_id;
+      perform public._delete_storage_objects(v_bucket, old.rel_path);
+    end if;
+    return new;
+  end if;
+end
+$$;
+
+drop trigger if exists trg_document_artefacts_gc on public.document_artefacts;
+create trigger trg_document_artefacts_gc
+before delete or update of file_id, rel_path on public.document_artefacts
+for each row execute function public._artefact_gc_sql();
+
+

db/migrations/core/65-keycloak-setup.sql

@@ -1,23 +0,0 @@
--- Create Keycloak user if it doesn't exist
-DO $$
-BEGIN
-    IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'keycloak') THEN
-        CREATE USER keycloak WITH PASSWORD 'keycloak';
-    END IF;
-END
-$$;
-
--- Create Keycloak schema if it doesn't exist
-CREATE SCHEMA IF NOT EXISTS keycloak;
-
--- Grant necessary permissions
-GRANT USAGE ON SCHEMA keycloak TO keycloak;
-GRANT ALL ON ALL TABLES IN SCHEMA keycloak TO keycloak;
-GRANT ALL ON ALL SEQUENCES IN SCHEMA keycloak TO keycloak;
-
--- Set default privileges for future tables
-ALTER DEFAULT PRIVILEGES IN SCHEMA keycloak GRANT ALL ON TABLES TO keycloak;
-ALTER DEFAULT PRIVILEGES IN SCHEMA keycloak GRANT ALL ON SEQUENCES TO keycloak;
-
--- Grant connect permission to the database
-GRANT CONNECT ON DATABASE postgres TO keycloak; 

db/migrations/core/66-rls-policies.sql

@@ -0,0 +1,84 @@
+-- Enable RLS and define policies for filesystem tables
+
+-- 1) Enable RLS
+alter table if exists public.file_cabinets enable row level security;
+alter table if exists public.files enable row level security;
+alter table if exists public.brain_files enable row level security;
+alter table if exists public.document_artefacts enable row level security;
+
+drop policy if exists "User can access own cabinets" on public.file_cabinets;
+create policy "User can access own cabinets" on public.file_cabinets
+using (user_id = auth.uid())
+with check (user_id = auth.uid());
+
+drop policy if exists "User can access files in own cabinet" on public.files;
+create policy "User can access files in own cabinet" on public.files
+using (exists (
+  select 1 from public.file_cabinets c
+  where c.id = files.cabinet_id and c.user_id = auth.uid()
+))
+with check (exists (
+  select 1 from public.file_cabinets c
+  where c.id = files.cabinet_id and c.user_id = auth.uid()
+));
+
+drop policy if exists "User can insert files into own cabinet" on public.files;
+create policy "User can insert files into own cabinet" on public.files for insert to authenticated
+with check (exists (
+  select 1 from public.file_cabinets c
+  where c.id = files.cabinet_id and c.user_id = auth.uid()
+));
+
+drop policy if exists "User can update files in own cabinet" on public.files;
+create policy "User can update files in own cabinet" on public.files for update to authenticated
+using (exists (
+  select 1 from public.file_cabinets c
+  where c.id = files.cabinet_id and c.user_id = auth.uid()
+))
+with check (exists (
+  select 1 from public.file_cabinets c
+  where c.id = files.cabinet_id and c.user_id = auth.uid()
+));
+
+drop policy if exists "User can delete files from own cabinet" on public.files;
+create policy "User can delete files from own cabinet" on public.files for delete
+using (exists (
+  select 1 from public.file_cabinets c
+  where c.id = files.cabinet_id and c.user_id = auth.uid()
+));
+
+-- 4) Brain-files: allow linking owned files to owned brains
+drop policy if exists "User can link files they own to their brains" on public.brain_files;
+create policy "User can link files they own to their brains" on public.brain_files
+using (
+  exists (select 1 from public.brains b where b.id = brain_files.brain_id and b.user_id = auth.uid())
+  and exists (
+    select 1 from public.files f join public.file_cabinets c on f.cabinet_id = c.id
+    where f.id = brain_files.file_id and c.user_id = auth.uid()
+  )
+)
+with check (true);
+
+-- 5) Document artefacts: allow reads to owners via file cabinet, writes via service_role
+drop policy if exists "artefacts_read_by_owner" on public.document_artefacts;
+create policy "artefacts_read_by_owner" on public.document_artefacts for select to authenticated
+using (exists (
+  select 1 from public.files f join public.file_cabinets c on f.cabinet_id = c.id
+  where f.id = document_artefacts.file_id and c.user_id = auth.uid()
+));
+
+drop policy if exists "artefacts_rw_service" on public.document_artefacts;
+create policy "artefacts_rw_service" on public.document_artefacts to service_role
+using (true) with check (true);
+
+-- Allow owners to delete their artefacts (needed for cascades under RLS)
+drop policy if exists "artefacts_delete_by_owner" on public.document_artefacts;
+create policy "artefacts_delete_by_owner" on public.document_artefacts for delete to authenticated
+using (exists (
+  select 1 from public.files f join public.file_cabinets c on f.cabinet_id = c.id
+  where f.id = document_artefacts.file_id and c.user_id = auth.uid()
+));
+
+-- File vectors RLS and policies are defined in 67-vectors.sql after the table is created
+
+

