Initial commit
This commit is contained in:
Kevin Carter
@@ -0,0 +1,208 @@
|
||||
BEGIN;
|
||||
-- Create pg_net extension
|
||||
CREATE EXTENSION IF NOT EXISTS pg_net SCHEMA extensions;
|
||||
-- Create supabase_functions schema
|
||||
CREATE SCHEMA supabase_functions AUTHORIZATION supabase_admin;
|
||||
GRANT USAGE ON SCHEMA supabase_functions TO postgres, anon, authenticated, service_role;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON TABLES TO postgres, anon, authenticated, service_role;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON FUNCTIONS TO postgres, anon, authenticated, service_role;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA supabase_functions GRANT ALL ON SEQUENCES TO postgres, anon, authenticated, service_role;
|
||||
-- supabase_functions.migrations definition
|
||||
CREATE TABLE supabase_functions.migrations (
|
||||
version text PRIMARY KEY,
|
||||
inserted_at timestamptz NOT NULL DEFAULT NOW()
|
||||
);
|
||||
-- Initial supabase_functions migration
|
||||
INSERT INTO supabase_functions.migrations (version) VALUES ('initial');
|
||||
-- supabase_functions.hooks definition
|
||||
CREATE TABLE supabase_functions.hooks (
|
||||
id bigserial PRIMARY KEY,
|
||||
hook_table_id integer NOT NULL,
|
||||
hook_name text NOT NULL,
|
||||
created_at timestamptz NOT NULL DEFAULT NOW(),
|
||||
request_id bigint
|
||||
);
|
||||
CREATE INDEX supabase_functions_hooks_request_id_idx ON supabase_functions.hooks USING btree (request_id);
|
||||
CREATE INDEX supabase_functions_hooks_h_table_id_h_name_idx ON supabase_functions.hooks USING btree (hook_table_id, hook_name);
|
||||
COMMENT ON TABLE supabase_functions.hooks IS 'Supabase Functions Hooks: Audit trail for triggered hooks.';
|
||||
CREATE FUNCTION supabase_functions.http_request()
|
||||
RETURNS trigger
|
||||
LANGUAGE plpgsql
|
||||
AS $function$
|
||||
DECLARE
|
||||
request_id bigint;
|
||||
payload jsonb;
|
||||
url text := TG_ARGV[0]::text;
|
||||
method text := TG_ARGV[1]::text;
|
||||
headers jsonb DEFAULT '{}'::jsonb;
|
||||
params jsonb DEFAULT '{}'::jsonb;
|
||||
timeout_ms integer DEFAULT 1000;
|
||||
BEGIN
|
||||
IF url IS NULL OR url = 'null' THEN
|
||||
RAISE EXCEPTION 'url argument is missing';
|
||||
END IF;
|
||||
|
||||
IF method IS NULL OR method = 'null' THEN
|
||||
RAISE EXCEPTION 'method argument is missing';
|
||||
END IF;
|
||||
|
||||
IF TG_ARGV[2] IS NULL OR TG_ARGV[2] = 'null' THEN
|
||||
headers = '{"Content-Type": "application/json"}'::jsonb;
|
||||
ELSE
|
||||
headers = TG_ARGV[2]::jsonb;
|
||||
END IF;
|
||||
|
||||
IF TG_ARGV[3] IS NULL OR TG_ARGV[3] = 'null' THEN
|
||||
params = '{}'::jsonb;
|
||||
ELSE
|
||||
params = TG_ARGV[3]::jsonb;
|
||||
END IF;
|
||||
|
||||
IF TG_ARGV[4] IS NULL OR TG_ARGV[4] = 'null' THEN
|
||||
timeout_ms = 1000;
|
||||
ELSE
|
||||
timeout_ms = TG_ARGV[4]::integer;
|
||||
END IF;
|
||||
|
||||
CASE
|
||||
WHEN method = 'GET' THEN
|
||||
SELECT http_get INTO request_id FROM net.http_get(
|
||||
url,
|
||||
params,
|
||||
headers,
|
||||
timeout_ms
|
||||
);
|
||||
WHEN method = 'POST' THEN
|
||||
payload = jsonb_build_object(
|
||||
'old_record', OLD,
|
||||
'record', NEW,
|
||||
'type', TG_OP,
|
||||
'table', TG_TABLE_NAME,
|
||||
'schema', TG_TABLE_SCHEMA
|
||||
);
|
||||
|
||||
SELECT http_post INTO request_id FROM net.http_post(
|
||||
url,
|
||||
payload,
|
||||
params,
|
||||
headers,
|
||||
timeout_ms
|
||||
);
|
||||
ELSE
|
||||
RAISE EXCEPTION 'method argument % is invalid', method;
|
||||
END CASE;
|
||||
|
||||
INSERT INTO supabase_functions.hooks
|
||||
(hook_table_id, hook_name, request_id)
