5360 lines
391 KiB
Plaintext
5360 lines
391 KiB
Plaintext
[2Ksparkyfitness-server | '20251020022200_update_rls_policies.sql',
|
|
[2Ksparkyfitness-server | '20251020022500_fix_food_select_policy.sql',
|
|
[2Ksparkyfitness-server | '20251020030000_simplify_food_select_policy.sql',
|
|
[2Ksparkyfitness-server | '20251020031000_update_food_select_policy_with_sharing.sql',
|
|
[2Ksparkyfitness-server | '20251020032200_add_all_owner_centric_policies.sql',
|
|
[2Ksparkyfitness-server | '20251020033400_add_food_variants_rls_policy.sql',
|
|
[2Ksparkyfitness-server | '20251020033700_fix_food_variants_rls_policy.sql',
|
|
[2Ksparkyfitness-server | '20251020230839_fix_family_access_rls_policies.sql',
|
|
[2Ksparkyfitness-server | '20251021025423_restrict_family_access_select_policy.sql',
|
|
[2Ksparkyfitness-server | '20251021034700_add_public_sharing_to_external_providers.sql',
|
|
[2Ksparkyfitness-server | '20251022201000_fix_exercise_rls_policy.sql',
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (fa.access_permissions->>'can_manage_medications')::boolean = true
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.has_medication_read_access(owner_uuid uuid) RETURNS boolean
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_manage_medications')::boolean = true OR
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_view_reports')::boolean = true
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_library_access_with_public(owner_uuid uuid, is_shared bool, perms text[]) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid
|
|
[2Ksparkyfitness-db | OR is_shared
|
|
[2Ksparkyfitness-db | OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_view_reports')::boolean = true OR
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM unnest(perms) p
|
|
[2Ksparkyfitness-db | WHERE (fa.access_permissions ->> p)::boolean = true
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | p <> 'can_manage_diary'
|
|
[2Ksparkyfitness-db | OR current_user_id() = owner_uuid
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | DROP FUNCTION IF EXISTS public.set_app_context(UUID, UUID);
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.set_app_context(p_user_id UUID, p_authenticated_user_id UUID)
|
|
[2Ksparkyfitness-db | RETURNS void AS $$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | -- app.user_id is used by RLS to determine whose data is being accessed
|
|
[2Ksparkyfitness-db | PERFORM set_config('app.user_id', p_user_id::text, false);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- app.authenticated_user_id is the actual logged-in user
|
|
[2Ksparkyfitness-db | PERFORM set_config('app.authenticated_user_id', p_authenticated_user_id::text, false);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $$ LANGUAGE plpgsql SECURITY DEFINER;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | DROP FUNCTION IF EXISTS public.can_access_user_data(UUID, TEXT, UUID);
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.can_access_user_data(
|
|
[2Ksparkyfitness-db | target_user_id UUID,
|
|
[2Ksparkyfitness-db | permission_type TEXT,
|
|
[2Ksparkyfitness-db | auth_user_id UUID
|
|
[2Ksparkyfitness-db | ) RETURNS BOOLEAN AS $func$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | -- Self access
|
|
[2Ksparkyfitness-db | IF target_user_id = auth_user_id THEN
|
|
[2Ksparkyfitness-db | RETURN TRUE;
|
|
[2Ksparkyfitness-db | END IF;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Family access check
|
|
[2Ksparkyfitness-db | RETURN EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1
|
|
[2Ksparkyfitness-db | FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.family_user_id = auth_user_id
|
|
[2Ksparkyfitness-db | AND fa.owner_user_id = target_user_id
|
|
[2Ksparkyfitness-db | AND fa.is_active = TRUE
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > NOW())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>permission_type)::BOOLEAN = TRUE
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | -- Mapping for common permission names
|
|
[2Ksparkyfitness-db | (permission_type = 'diary' AND (fa.access_permissions->>'can_manage_diary')::BOOLEAN = TRUE)
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | (permission_type = 'checkin' AND (fa.access_permissions->>'can_manage_checkin')::BOOLEAN = TRUE)
