feat(server): add project RBAC and guarded workflows

2026-07-30 16:45:09 +08:00
parent 3fbb17bb30
commit ae1a657554
29 changed files with 1431 additions and 412 deletions
@@ -42,6 +42,12 @@ ALTER TABLE users
 ALTER TABLE users
    ALTER COLUMN role SET DEFAULT 'user';

+ALTER TABLE users
+    DROP CONSTRAINT IF EXISTS users_role_check;
+ALTER TABLE users
+    ADD CONSTRAINT users_role_check
+    CHECK (role IN ('admin', 'user'));
+
 CREATE UNIQUE INDEX IF NOT EXISTS idx_users_keycloak_id ON users(keycloak_id);
 CREATE INDEX IF NOT EXISTS idx_users_role ON users(role);
 CREATE INDEX IF NOT EXISTS idx_users_is_active ON users(is_active);
@@ -52,7 +58,9 @@ CREATE TABLE IF NOT EXISTS user_project_membership (
    project_id UUID NOT NULL,
    project_role VARCHAR(20) DEFAULT 'viewer' NOT NULL,
    CONSTRAINT user_project_membership_role_check
-        CHECK (project_role IN ('owner', 'admin', 'member', 'viewer')),
+        CHECK (
+            project_role IN ('member', 'viewer')
+        ),
    CONSTRAINT user_project_membership_unique UNIQUE (user_id, project_id)
 );