|
||||
VALUES
|
||||
(TG_RELID, TG_NAME, request_id);
|
||||
|
||||
RETURN NEW;
|
||||
END
|
||||
$function$;
|
||||
-- Supabase super admin
|
||||
DO
|
||||
$$
|
||||
BEGIN
|
||||
IF NOT EXISTS (
|
||||
SELECT 1
|
||||
FROM pg_roles
|
||||
WHERE rolname = 'supabase_functions_admin'
|
||||
)
|
||||
THEN
|
||||
CREATE USER supabase_functions_admin NOINHERIT CREATEROLE LOGIN NOREPLICATION;
|
||||
END IF;
|
||||
END
|
||||
$$;
|
||||
GRANT ALL PRIVILEGES ON SCHEMA supabase_functions TO supabase_functions_admin;
|
||||
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA supabase_functions TO supabase_functions_admin;
|
||||
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA supabase_functions TO supabase_functions_admin;
|
||||
ALTER USER supabase_functions_admin SET search_path = "supabase_functions";
|
||||
ALTER table "supabase_functions".migrations OWNER TO supabase_functions_admin;
|
||||
ALTER table "supabase_functions".hooks OWNER TO supabase_functions_admin;
|
||||
ALTER function "supabase_functions".http_request() OWNER TO supabase_functions_admin;
|
||||
GRANT supabase_functions_admin TO postgres;
|
||||
-- Remove unused supabase_pg_net_admin role
|
||||
DO
|
||||
$$
|
||||
BEGIN
|
||||
IF EXISTS (
|
||||
SELECT 1
|
||||
FROM pg_roles
|
||||
WHERE rolname = 'supabase_pg_net_admin'
|
||||
)
|
||||
THEN
|
||||
REASSIGN OWNED BY supabase_pg_net_admin TO supabase_admin;
|
||||
DROP OWNED BY supabase_pg_net_admin;
|
||||
DROP ROLE supabase_pg_net_admin;
|
||||
END IF;
|
||||
END
|
||||
$$;
|
||||
-- pg_net grants when extension is already enabled
|
||||
DO
|
||||
$$
|
||||
BEGIN
|
||||
IF EXISTS (
|
||||
SELECT 1
|
||||
FROM pg_extension
|
||||
WHERE extname = 'pg_net'
|
||||
)
|
||||
THEN
|
||||
GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;
|
||||
ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
|
||||
ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
|
||||
ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
|
||||
ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
|
||||
REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
|
||||
REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
|
||||
GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
|
||||
GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
|
||||
END IF;
|
||||
END
|
||||
$$;
|
||||
-- Event trigger for pg_net
|
||||
CREATE OR REPLACE FUNCTION extensions.grant_pg_net_access()
|
||||
RETURNS event_trigger
|
||||
LANGUAGE plpgsql
|
||||
AS $$
|
||||
BEGIN
|
||||
IF EXISTS (
|
||||
SELECT 1
|
||||
FROM pg_event_trigger_ddl_commands() AS ev
|
||||
JOIN pg_extension AS ext
|
||||
ON ev.objid = ext.oid
|
||||
WHERE ext.extname = 'pg_net'
|
||||
)
|
||||
THEN
|
||||
GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role;
|
||||
ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
|
||||
ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER;
|
||||
ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
|
||||
ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net;
|
||||
REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
|
||||
REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC;
|
||||
GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
|
||||
GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role;
|
||||
END IF;
|
||||
END;
|
||||
$$;
|
||||
COMMENT ON FUNCTION extensions.grant_pg_net_access IS 'Grants access to pg_net';
|
||||
DO
|
||||
$$
|
||||
BEGIN
|
||||
IF NOT EXISTS (
|
||||
SELECT 1
|
||||
FROM pg_event_trigger
|
||||
WHERE evtname = 'issue_pg_net_access'
|
||||
) THEN
|
||||