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | (permission_type = 'reports' AND (fa.access_permissions->>'can_view_reports')::BOOLEAN = TRUE)
|
|
[2Ksparkyfitness-db | OR
|
|
[2K[2Ksparkyfitness-server | '20251022203000_snapshot_exercise_details_in_entries.sql',
|
|
[2Ksparkyfitness-server | '20251023120500_update_external_providers_select_policy_for_public.sql',
|
|
[2Ksparkyfitness-server | '20251023221000_update_meals_rls_policy.sql',
|
|
sparkyfitness-db | -- Inheritance: reports permission grants read access to others
|
|
[2Ksparkyfitness-db | (permission_type IN ('calorie', 'diary', 'mood', 'sleep', 'exercise', 'water', 'checkin')
|
|
[2Ksparkyfitness-db | AND (COALESCE((fa.access_permissions->>'reports')::BOOLEAN, FALSE)
|
|
[2Ksparkyfitness-db | OR COALESCE((fa.access_permissions->>'can_view_reports')::BOOLEAN, FALSE)))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $func$ LANGUAGE plpgsql STABLE;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Helper function to check if authenticated user is admin
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION is_admin() RETURNS boolean
|
|
[2Ksparkyfitness-server | '20251023221500_update_meal_plan_template_assignments_rls_policy.sql',
|
|
[2Ksparkyfitness-server | '20251023221501_add_meal_id_to_food_entries.sql',
|
|
[2Ksparkyfitness-server | '20251024230330_add_withings_fields_to_external_data_providers.sql',
|
|
[2Ksparkyfitness-server | '20251025210900_add_source_to_custom_measurements.sql',
|
|
[2Ksparkyfitness-server | '20251026125900_add_distance_and_hr_to_exercise_entries_activity_details.sql',
|
|
[2Ksparkyfitness-server | '202510310132_add_language_to_user_preferences.sql',
|
|
[2Ksparkyfitness-server | '20251101151100_create_sleep_entries_table.sql',
|
|
[2Ksparkyfitness-server | '20251103000000_add_onboarding_schema.sql',
|
|
[2Ksparkyfitness-server | '20251112000000_add_display_name_to_custom_categories.sql',
|
|
[2Ksparkyfitness-server | '20251114205134_create_exercise_preset_entries_table.sql',
|
|
[2Ksparkyfitness-server | '20251115003147_add_source_to_exercise_preset_entries.sql',
|
|
[2Ksparkyfitness-server | '20251115003301_add_exercise_preset_entry_id_to_activity_details.sql',
|
|
[2Ksparkyfitness-server | '20251115004027_alter_exercise_entry_id_nullable_in_activity_details.sql',
|
|
[2Ksparkyfitness-server | '20251120011100_add_mfa_magic_link_columns.sql',
|
|
[2Ksparkyfitness-server | '20251121011500_add_email_mfa_columns_to_users.sql',
|
|
[2Ksparkyfitness-server | '202511220110_add_default_external_data_providers.sql',
|
|
[2Ksparkyfitness-server | '202511232110_delete_raw_stress_data_categories.sql',
|
|
[2Ksparkyfitness-server | '202511270109_add_calorie_goal_adjustment_mode_to_user_preferences.sql',
|
|
[2Ksparkyfitness-server | '20251127194107_create_food_entry_meals_and_link_food_entries.sql',
|
|
[2Ksparkyfitness-server | '20251127194108_migrate_aggregated_food_entries_to_food_entry_meals.sql',
|
|
[2Ksparkyfitness-server | '20251128030115_add_tandoor_provider_type.sql',
|
|
[2Ksparkyfitness-server | '20251205000000_add_energy_unit_to_user_preferences.sql',
|
|
[2Ksparkyfitness-server | '20251206000000_add_nutrient_calculation_algorithms.sql',
|
|
[2Ksparkyfitness-server | '20251206000001_add_serving_size_to_meals.sql',
|
|
[2Ksparkyfitness-server | '20251207000001_add_default_meal_quantity.sql',
|
|
[2Ksparkyfitness-server | '20251215005329_add_usda_to_provider_type_check.sql',
|
|
[2Ksparkyfitness-server | '20251221000000_create_fasting_logs.sql',
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public."user" u
|
|
[2Ksparkyfitness-db | WHERE u.id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND u.role = 'admin'
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-server | '20251221010000_drop_mood_weight_from_fasting_logs.sql',
|
|
[2Ksparkyfitness-server | '20251226150700_add_mobile_health_data_features.sql',
|
|
[2Ksparkyfitness-server | '20251228000000_add_custom_nutrients_tables.sql',
|
|
[2Ksparkyfitness-server | ... 193 more items
|
|
[2Ksparkyfitness-server | ]
|
|
[2Ksparkyfitness-server | [2026-11-03T02:00:58.461Z] [INFO] Ensuring permissions for role: "sparkyapp"
|
|
[2Ksparkyfitness-server | [2026-11-03T02:00:58.511Z] [INFO] Successfully ensured permissions for role: "sparkyapp"
|
|
[2Ksparkyfitness-server | [2026-11-03T02:00:58.512Z] [INFO] Permissions granted to application user.
