Paul Trowbridge
712d114dc5
Territory filtering was deferred from v1, so every account saw and could write every row. With the sales team about to adjust their own territories that is the thing standing in the way, and it is also why a rep would wait fifteen seconds to load 2.7M rows to work on a few thousand. The list lives on pf.app_user.territory with is_admin beside it, and col_meta.is_territory marks which column of a source the values belong to -- flagged rather than named in code, so a second source can be divided by something other than a sales rep. Fail closed: buildTerritoryClause returns FALSE for an empty list or an unflagged source. An account nobody configured sees nothing, rather than everything because a column was left null. Built from the session, never the request. That is what separates it from `scope`, which the browser sends and should: a filter the user chose belongs in the payload, a permission cannot come from the thing it restrains. It is ANDed on last, where nothing in the request can undo it. Enforced on /data (the cursor and the count behind X-Row-Count), on /agg before the GROUP BY since the territory column need not be in the grain, on every operation through sliceUnits, and on the value completion endpoint -- which reads the source table, so without it a dropdown enumerates every customer and rep in the business to someone shown none of their rows. Undo is gated by owner rather than territory: it removes an entry's rows wholesale, so half-undoing one would leave a state nothing describes. Recode refuses to set the territory column unless you are an admin, since moving a row between territories is reassignment, not forecasting. ./pf.sh gains set-territory, set-admin and orphan-territory. The last lists territory values no account owns -- work under one is invisible to everybody but an admin, which a typo causes easily and nothing in the app reveals. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
39 lines
1.6 KiB
SQL
39 lines
1.6 KiB
SQL
-- Pivot Forecast — authentication
|
|
-- Run after 01_schema.sql: psql -d <db> -f setup_sql/02_auth.sql
|
|
-- Safe to re-run.
|
|
|
|
-- Application accounts. Passwords are scrypt hashes written by lib/auth.js;
|
|
-- the plaintext never reaches the database. Manage with ./pf.sh add-user.
|
|
CREATE TABLE IF NOT EXISTS pf.app_user (
|
|
id serial PRIMARY KEY,
|
|
username text NOT NULL UNIQUE,
|
|
pass_hash text NOT NULL,
|
|
display_name text,
|
|
is_active boolean NOT NULL DEFAULT true,
|
|
created_at timestamptz NOT NULL DEFAULT now(),
|
|
last_login_at timestamptz
|
|
);
|
|
|
|
-- Session store for express-session (connect-pg-simple layout). Sessions live
|
|
-- here rather than in memory so a restart doesn't sign everyone out, and so a
|
|
-- session can be revoked by deleting its row.
|
|
CREATE TABLE IF NOT EXISTS pf.session (
|
|
sid varchar PRIMARY KEY NOT NULL COLLATE "default",
|
|
sess json NOT NULL,
|
|
expire timestamp(6) NOT NULL
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS session_expire_idx ON pf.session (expire);
|
|
|
|
-- What an account may see and change.
|
|
--
|
|
-- territory is the list of values allowed in the source's territory column
|
|
-- (col_meta.is_territory). It is a filter the server applies to every read and
|
|
-- every write; it is never sent by the client, which could remove it.
|
|
--
|
|
-- Fail closed: no territory and not an admin means no rows. An account created
|
|
-- without one sees nothing until someone grants it, rather than seeing the whole
|
|
-- book because a column was left null.
|
|
ALTER TABLE pf.app_user ADD COLUMN IF NOT EXISTS territory jsonb;
|
|
ALTER TABLE pf.app_user ADD COLUMN IF NOT EXISTS is_admin boolean NOT NULL DEFAULT false;
|