CREATE EVENT TRIGGER issue_pg_net_access ON ddl_command_end WHEN TAG IN ('CREATE EXTENSION')
|
||||
EXECUTE PROCEDURE extensions.grant_pg_net_access();
|
||||
END IF;
|
||||
END
|
||||
$$;
|
||||
INSERT INTO supabase_functions.migrations (version) VALUES ('20210809183423_update_grants');
|
||||
ALTER function supabase_functions.http_request() SECURITY DEFINER;
|
||||
ALTER function supabase_functions.http_request() SET search_path = supabase_functions;
|
||||
REVOKE ALL ON FUNCTION supabase_functions.http_request() FROM PUBLIC;
|
||||
GRANT EXECUTE ON FUNCTION supabase_functions.http_request() TO postgres, anon, authenticated, service_role;
|
||||
COMMIT;
|
||||
@@ -0,0 +1,5 @@
|
||||
\set jwt_secret `echo "$JWT_SECRET"`
|
||||
\set jwt_exp `echo "$JWT_EXP"`
|
||||
|
||||
ALTER DATABASE postgres SET "app.settings.jwt_secret" TO :'jwt_secret';
|
||||
ALTER DATABASE postgres SET "app.settings.jwt_exp" TO :'jwt_exp';
|
||||
@@ -0,0 +1,8 @@
|
||||
-- NOTE: change to your own passwords for production environments
|
||||
\set pgpass `echo "$POSTGRES_PASSWORD"`
|
||||
|
||||
ALTER USER authenticator WITH PASSWORD :'pgpass';
|
||||
ALTER USER pgbouncer WITH PASSWORD :'pgpass';
|
||||
ALTER USER supabase_auth_admin WITH PASSWORD :'pgpass';
|
||||
ALTER USER supabase_functions_admin WITH PASSWORD :'pgpass';
|
||||
ALTER USER supabase_storage_admin WITH PASSWORD :'pgpass';
|
||||
@@ -0,0 +1,25 @@
|
||||
-- Create Keycloak schema if it doesn't exist
|
||||
create schema if not exists keycloak;
|
||||
|
||||
-- Create Keycloak user if it doesn't exist
|
||||
do $$
|
||||
begin
|
||||
if not exists (select 1 from pg_roles where rolname = 'keycloak') then
|
||||
create user keycloak with password 'keycloak';
|
||||
end if;
|
||||
end
|
||||
$$;
|
||||
|
||||
-- Grant schema usage and ownership to Keycloak user
|
||||
alter schema keycloak owner to keycloak;
|
||||
grant usage on schema keycloak to keycloak;
|
||||
|
||||
-- Grant all privileges on all tables in keycloak schema to keycloak user
|
||||
grant all privileges on all tables in schema keycloak to keycloak;
|
||||
|
||||
-- Grant all privileges on all sequences in keycloak schema to keycloak user
|
||||
grant all privileges on all sequences in schema keycloak to keycloak;
|
||||
|
||||
-- Set default privileges for future tables and sequences
|
||||
alter default privileges in schema keycloak grant all on tables to keycloak;
|
||||
alter default privileges in schema keycloak grant all on sequences to keycloak;
|
||||
@@ -0,0 +1,200 @@
|
||||
--[ Database Schema Version ]--
|
||||
-- Version: 1.0.0
|
||||
-- Last Updated: 2024-02-24
|
||||
-- Description: Core schema setup for ClassConcepts
|
||||
-- Dependencies: auth.users (Supabase Auth)
|
||||
|
||||
--[ Validation ]--
|
||||
do $$
|
||||
begin
|
||||
-- Verify required extensions
|
||||
if not exists (select 1 from pg_extension where extname = 'uuid-ossp') then
|
||||
raise exception 'Required extension uuid-ossp is not installed';
|
||||
end if;
|
||||
|
||||
-- Verify auth schema exists
|
||||
if not exists (select 1 from information_schema.schemata where schema_name = 'auth') then
|
||||
raise exception 'Required auth schema is not available';
|
||||
end if;
|
||||
|
||||
-- Verify storage schema exists
|
||||
if not exists (select 1 from information_schema.schemata where schema_name = 'storage') then
|
||||
raise exception 'Required storage schema is not available';
|
||||
end if;
|
||||
end $$;
|
||||
|
||||
--[ 1. Extensions ]--
|
||||
create extension if not exists "uuid-ossp";
|
||||
|
||||
-- Create rpc schema if it doesn't exist
|
||||
create schema if not exists rpc;
