feat(server): add project RBAC and guarded workflows

resources/sql/004_metadata_auth_management.sql

@@ -42,6 +42,12 @@ ALTER TABLE users
 ALTER TABLE users
     ALTER COLUMN role SET DEFAULT 'user';
 
+ALTER TABLE users
+    DROP CONSTRAINT IF EXISTS users_role_check;
+ALTER TABLE users
+    ADD CONSTRAINT users_role_check
+    CHECK (role IN ('admin', 'user'));
+
 CREATE UNIQUE INDEX IF NOT EXISTS idx_users_keycloak_id ON users(keycloak_id);
 CREATE INDEX IF NOT EXISTS idx_users_role ON users(role);
 CREATE INDEX IF NOT EXISTS idx_users_is_active ON users(is_active);
@@ -52,7 +58,9 @@ CREATE TABLE IF NOT EXISTS user_project_membership (
     project_id UUID NOT NULL,
     project_role VARCHAR(20) DEFAULT 'viewer' NOT NULL,
     CONSTRAINT user_project_membership_role_check
-        CHECK (project_role IN ('owner', 'admin', 'member', 'viewer')),
+        CHECK (
+            project_role IN ('member', 'viewer')
+        ),
     CONSTRAINT user_project_membership_unique UNIQUE (user_id, project_id)
 );
 

resources/sql/006_metadata_rbac_roles.sql

@@ -0,0 +1,32 @@
+-- Normalize existing roles to the Web authorization model.
+-- This migration is intentionally re-runnable.
+
+ALTER TABLE users
+    DROP CONSTRAINT IF EXISTS users_role_check;
+
+UPDATE users
+SET role = 'user'
+WHERE role NOT IN ('admin', 'user');
+
+ALTER TABLE users
+    ADD CONSTRAINT users_role_check
+    CHECK (role IN ('admin', 'user'));
+
+ALTER TABLE user_project_membership
+    DROP CONSTRAINT IF EXISTS user_project_membership_role_check;
+
+UPDATE user_project_membership
+SET project_role = CASE
+    WHEN project_role IN (
+        'owner',
+        'admin',
+        'modeler',
+        'dispatcher'
+    ) THEN 'member'
+    ELSE 'viewer'
+END
+WHERE project_role NOT IN ('member', 'viewer');
+
+ALTER TABLE user_project_membership
+    ADD CONSTRAINT user_project_membership_role_check
+    CHECK (project_role IN ('member', 'viewer'));