db/migrations/core/67-vectors.sql

@@ -0,0 +1,79 @@
+-- Vectors: file_vectors table and similarity search function
+
+-- 1) Ensure pgvector extension is available
+create extension if not exists vector;
+
+-- 2) File vectors table
+create table if not exists public.file_vectors (
+    id bigint generated by default as identity primary key,
+    created_at timestamp with time zone default now() not null,
+    embedding public.vector,
+    metadata jsonb,
+    content text
+);
+
+-- 3) ANN index (skipped until embedding dimension is fixed)
+-- To enable: set column type to public.vector(<dim>) and uncomment:
+-- create index if not exists file_vectors_embedding_idx
+-- on public.file_vectors using ivfflat (embedding public.vector_cosine_ops)
+-- with (lists='100');
+
+-- 3b) Enable RLS and set policies (moved here to avoid ordering issues)
+alter table if exists public.file_vectors enable row level security;
+
+drop policy if exists "vectors_read_by_owner" on public.file_vectors;
+create policy "vectors_read_by_owner" on public.file_vectors for select to authenticated
+using (coalesce((metadata->>'file_id')::uuid, null) is null or exists (
+  select 1 from public.files f join public.file_cabinets c on f.cabinet_id = c.id
+  where f.id = (metadata->>'file_id')::uuid and c.user_id = auth.uid()
+));
+
+drop policy if exists "vectors_rw_service" on public.file_vectors;
+create policy "vectors_rw_service" on public.file_vectors to service_role
+using (true) with check (true);
+
+-- 4) Match function mirrored from neoFS (generic metadata mapping)
+create or replace function public.match_file_vectors(
+    filter jsonb,
+    match_count integer,
+    query_embedding public.vector
+)
+returns table (
+    id bigint,
+    file_id uuid,
+    cabinet_id uuid,
+    artefact_type text,
+    artefact_is text,
+    original_path_prefix text,
+    original_filename text,
+    content text,
+    metadata jsonb,
+    similarity double precision
+)
+language sql stable as $$
+  select
+    fv.id,
+    nullif(fv.metadata->>'file_id','')::uuid              as file_id,
+    nullif(fv.metadata->>'cabinet_id','')::uuid           as cabinet_id,
+    nullif(fv.metadata->>'artefact_type','')              as artefact_type,
+    nullif(fv.metadata->>'artefact_is','')                as artefact_is,
+    nullif(fv.metadata->>'original_path_prefix','')       as original_path_prefix,
+    nullif(fv.metadata->>'original_filename','')          as original_filename,
+    fv.content,
+    fv.metadata,
+    1 - (fv.embedding <=> query_embedding)                as similarity
+  from public.file_vectors fv
+  where
+    (coalesce(filter ? 'file_id', false)                = false or (fv.metadata->>'file_id')::uuid              = (filter->>'file_id')::uuid)
+    and (coalesce(filter ? 'cabinet_id', false)         = false or (fv.metadata->>'cabinet_id')::uuid           = (filter->>'cabinet_id')::uuid)
+    and (coalesce(filter ? 'artefact_type', false)      = false or (fv.metadata->>'artefact_type')              = (filter->>'artefact_type'))
+    and (coalesce(filter ? 'artefact_id', false)        = false or (fv.metadata->>'artefact_id')                = (filter->>'artefact_id'))
+    and (coalesce(filter ? 'original_path_prefix', false)     = false or (fv.metadata->>'original_path_prefix') like  (filter->>'original_path_prefix') || '%')
+    and (coalesce(filter ? 'original_path_prefix_ilike', false)= false or (fv.metadata->>'original_path_prefix') ilike (filter->>'original_path_prefix_ilike') || '%')
+    and (coalesce(filter ? 'original_filename', false)   = false or (fv.metadata->>'original_filename')         = (filter->>'original_filename'))
+    and (coalesce(filter ? 'original_filename_ilike', false)= false or (fv.metadata->>'original_filename') ilike (filter->>'original_filename_ilike'))
+  order by fv.embedding <=> query_embedding
+  limit greatest(coalesce(match_count, 10), 1)
+$$;
+
+