|
||||
grant usage on schema rpc to anon, authenticated;
|
||||
|
||||
-- Create exec_sql function for admin operations
|
||||
create or replace function exec_sql(query text)
|
||||
returns void as $$
|
||||
begin
|
||||
execute query;
|
||||
end;
|
||||
$$ language plpgsql security definer;
|
||||
|
||||
-- Create updated_at trigger function
|
||||
create or replace function public.handle_updated_at()
|
||||
returns trigger as $$
|
||||
begin
|
||||
new.updated_at = timezone('utc'::text, now());
|
||||
return new;
|
||||
end;
|
||||
$$ language plpgsql security definer;
|
||||
|
||||
--[ 5. Core Tables ]--
|
||||
-- Base user profiles
|
||||
create table if not exists public.profiles (
|
||||
id uuid primary key references auth.users(id) on delete cascade,
|
||||
email text not null unique,
|
||||
user_type text not null check (user_type in ('admin', 'email_teacher', 'email_student')),
|
||||
username text not null unique,
|
||||
full_name text,
|
||||
display_name text,
|
||||
metadata jsonb default '{}'::jsonb,
|
||||
last_login timestamp with time zone,
|
||||
created_at timestamp with time zone default timezone('utc'::text, now()),
|
||||
updated_at timestamp with time zone default timezone('utc'::text, now())
|
||||
);
|
||||
comment on table public.profiles is 'User profiles linked to Supabase auth.users';
|
||||
comment on column public.profiles.user_type is 'Type of user: admin, teacher, or student';
|
||||
|
||||
-- Institute import data
|
||||
create table if not exists public.institute_imports (
|
||||
id uuid primary key default uuid_generate_v4(),
|
||||
urn text unique,
|
||||
establishment_name text not null,
|
||||
la_code text,
|
||||
la_name text,
|
||||
establishment_number text,
|
||||
establishment_type text,
|
||||
establishment_type_group text,
|
||||
establishment_status text,
|
||||
reason_establishment_opened text,
|
||||
open_date date,
|
||||
reason_establishment_closed text,
|
||||
close_date date,
|
||||
phase_of_education text,
|
||||
statutory_low_age integer,
|
||||
statutory_high_age integer,
|
||||
boarders text,
|
||||
nursery_provision text,
|
||||
official_sixth_form text,
|
||||
gender text,
|
||||
religious_character text,
|
||||
religious_ethos text,
|
||||
diocese text,
|
||||
admissions_policy text,
|
||||
school_capacity integer,
|
||||
special_classes text,
|
||||
census_date date,
|
||||
number_of_pupils integer,
|
||||
number_of_boys integer,
|
||||
number_of_girls integer,
|
||||
percentage_fsm numeric(5,2),
|
||||
trust_school_flag text,
|
||||
trusts_name text,
|
||||
school_sponsor_flag text,
|
||||
school_sponsors_name text,
|
||||
federation_flag text,
|
||||
federations_name text,
|
||||
ukprn text,
|
||||
fehe_identifier text,
|
||||
further_education_type text,
|
||||
ofsted_last_inspection date,
|
||||
last_changed_date date,
|
||||
street text,
|
||||
locality text,
|
||||
address3 text,
|
||||
town text,
|
||||
county text,
|
||||
postcode text,
|
||||
school_website text,
|
||||
telephone_num text,
|
||||
head_title text,
|
||||
head_first_name text,
|
||||
head_last_name text,
|
||||
head_preferred_job_title text,
|
||||
gssla_code text,
|
||||
parliamentary_constituency text,
|
||||
urban_rural text,
|
||||
rsc_region text,
|
||||
country text,
|
||||
uprn text,
|
||||
sen_stat boolean,
|
||||
sen_no_stat boolean,
|
||||
sen_unit_on_roll integer,
|
||||
sen_unit_capacity integer,
|
||||
resourced_provision_on_roll integer,
|
||||
resourced_provision_capacity integer,
|
||||
metadata jsonb default '{}'::jsonb,
|
||||
imported_at timestamp with time zone default timezone('utc'::text, now()),