|
|
[2Ksparkyfitness-server | [2026-11-03T02:00:58.512Z] [INFO] Applying all RLS policies from rls_policies.sql...
|
|
[2Ksparkyfitness-server | [2026-11-03T02:00:58.634Z] [ERROR] Error applying RLS policies: error: relation "public.user_custom_symptom_locations" does not exist
|
|
[2Ksparkyfitness-server | at /app/SparkyFitnessServer/node_modules/.pnpm/pg@8.20.0/node_modules/pg/lib/client.js:631:17
|
|
[2Ksparkyfitness-server | at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
|
|
[2Ksparkyfitness-server | at async applyRlsPolicies (/app/SparkyFitnessServer/utils/applyRlsPolicies.ts:15:5) {
|
|
[2Ksparkyfitness-db | -- Step 4: Define generic policy creation functions.
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_owner_policy(table_name text, id_column text DEFAULT 'user_id') RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (%I = authenticated_user_id())
|
|
[2Ksparkyfitness-db | WITH CHECK (%I = authenticated_user_id());
|
|
[2Ksparkyfitness-db | ', table_name, id_column, id_column);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_shared_owner_policy(table_name text, id_column text DEFAULT 'user_id') RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (%I = current_user_id());
|
|
[2Ksparkyfitness-db | ', table_name, id_column);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (%I = authenticated_user_id())
|
|
[2Ksparkyfitness-db | WITH CHECK (%I = authenticated_user_id());
|
|
[2Ksparkyfitness-db | ', table_name, id_column, id_column);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_diary_policy(table_name text) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_access(user_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (has_diary_access(user_id));
|
|
[2Ksparkyfitness-db | ', table_name, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_checkin_policy(table_name text) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-server | length: 282,
|
|
[2K[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_checkin_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id OR has_family_access(user_id, ''can_manage_checkin''))
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id OR has_family_access(user_id, ''can_manage_checkin''));
|
|
[2Ksparkyfitness-db | ', table_name, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_library_policy(table_name text, shared_column text, permissions text[]) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | DECLARE
|
|
[2Ksparkyfitness-db | quoted_permissions text;
|
|
[2Ksparkyfitness-db | shared_expression text;
|
|
sparkyfitness-server | severity: 'ERROR',
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-server | code: '42P01',
|
|
[2Ksparkyfitness-db | -- Quote each permission name to ensure valid ARRAY syntax
|
|
[2Ksparkyfitness-server | detail: undefined,
|
|
[2Ksparkyfitness-db | SELECT array_to_string(ARRAY(
|
|
[2Ksparkyfitness-db | SELECT quote_literal(p) FROM unnest(permissions) p
|
|
[2Ksparkyfitness-db | ), ',') INTO quoted_permissions;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Use boolean false if shared_column is 'false', otherwise treat as column name
|
|
[2Ksparkyfitness-db | IF shared_column = 'false' THEN
|
|
[2Ksparkyfitness-db | shared_expression := 'false';