db/migrations/core/68-cabinet-memberships.sql

@@ -0,0 +1,73 @@
+-- Cabinet memberships for sharing access
+
+create table if not exists public.cabinet_memberships (
+    id uuid default uuid_generate_v4() primary key,
+    cabinet_id uuid not null references public.file_cabinets(id) on delete cascade,
+    profile_id uuid not null references public.profiles(id) on delete cascade,
+    role text not null check (role in ('owner','editor','viewer')),
+    created_at timestamp with time zone default timezone('utc'::text, now()),
+    updated_at timestamp with time zone default timezone('utc'::text, now()),
+    unique(cabinet_id, profile_id)
+);
+
+create index if not exists idx_cabinet_memberships_cabinet on public.cabinet_memberships(cabinet_id);
+create index if not exists idx_cabinet_memberships_profile on public.cabinet_memberships(profile_id);
+
+-- Updated at trigger
+drop trigger if exists trg_cabinet_memberships_updated_at on public.cabinet_memberships;
+create trigger trg_cabinet_memberships_updated_at
+    before update on public.cabinet_memberships
+    for each row execute function public.handle_updated_at();
+
+-- RLS and policies
+alter table if exists public.cabinet_memberships enable row level security;
+
+-- Members can select their own memberships; cabinet owners can also see memberships
+drop policy if exists cm_read_self_or_owner on public.cabinet_memberships;
+create policy cm_read_self_or_owner on public.cabinet_memberships for select to authenticated
+using (
+  profile_id = auth.uid() or exists (
+    select 1 from public.file_cabinets c where c.id = cabinet_memberships.cabinet_id and c.user_id = auth.uid()
+  )
+);
+
+-- Cabinet owners can insert memberships
+drop policy if exists cm_insert_by_owner on public.cabinet_memberships;
+create policy cm_insert_by_owner on public.cabinet_memberships for insert to authenticated
+with check (exists (
+  select 1 from public.file_cabinets c where c.id = cabinet_memberships.cabinet_id and c.user_id = auth.uid()
+));
+
+-- Cabinet owners can update memberships (e.g., role)
+drop policy if exists cm_update_by_owner on public.cabinet_memberships;
+create policy cm_update_by_owner on public.cabinet_memberships for update to authenticated
+using (exists (
+  select 1 from public.file_cabinets c where c.id = cabinet_memberships.cabinet_id and c.user_id = auth.uid()
+))
+with check (exists (
+  select 1 from public.file_cabinets c where c.id = cabinet_memberships.cabinet_id and c.user_id = auth.uid()
+));
+
+-- Cabinet owners can delete memberships
+drop policy if exists cm_delete_by_owner on public.cabinet_memberships;
+create policy cm_delete_by_owner on public.cabinet_memberships for delete to authenticated
+using (exists (
+  select 1 from public.file_cabinets c where c.id = cabinet_memberships.cabinet_id and c.user_id = auth.uid()
+));
+
+-- Extend access to cabinets/files for members (after table exists)
+drop policy if exists "User can access cabinets via membership" on public.file_cabinets;
+create policy "User can access cabinets via membership" on public.file_cabinets for select to authenticated
+using (exists (
+  select 1 from public.cabinet_memberships m
+  where m.cabinet_id = file_cabinets.id and m.profile_id = auth.uid()
+));
+
+drop policy if exists "User can access files via membership" on public.files;
+create policy "User can access files via membership" on public.files for select to authenticated
+using (exists (
+  select 1 from public.cabinet_memberships m
+  where m.cabinet_id = files.cabinet_id and m.profile_id = auth.uid()
+));
+
+