|
||||
updated_at timestamp with time zone default timezone('utc'::text, now())
|
||||
);
|
||||
comment on table public.institute_imports is 'Raw institute data imported from external sources';
|
||||
|
||||
-- Active institutes
|
||||
create table if not exists public.institutes (
|
||||
id uuid primary key default uuid_generate_v4(),
|
||||
import_id uuid references public.institute_imports(id),
|
||||
name text not null,
|
||||
urn text unique,
|
||||
status text not null default 'active' check (status in ('active', 'inactive', 'pending')),
|
||||
address jsonb default '{}'::jsonb,
|
||||
website text,
|
||||
metadata jsonb default '{}'::jsonb,
|
||||
neo4j_unique_id text,
|
||||
neo4j_public_sync_status text default 'pending' check (neo4j_public_sync_status in ('pending', 'synced', 'failed')),
|
||||
neo4j_public_sync_at timestamp with time zone,
|
||||
neo4j_private_sync_status text default 'not_started' check (neo4j_private_sync_status in ('not_started', 'pending', 'synced', 'failed')),
|
||||
neo4j_private_sync_at timestamp with time zone,
|
||||
created_at timestamp with time zone default timezone('utc'::text, now()),
|
||||
updated_at timestamp with time zone default timezone('utc'::text, now())
|
||||
);
|
||||
comment on table public.institutes is 'Active institutes in the system';
|
||||
|
||||
--[ 6. Relationship Tables ]--
|
||||
-- Institute memberships
|
||||
create table if not exists public.institute_memberships (
|
||||
id uuid primary key default uuid_generate_v4(),
|
||||
profile_id uuid references public.profiles(id) on delete cascade,
|
||||
institute_id uuid references public.institutes(id) on delete cascade,
|
||||
role text not null check (role in ('admin', 'teacher', 'student')),
|
||||
tldraw_preferences jsonb default '{}'::jsonb,
|
||||
metadata jsonb default '{}'::jsonb,
|
||||
created_at timestamp with time zone default timezone('utc'::text, now()),
|
||||
updated_at timestamp with time zone default timezone('utc'::text, now()),
|
||||
unique(profile_id, institute_id)
|
||||
);
|
||||
comment on table public.institute_memberships is 'Manages user roles and relationships with institutes';
|
||||
|
||||
-- Membership requests
|
||||
create table if not exists public.institute_membership_requests (
|
||||
id uuid primary key default uuid_generate_v4(),
|
||||
profile_id uuid references public.profiles(id) on delete cascade,
|
||||
institute_id uuid references public.institutes(id) on delete cascade,
|
||||
requested_role text check (requested_role in ('teacher', 'student')),
|
||||
status text default 'pending' check (status in ('pending', 'approved', 'rejected')),
|
||||
metadata jsonb default '{}'::jsonb,
|
||||
created_at timestamp with time zone default timezone('utc'::text, now()),
|
||||
updated_at timestamp with time zone default timezone('utc'::text, now())
|
||||
);
|
||||
comment on table public.institute_membership_requests is 'Tracks requests to join institutes';
|
||||
|
||||
--[ 7. Audit Tables ]--
|
||||
-- System audit logs
|
||||
create table if not exists public.audit_logs (
|
||||
id uuid primary key default uuid_generate_v4(),
|
||||
profile_id uuid references public.profiles(id) on delete set null,
|
||||
action_type text,
|
||||
table_name text,
|
||||
record_id uuid,
|
||||
changes jsonb,
|
||||
created_at timestamp with time zone default timezone('utc'::text, now())
|
||||
);
|
||||
comment on table public.audit_logs is 'System-wide audit trail for important operations';
|
||||
@@ -0,0 +1,199 @@
|
||||
--[ 8. Auth Functions ]--
|
||||
-- Create a secure function to check admin status