|
|
[2Ksparkyfitness-db | ELSE
|
|
[2Ksparkyfitness-db | shared_expression := quote_ident(shared_column);
|
|
[2Ksparkyfitness-db | END IF;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-server | hint: undefined,
|
|
[2Ksparkyfitness-server | position: undefined,
|
|
[2Ksparkyfitness-server | internalPosition: undefined,
|
|
[2Ksparkyfitness-server | internalQuery: undefined,
|
|
[2Ksparkyfitness-server | where: 'SQL statement "ALTER TABLE public.user_custom_symptom_locations ENABLE ROW LEVEL SECURITY;"\n' +
|
|
[2Ksparkyfitness-server | 'PL/pgSQL function inline_code_block line 86 at EXECUTE',
|
|
[2Ksparkyfitness-server | schema: undefined,
|
|
[2Ksparkyfitness-server | table: undefined,
|
|
[2Ksparkyfitness-server | column: undefined,
|
|
[2Ksparkyfitness-server | dataType: undefined,
|
|
[2Ksparkyfitness-server | constraint: undefined,
|
|
[2Ksparkyfitness-server | file: 'namespace.c',
|
|
[2Ksparkyfitness-server | line: '631',
|
|
[2K[2Ksparkyfitness-server | routine: 'RangeVarGetRelidExtended'
|
|
[2Ksparkyfitness-server | }
|
|
[2Ksparkyfitness-server | Failed to start server: error: relation "public.user_custom_symptom_locations" does not exist
|
|
[2Ksparkyfitness-server | at /app/SparkyFitnessServer/node_modules/.pnpm/pg@8.20.0/node_modules/pg/lib/client.js:631:17
|
|
[2Ksparkyfitness-server | at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
|
|
[2Ksparkyfitness-server | at async applyRlsPolicies (/app/SparkyFitnessServer/utils/applyRlsPolicies.ts:15:5) {
|
|
[2Ksparkyfitness-server | length: 282,
|
|
[2Ksparkyfitness-server | severity: 'ERROR',
|
|
[2Ksparkyfitness-server | code: '42P01',
|
|
[2Ksparkyfitness-server | detail: undefined,
|
|
[2Ksparkyfitness-server | hint: undefined,
|
|
[2Ksparkyfitness-server | position: undefined,
|
|
[2Ksparkyfitness-server | internalPosition: undefined,
|
|
[2Ksparkyfitness-server | internalQuery: undefined,
|
|
sparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-server | where: 'SQL statement "ALTER TABLE public.user_custom_symptom_locations ENABLE ROW LEVEL SECURITY;"\n' +
|
|
[2Ksparkyfitness-db | USING (has_library_access_with_public(user_id, %s, ARRAY[%s]));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db | ', table_name, shared_expression, quoted_permissions, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.create_medication_policy(table_name text) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-server | 'PL/pgSQL function inline_code_block line 86 at EXECUTE',
|
|
[2Ksparkyfitness-server | schema: undefined,
|
|
[2Ksparkyfitness-server | table: undefined,
|
|
[2Ksparkyfitness-server | column: undefined,
|
|
[2Ksparkyfitness-server | dataType: undefined,
|
|
[2Ksparkyfitness-server | constraint: undefined,
|
|
[2Ksparkyfitness-server | file: 'namespace.c',
|
|
[2Ksparkyfitness-server | line: '631',
|
|
[2Ksparkyfitness-server | routine: 'RangeVarGetRelidExtended'
|
|
[2Ksparkyfitness-server | }
|
|
[2Ksparkyfitness-server | [dotenv@17.3.1] injecting env (0) from ../.env -- tip: 🔐 prevent building .env in docker: https://dotenvx.com/prebuild
|
|
[2Ksparkyfitness-server | [Secrets] Checking for secret files to load...
|
|
[2Ksparkyfitness-server | [Secrets] No secrets loaded from files.