db/migrations/core/69-gc-prefix-cleanup.sql

@@ -0,0 +1,48 @@
+-- Ensure storage objects for all artefacts are removed when a file is deleted
+-- by deleting the entire "cabinet_id/file_id" directory prefix in Storage.
+
+-- Helper to delete all objects under a prefix
+create or replace function public._delete_storage_prefix(p_bucket text, p_prefix text)
+returns void
+language plpgsql security definer
+set search_path to 'public', 'storage'
+as $$
+begin
+  if p_bucket is null or p_prefix is null then
+    return;
+  end if;
+  -- Delete any objects whose name starts with the prefix + '/'
+  delete from storage.objects where bucket_id = p_bucket and name like p_prefix || '/%';
+  -- In case an object exists exactly at the prefix (rare but safe)
+  delete from storage.objects where bucket_id = p_bucket and name = p_prefix;
+end
+$$;
+
+-- Update file-level GC to also delete the parent directory prefix (cabinet_id/file_id)
+create or replace function public._storage_gc_sql()
+returns trigger
+language plpgsql security definer
+set search_path to 'public', 'storage'
+as $$
+declare
+  v_prefix text;
+begin
+  -- Derive directory prefix from the file path by removing the last segment (filename)
+  -- Example: 'cabinet_id/file_id/filename.ext' -> 'cabinet_id/file_id'
+  v_prefix := regexp_replace(old.path, '/[^/]+$', '');
+
+  if tg_op = 'DELETE' then
+    -- Delete the original object and any artefacts under the file's directory
+    perform public._delete_storage_objects(old.bucket, old.path);
+    perform public._delete_storage_prefix(old.bucket, v_prefix);
+  elsif tg_op = 'UPDATE' then
+    if (old.bucket is distinct from new.bucket) or (old.path is distinct from new.path) then
+      perform public._delete_storage_objects(old.bucket, old.path);
+      perform public._delete_storage_prefix(old.bucket, v_prefix);
+    end if;
+  end if;
+  return null;
+end
+$$;
+
+