|
||||
create or replace function auth.is_admin()
|
||||
returns boolean as $$
|
||||
select coalesce(
|
||||
(select true
|
||||
from public.profiles
|
||||
where id = auth.uid()
|
||||
and user_type = 'admin'),
|
||||
false
|
||||
);
|
||||
$$ language sql security definer;
|
||||
|
||||
-- Create a secure function to check super admin status
|
||||
create or replace function auth.is_super_admin()
|
||||
returns boolean as $$
|
||||
select coalesce(
|
||||
(select role = 'supabase_admin'
|
||||
from auth.users
|
||||
where id = auth.uid()),
|
||||
false
|
||||
);
|
||||
$$ language sql security definer;
|
||||
|
||||
-- Create public wrappers for the auth functions
|
||||
create or replace function public.is_admin()
|
||||
returns boolean as $$
|
||||
select auth.is_admin();
|
||||
$$ language sql security definer;
|
||||
|
||||
create or replace function public.is_super_admin()
|
||||
returns boolean as $$
|
||||
select auth.is_super_admin();
|
||||
$$ language sql security definer;
|
||||
|
||||
-- Grant execute permissions
|
||||
grant execute on function public.is_admin to authenticated;
|
||||
grant execute on function public.is_super_admin to authenticated;
|
||||
grant execute on function auth.is_admin to authenticated;
|
||||
grant execute on function auth.is_super_admin to authenticated;
|
||||
|
||||
-- Initial admin setup function
|
||||
create or replace function public.setup_initial_admin(admin_email text)
|
||||
returns json
|
||||
language plpgsql
|
||||
security definer
|
||||
as $$
|
||||
declare
|
||||
result json;
|
||||
begin
|
||||
-- Only allow this to run as service role or supabase_admin
|
||||
if not (
|
||||
current_user = 'service_role'
|
||||
or exists (
|
||||
select 1 from pg_roles
|
||||
where rolname = current_user
|
||||
and rolsuper
|
||||
)
|
||||
) then
|
||||
raise exception 'Must be run as service_role or superuser';
|
||||
end if;
|
||||
|
||||
-- Update user_type and username for admin
|
||||
update public.profiles
|
||||
set user_type = 'admin',
|
||||
username = coalesce(username, 'superadmin'),
|
||||
display_name = coalesce(display_name, 'Super Admin')
|
||||
where email = admin_email
|
||||
returning json_build_object(
|
||||
'id', id,
|
||||
'email', email,
|
||||
'user_type', user_type,
|
||||
'username', username,
|
||||
'display_name', display_name
|
||||
) into result;
|
||||
|
||||
if result is null then
|
||||
raise exception 'Admin user with email % not found', admin_email;
|
||||
end if;
|
||||
|
||||
return result;
|
||||
end;
|
||||
$$;
|
||||
|
||||
-- Grant execute permissions
|
||||
revoke execute on function public.setup_initial_admin from public;
|
||||
grant execute on function public.setup_initial_admin to authenticated, service_role, supabase_admin;
|
||||
|
||||
-- Create RPC wrapper for REST API access
|
||||
create or replace function rpc.setup_initial_admin(admin_email text)
|
||||
returns json
|
||||
language plpgsql
|
||||
security definer
|
||||
as $$
|
||||
begin
|
||||
return public.setup_initial_admin(admin_email);
|
||||
end;
|
||||
$$;
|
||||
|
||||
-- Grant execute permissions for RPC wrapper
|
||||
grant execute on function rpc.setup_initial_admin to authenticated, service_role, supabase_admin;
|
||||
|
||||
--[ 9. Utility Functions ]--
|
||||
-- Check if database is ready
|
||||
create or replace function check_db_ready()
|
||||
returns boolean
|
||||
language plpgsql
|
||||
security definer
|
||||
as $$
|
||||
begin
|
||||
-- Check if essential schemas exist
|
||||
if not exists (
|
||||
select 1
|
||||
from information_schema.schemata
|
||||