|
|
[2Ksparkyfitness-server | [2026-11-03T02:01:30.167Z] [INFO] Environment variable pre-flight checks passed successfully.
|
|
[2Ksparkyfitness-server | Starting server...
|
|
[2Ksparkyfitness-server | [2026-11-03T02:01:38.691Z] [INFO] [withingsService] Withings data source configured to: withings
|
|
[2Ksparkyfitness-server | [2026-11-03T02:01:38.693Z] [INFO] [fitbitService] Fitbit data source configured to: fitbit
|
|
[2Ksparkyfitness-server | [2026-11-03T02:01:38.693Z] [INFO] [googleHealthService] Google Health data source: googlehealth
|
|
[2Ksparkyfitness-server | [2026-11-03T02:01:38.695Z] [INFO] [polarService] Polar data source configured to: polar
|
|
[2Ksparkyfitness-server | [2026-11-03T02:01:38.696Z] [INFO] [stravaService] Strava data source configured to: strava
|
|
[2Ksparkyfitness-server | [2026-11-03T02:01:38.696Z] [INFO] [hevyService] Hevy data source configured to: hevy
|
|
[2Ksparkyfitness-server | [2026-11-03T02:01:39.462Z] [INFO] UserProfileRoutes UPLOADS_DIR: /app/SparkyFitnessServer/uploads/avatars
|
|
[2Ksparkyfitness-server | DEBUG: SPARKY_FITNESS_FRONTEND_URL is: https://sparky.gate.invalid
|
|
[2Ksparkyfitness-server | [SECURITY] Private network CORS is ENABLED. Ensure this is only on self-hosted/private networks.
|
|
[2Ksparkyfitness-server | SparkyFitnessServer UPLOADS_BASE_DIR: /app/SparkyFitnessServer/uploads
|
|
[2Ksparkyfitness-server | [2026-11-03T02:01:39.634Z] [INFO] Ensured temporary upload directory exists: /app/SparkyFitnessServer/temp_uploads/
|
|
[2Ksparkyfitness-server | [2026-11-03T02:01:39.657Z] [INFO] Role "sparkyapp" already exists.
|
|
[2Ksparkyfitness-server | [2026-11-03T02:01:39.659Z] [INFO] Ensured schema_migrations table exists.
|
|
[2Ksparkyfitness-server | [2026-11-03T02:01:39.664Z] [INFO] Applied migrations: [
|
|
[2Ksparkyfitness-server | '20250703170640_InitialDB.sql',
|
|
[2Ksparkyfitness-server | '20250710062500_create_goal_presets_table.sql',
|
|
[2Ksparkyfitness-server | '20250711173824_meal_features.sql',
|
|
[2Ksparkyfitness-server | '20250712163617_refactor_data_providers_and_add_exercise_source_id.sql',
|
|
[2Ksparkyfitness-server | '20250713125323_create_oidc_settings_and_update_users_table.sql',
|
|
[2Ksparkyfitness-server | '20250713135900_add_role_to_users_table.sql',
|
|
[2Ksparkyfitness-server | '20250713142300_add_oidc_config_fields.sql',
|
|
[2Ksparkyfitness-server | '20250714000000_create_session_table.sql',
|
|
[2Ksparkyfitness-server | '20250714175824_add_api_key_tag_to_ai_service_settings.sql',
|
|
[2Ksparkyfitness-server | '20250717190700_add_cascading_deletes.sql',
|
|
[2Ksparkyfitness-server | '20250717233929_add_is_quick_food_to_foods.sql',
|
|
[2Ksparkyfitness-server | '20250718190226_add_food_display_limit_to_user_preferences.sql',
|
|
[2Ksparkyfitness-server | '20250719131500_add_meal_percentages.sql',
|
|
[2Ksparkyfitness-server | '20250719215400_add_login_management_to_oidc_settings.sql',
|
|
[2Ksparkyfitness-server | '20250720010000_create_user_nutrient_display_preferences.sql',
|
|
[2Ksparkyfitness-server | '20250720201800_rename_food_display_limit_to_item_display_limit.sql',
|
|
[2Ksparkyfitness-server | '20250720220000_add_water_tracking_features.sql',
|
|
[2Ksparkyfitness-server | '20250720233836_alter_water_goal_ml_to_numeric.sql',
|
|
[2Ksparkyfitness-server | '20250721000000_add_servings_per_container_to_water_containers.sql',
|
|
[2Ksparkyfitness-server | '20250721000000_alter_water_container_volume_to_numeric.sql',
|
|