db/migrations/core/70_add_directory_support.sql

@@ -0,0 +1,41 @@
+-- Add directory support to files table
+-- Migration: Add directory support for folder uploads
+
+-- Add new columns to files table
+ALTER TABLE files 
+ADD COLUMN IF NOT EXISTS is_directory BOOLEAN DEFAULT FALSE,
+ADD COLUMN IF NOT EXISTS parent_directory_id UUID REFERENCES files(id) ON DELETE CASCADE,
+ADD COLUMN IF NOT EXISTS relative_path TEXT,
+ADD COLUMN IF NOT EXISTS directory_manifest JSONB,
+ADD COLUMN IF NOT EXISTS upload_session_id UUID,
+ADD COLUMN IF NOT EXISTS processing_status TEXT DEFAULT 'uploaded' CHECK (processing_status IN ('uploaded', 'processing', 'completed', 'failed', 'queued'));
+
+-- Create index for efficient directory queries
+CREATE INDEX IF NOT EXISTS idx_files_parent_directory ON files(parent_directory_id);
+CREATE INDEX IF NOT EXISTS idx_files_upload_session ON files(upload_session_id);
+CREATE INDEX IF NOT EXISTS idx_files_processing_status ON files(processing_status);
+CREATE INDEX IF NOT EXISTS idx_files_is_directory ON files(is_directory);
+
+-- Create directory manifest structure
+COMMENT ON COLUMN files.is_directory IS 'True if this record represents a directory/folder';
+COMMENT ON COLUMN files.parent_directory_id IS 'ID of parent directory if this file is inside an uploaded folder';
+COMMENT ON COLUMN files.relative_path IS 'Relative path within the uploaded directory structure';
+COMMENT ON COLUMN files.directory_manifest IS 'JSON manifest of directory contents including file count, total size, structure';
+COMMENT ON COLUMN files.upload_session_id IS 'Groups files uploaded together in a single directory upload session';
+COMMENT ON COLUMN files.processing_status IS 'Simple status tracking without auto-processing';
+
+-- Example directory_manifest structure:
+-- {
+--   "total_files": 15,
+--   "total_size_bytes": 12345678,
+--   "directory_structure": {
+--     "documents/": {
+--       "file1.pdf": {"size": 123456, "mime_type": "application/pdf"},
+--       "subdirectory/": {
+--         "file2.docx": {"size": 234567, "mime_type": "application/vnd.openxmlformats-officedocument.wordprocessingml.document"}
+--       }
+--     }
+--   },
+--   "upload_timestamp": "2024-09-23T12:00:00Z",
+--   "upload_method": "directory_picker"
+-- }

db/migrations/supabase/50-_supabase.sql

@@ -1,3 +1,7 @@
-\set pguser `echo "$POSTGRES_USER"`
+-- Create _supabase database for internal Supabase operations
+-- This database is created automatically by Supabase's internal setup
+-- This file is kept for reference but the actual database creation is managed
+-- through the Supabase configuration and environment variables
 
-CREATE DATABASE _supabase WITH OWNER :pguser;
+-- Note: The _supabase database is created with the postgres user as owner
+-- by default during Supabase initialization

db/migrations/supabase/52-logs.sql

@@ -1,5 +1,7 @@
-\set pguser `echo "$POSTGRES_USER"`
+-- Create _analytics schema for Supabase analytics
+-- This schema is created automatically by Supabase's internal setup
+-- This file is kept for reference but the actual schema creation is managed
+-- through the Supabase configuration and environment variables
 
-\c _supabase
-create schema if not exists _analytics;
-alter schema _analytics owner to :pguser;
+-- Note: The _analytics schema is created in the _supabase database
+-- with appropriate ownership during Supabase initialization

db/migrations/supabase/52-pooler.sql

@@ -1,5 +1,7 @@
-\set pguser `echo "$POSTGRES_USER"`
+-- Create _supavisor schema for Supabase connection pooling
+-- This schema is created automatically by Supabase's internal setup
+-- This file is kept for reference but the actual schema creation is managed
+-- through the Supabase configuration and environment variables
 
-\c _supabase
-create schema if not exists _supavisor;
-alter schema _supavisor owner to :pguser;
+-- Note: The _supavisor schema is created in the _supabase database
+-- with appropriate ownership during Supabase initialization

db/migrations/supabase/52-realtime.sql

@@ -1,4 +1,7 @@
-\set pguser `echo "$POSTGRES_USER"`
+-- Create _realtime schema for Supabase realtime functionality
+-- This schema is created automatically by Supabase's internal setup
+-- This file is kept for reference but the actual schema creation is managed
+-- through the Supabase configuration and environment variables
 
-create schema if not exists _realtime;
-alter schema _realtime owner to :pguser;
+-- Note: The _realtime schema is created with appropriate ownership
+-- during Supabase initialization