where schema_name in ('auth', 'storage', 'public')
|
||||
) then
|
||||
return false;
|
||||
end if;
|
||||
|
||||
-- Check if essential tables exist
|
||||
if not exists (
|
||||
select 1
|
||||
from information_schema.tables
|
||||
where table_schema = 'auth'
|
||||
and table_name = 'users'
|
||||
) then
|
||||
return false;
|
||||
end if;
|
||||
|
||||
-- Check if RLS is enabled on public.profiles
|
||||
if not exists (
|
||||
select 1
|
||||
from pg_tables
|
||||
where schemaname = 'public'
|
||||
and tablename = 'profiles'
|
||||
and rowsecurity = true
|
||||
) then
|
||||
return false;
|
||||
end if;
|
||||
|
||||
return true;
|
||||
end;
|
||||
$$;
|
||||
|
||||
-- Grant execute permission
|
||||
grant execute on function check_db_ready to anon, authenticated, service_role;
|
||||
|
||||
-- Function to handle new user registration
|
||||
create or replace function public.handle_new_user()
|
||||
returns trigger
|
||||
language plpgsql
|
||||
security definer set search_path = public
|
||||
as $$
|
||||
declare
|
||||
default_user_type text := 'email_student';
|
||||
default_username text;
|
||||
begin
|
||||
-- Generate username from email
|
||||
default_username := split_part(new.email, '@', 1);
|
||||
|
||||
insert into public.profiles (
|
||||
id,
|
||||
email,
|
||||
user_type,
|
||||
username,
|
||||
display_name
|
||||
)
|
||||
values (
|
||||
new.id,
|
||||
new.email,
|
||||
coalesce(new.raw_user_meta_data->>'user_type', default_user_type),
|
||||
coalesce(new.raw_user_meta_data->>'username', default_username),
|
||||
coalesce(new.raw_user_meta_data->>'display_name', default_username)
|
||||
);
|
||||
return new;
|
||||
end;
|
||||
$$;
|
||||
|
||||
-- Trigger for new user creation
|
||||
drop trigger if exists on_auth_user_created on auth.users;
|
||||
create trigger on_auth_user_created
|
||||
after insert on auth.users
|
||||
for each row execute procedure public.handle_new_user();
|
||||
|
||||
--[ 11. Database Triggers ]--
|
||||
drop trigger if exists handle_profiles_updated_at on public.profiles;
|
||||
create trigger handle_profiles_updated_at
|
||||
before update on public.profiles
|
||||
for each row execute function public.handle_updated_at();
|
||||
|
||||
drop trigger if exists handle_institute_memberships_updated_at on public.institute_memberships;
|
||||
create trigger handle_institute_memberships_updated_at
|
||||
before update on public.institute_memberships
|
||||
for each row execute function public.handle_updated_at();
|
||||
|
||||
drop trigger if exists handle_membership_requests_updated_at on public.institute_membership_requests;
|
||||
create trigger handle_membership_requests_updated_at
|
||||
before update on public.institute_membership_requests
|
||||
for each row execute function public.handle_updated_at();
|
||||
@@ -0,0 +1,50 @@
|
||||
-- Enable RLS on storage.buckets
|
||||
alter table if exists storage.buckets enable row level security;
|
||||
|
||||
-- Drop existing policies if they exist
|
||||
drop policy if exists "Super admin has full access to buckets" on storage.buckets;
|
||||
drop policy if exists "Users can create their own buckets" on storage.buckets;
|
||||
drop policy if exists "Users can view their own buckets" on storage.buckets;
|
||||
|
||||
-- Create new policies with proper permissions
|
||||
create policy "Super admin has full access to buckets"
|
||||
on storage.buckets for all
|
||||
using (
|
||||
current_user = 'service_role'
|
||||
or current_user = 'supabase_admin'
|
||||
or exists (
|
||||
select 1 from public.profiles
|
||||
where id = auth.uid()
|
||||
and user_type = 'admin'
|
||||
)
|