[2Ksparkyfitness-server | '20250721014900_alter_water_ml_to_numeric.sql',
|
|
[2Ksparkyfitness-server | '20250819062400_add_mealie_provider_type.sql',
|
|
[2Ksparkyfitness-server | '20250819083500_add_base_url_to_external_data_providers.sql',
|
|
[2Ksparkyfitness-server | '202508201215_add_garmin_integration_schema.sql',
|
|
[2Ksparkyfitness-server | '20250821090000_update_external_data_providers_provider_type_check.sql',
|
|
[2Ksparkyfitness-server | '20250821091500_add_garth_token_dump_to_external_data_providers.sql',
|
|
[2Ksparkyfitness-server | '20250821102000_remove_redundant_token_fields_from_external_data_providers.sql',
|
|
[2Ksparkyfitness-server | '20250831063900_create_mood_entries_table.sql',
|
|
[2Ksparkyfitness-server | '20250927180257_alter_exercises_table.sql',
|
|
[2Ksparkyfitness-server | '20250927212000_add_free_exercise_db_to_provider_type_check.sql',
|
|
[2Ksparkyfitness-server | '20250930002100_add_sets_reps_weight_to_exercise_entries.sql',
|
|
[2Ksparkyfitness-server | '20251001232600_add_gender_to_users_table.sql',
|
|
[2Ksparkyfitness-server | '20251002182306_create_backup_settings_table.sql',
|
|
[2Ksparkyfitness-server | '20251002224500_add_password_reset_to_users_table.sql',
|
|
[2Ksparkyfitness-server | '20251006021609_add_glycemic_index_to_foods_and_food_variants.sql',
|
|
[2Ksparkyfitness-server | '20251006220500_create_admin_activity_logs_table.sql',
|
|
[2Ksparkyfitness-server | '20251008224256_add_workout_features.sql',
|
|
[2Ksparkyfitness-server | '20251012225400_add_primary_keys_to_workout_tables.sql',
|
|
[2Ksparkyfitness-server | '20251012225500_add_multiple_sets_to_presets.sql',
|
|
[2Ksparkyfitness-server | '20251012225900_add_multiple_sets_to_plans.sql',
|
|
[2Ksparkyfitness-server | '20251012230000_add_multiple_sets_to_exercise_entries.sql',
|
|
[2Ksparkyfitness-server | '20251015223200_convert_weights_to_kg_and_set_default.sql',
|
|
[2Ksparkyfitness-server | '202510170132_add_text_measurements.sql',
|
|
[2Ksparkyfitness-server | '20251017200900_add_multiple_oidc_providers.sql',
|
|
[2Ksparkyfitness-server | '20251017204200_create_global_settings.sql',
|
|
[2Ksparkyfitness-server | '20251018001151_add_bmr_and_bodyfat_preferences.sql',
|
|
[2Ksparkyfitness-server | '20251018223700_add_signing_alg_to_oidc_providers.sql',
|
|
[2Ksparkyfitness-server | '20251019013200_merged_schema_and_data.sql',
|
|
[2Ksparkyfitness-server | '20251019013300_merged_rls_policies.sql',
|
|
[2K[2Ksparkyfitness-server | '20251019154515_update_rls_policies_for_shared_items.sql',
|
|
[2Ksparkyfitness-server | '20251019203500_fix_rls_permissions_for_public_foods.sql',
|
|
[2Ksparkyfitness-server | '20251019204000_correct_variant_rls_policy.sql',
|
|
[2Ksparkyfitness-server | '20251019212500_update_measurement_rls_policies.sql',
|
|
[2Ksparkyfitness-server | '20251019222100_add_audit_columns_to_measurements.sql',
|
|
[2Ksparkyfitness-server | '20251020001000_fix_family_access_insert_policy.sql',
|
|
[2Ksparkyfitness-server | '20251020022000_set_default_shared_with_public.sql',
|
|
[2Ksparkyfitness-server | '20251020022200_update_rls_policies.sql',
|
|
[2Ksparkyfitness-server | '20251020022500_fix_food_select_policy.sql',
|
|
[2Ksparkyfitness-server | '20251020030000_simplify_food_select_policy.sql',
|
|
[2Ksparkyfitness-server | '20251020031000_update_food_select_policy_with_sharing.sql',
|
|
[2Ksparkyfitness-server | '20251020032200_add_all_owner_centric_policies.sql',
|
|
[2Ksparkyfitness-server | '20251020033400_add_food_variants_rls_policy.sql',
|
|
[2Ksparkyfitness-server | '20251020033700_fix_food_variants_rls_policy.sql',
|
|
sparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_medication_read_access(user_id));
|
|
[2Ksparkyfitness-server | '20251020230839_fix_family_access_rls_policies.sql',
|
|
[2Ksparkyfitness-server | '20251021025423_restrict_family_access_select_policy.sql',
|
|
[2Ksparkyfitness-server | '20251021034700_add_public_sharing_to_external_providers.sql',
|
|
[2Ksparkyfitness-server | '20251022201000_fix_exercise_rls_policy.sql',
|
|
[2Ksparkyfitness-server | '20251022203000_snapshot_exercise_details_in_entries.sql',
|
|
[2Ksparkyfitness-server | '20251023120500_update_external_providers_select_policy_for_public.sql',
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_medication_access(user_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (has_medication_access(user_id));
|
|
[2Ksparkyfitness-server | '20251023221000_update_meals_rls_policy.sql',
|
|
[2Ksparkyfitness-server | '20251023221500_update_meal_plan_template_assignments_rls_policy.sql',
|
|
[2Ksparkyfitness-server | '20251023221501_add_meal_id_to_food_entries.sql',
|
|
[2Ksparkyfitness-server | '20251024230330_add_withings_fields_to_external_data_providers.sql',
|
|
[2Ksparkyfitness-server | '20251025210900_add_source_to_custom_measurements.sql',
|
|
[2Ksparkyfitness-server | '20251026125900_add_distance_and_hr_to_exercise_entries_activity_details.sql',
|
|
[2Ksparkyfitness-server | '202510310132_add_language_to_user_preferences.sql',
|
|
[2Ksparkyfitness-server | '20251101151100_create_sleep_entries_table.sql',
|
|
[2Ksparkyfitness-server | '20251103000000_add_onboarding_schema.sql',
|
|
[2Ksparkyfitness-server | '20251112000000_add_display_name_to_custom_categories.sql',
|
|
[2Ksparkyfitness-server | '20251114205134_create_exercise_preset_entries_table.sql',
|
|
[2Ksparkyfitness-server | '20251115003147_add_source_to_exercise_preset_entries.sql',
|
|
[2Ksparkyfitness-server | '20251115003301_add_exercise_preset_entry_id_to_activity_details.sql',
|
|
[2Ksparkyfitness-server | '20251115004027_alter_exercise_entry_id_nullable_in_activity_details.sql',
|
|
[2Ksparkyfitness-server | '20251120011100_add_mfa_magic_link_columns.sql',
|
|
[2Ksparkyfitness-server | '20251121011500_add_email_mfa_columns_to_users.sql',
|
|
[2Ksparkyfitness-server | '202511220110_add_default_external_data_providers.sql',
|
|
[2Ksparkyfitness-server | '202511232110_delete_raw_stress_data_categories.sql',
|
|
[2Ksparkyfitness-server | '202511270109_add_calorie_goal_adjustment_mode_to_user_preferences.sql',
|
|
[2Ksparkyfitness-server | '20251127194107_create_food_entry_meals_and_link_food_entries.sql',
|
|
[2Ksparkyfitness-server | '20251127194108_migrate_aggregated_food_entries_to_food_entry_meals.sql',
|
|
[2Ksparkyfitness-server | '20251128030115_add_tandoor_provider_type.sql',
|
|
[2Ksparkyfitness-server | '20251205000000_add_energy_unit_to_user_preferences.sql',
|
|
[2Ksparkyfitness-server | '20251206000000_add_nutrient_calculation_algorithms.sql',
|
|
[2Ksparkyfitness-server | '20251206000001_add_serving_size_to_meals.sql',
|
|
[2Ksparkyfitness-server | '20251207000001_add_default_meal_quantity.sql',
|
|
[2K[2Ksparkyfitness-db | ', table_name, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $$;
|
|
[2Ksparkyfitness-db |
|
|
sparkyfitness-server | '20251215005329_add_usda_to_provider_type_check.sql',
|
|
[2Ksparkyfitness-db | -- Step 5: Apply policies to all tables.