||||
);
|
||||
|
||||
-- Allow authenticated users to create buckets
|
||||
create policy "Users can create their own buckets"
|
||||
on storage.buckets for insert
|
||||
to authenticated
|
||||
with check (
|
||||
owner::text = auth.uid()::text
|
||||
or exists (
|
||||
select 1 from public.profiles
|
||||
where id = auth.uid()
|
||||
and user_type = 'admin'
|
||||
)
|
||||
);
|
||||
|
||||
-- Allow users to view buckets they own or public buckets
|
||||
create policy "Users can view their own buckets"
|
||||
on storage.buckets for select
|
||||
to authenticated
|
||||
using (
|
||||
owner::text = auth.uid()::text
|
||||
or exists (
|
||||
select 1 from public.profiles
|
||||
where id = auth.uid()
|
||||
and user_type = 'admin'
|
||||
)
|
||||
);
|
||||
|
||||
-- Grant necessary permissions
|
||||
grant all on storage.buckets to authenticated;
|
||||
grant all on storage.objects to authenticated;
|
||||
@@ -0,0 +1,31 @@
|
||||
-- Ensure uuid-ossp extension is enabled
|
||||
create extension if not exists "uuid-ossp" schema extensions;
|
||||
|
||||
-- Function to set up initial admin
|
||||
create or replace function public.setup_initial_admin()
|
||||
returns void
|
||||
language plpgsql
|
||||
security definer
|
||||
set search_path = public, extensions
|
||||
as $$
|
||||
begin
|
||||
-- Check if admin already exists
|
||||
if exists (
|
||||
select 1 from public.profiles
|
||||
where user_type = 'admin'
|
||||
) then
|
||||
return;
|
||||
end if;
|
||||
|
||||
-- Grant necessary permissions
|
||||
grant all on all tables in schema public to authenticated;
|
||||
grant all on all sequences in schema public to authenticated;
|
||||
grant all on all functions in schema public to authenticated;
|
||||
end;
|
||||
$$;
|
||||
|
||||
-- Execute the function
|
||||
select public.setup_initial_admin();
|
||||
|
||||
-- Drop the function after execution
|
||||
drop function public.setup_initial_admin();
|
||||
@@ -0,0 +1,23 @@
|
||||
-- Create Keycloak user if it doesn't exist
|
||||
DO $$
|
||||
BEGIN
|
||||
IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'keycloak') THEN
|
||||
CREATE USER keycloak WITH PASSWORD 'keycloak';
|
||||
END IF;
|
||||
END
|
||||
$$;
|
||||
|
||||
-- Create Keycloak schema if it doesn't exist
|
||||
CREATE SCHEMA IF NOT EXISTS keycloak;
|
||||
|
||||
-- Grant necessary permissions
|
||||
GRANT USAGE ON SCHEMA keycloak TO keycloak;
|
||||
GRANT ALL ON ALL TABLES IN SCHEMA keycloak TO keycloak;
|
||||
GRANT ALL ON ALL SEQUENCES IN SCHEMA keycloak TO keycloak;
|
||||
|
||||
-- Set default privileges for future tables
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA keycloak GRANT ALL ON TABLES TO keycloak;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA keycloak GRANT ALL ON SEQUENCES TO keycloak;
|
||||
|
||||
-- Grant connect permission to the database
|
||||
GRANT CONNECT ON DATABASE postgres TO keycloak;
|
||||
@@ -0,0 +1,3 @@
|
||||
\set pguser `echo "$POSTGRES_USER"`
|
||||
|
||||
CREATE DATABASE _supabase WITH OWNER :pguser;
|
||||
@@ -0,0 +1,5 @@
|
||||
\set pguser `echo "$POSTGRES_USER"`
|
||||
|
||||
\c _supabase
|
||||
create schema if not exists _analytics;
|
||||
alter schema _analytics owner to :pguser;
|
||||
@@ -0,0 +1,5 @@
|
||||
\set pguser `echo "$POSTGRES_USER"`
|
||||
|
||||
\c _supabase
|
||||
create schema if not exists _supavisor;
|
||||
alter schema _supavisor owner to :pguser;
|
||||
@@ -0,0 +1,4 @@
|
||||
\set pguser `echo "$POSTGRES_USER"`
|
||||
|
||||
create schema if not exists _realtime;
|
||||
alter schema _realtime owner to :pguser;
|
||||
Reference in New Issue
Block a user