|
|
[2Ksparkyfitness-server | '20251221000000_create_fasting_logs.sql',
|
|
[2Ksparkyfitness-server | '20251221010000_drop_mood_weight_from_fasting_logs.sql',
|
|
[2Ksparkyfitness-server | '20251226150700_add_mobile_health_data_features.sql',
|
|
[2Ksparkyfitness-server | '20251228000000_add_custom_nutrients_tables.sql',
|
|
[2Ksparkyfitness-server | ... 193 more items
|
|
[2Ksparkyfitness-server | ]
|
|
[2Ksparkyfitness-server | [2026-11-03T02:01:39.681Z] [INFO] Ensuring permissions for role: "sparkyapp"
|
|
[2Ksparkyfitness-server | [2026-11-03T02:01:39.725Z] [INFO] Successfully ensured permissions for role: "sparkyapp"
|
|
[2Ksparkyfitness-server | [2026-11-03T02:01:39.726Z] [INFO] Permissions granted to application user.
|
|
[2Ksparkyfitness-server | [2026-11-03T02:01:39.726Z] [INFO] Applying all RLS policies from rls_policies.sql...
|
|
[2Ksparkyfitness-server | [2026-11-03T02:01:39.845Z] [ERROR] Error applying RLS policies: error: relation "public.user_custom_symptom_locations" does not exist
|
|
[2Ksparkyfitness-server | at /app/SparkyFitnessServer/node_modules/.pnpm/pg@8.20.0/node_modules/pg/lib/client.js:631:17
|
|
[2K[2Ksparkyfitness-server | at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
|
|
sparkyfitness-db | -- Custom policy for ai_service_settings to support admin-global + user-owned settings
|
|
[2Ksparkyfitness-server | at async applyRlsPolicies (/app/SparkyFitnessServer/utils/applyRlsPolicies.ts:15:5) {
|
|
[2Ksparkyfitness-db | -- Drop ALL possible old policy names before recreating
|
|
[2Ksparkyfitness-server | length: 282,
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS owner_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-server | severity: 'ERROR',
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS select_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-server | code: '42P01',
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS modify_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-server | detail: undefined,
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_select_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-server | hint: undefined,
|
|
[2Ksparkyfitness-server | position: undefined,
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_insert_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_update_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_delete_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | -- SELECT policy: All authenticated users can read public settings, users can read their own
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_select_policy ON public.ai_service_settings FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND authenticated_user_id() IS NOT NULL) OR
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-server | internalPosition: undefined,
|
|
[2Ksparkyfitness-server | internalQuery: undefined,
|
|
[2Ksparkyfitness-server | where: 'SQL statement "ALTER TABLE public.user_custom_symptom_locations ENABLE ROW LEVEL SECURITY;"\n' +
|
|
[2Ksparkyfitness-server | 'PL/pgSQL function inline_code_block line 86 at EXECUTE',
|
|
[2Ksparkyfitness-server | schema: undefined,
|
|
[2Ksparkyfitness-server | table: undefined,
|
|
[2Ksparkyfitness-server | column: undefined,
|
|
[2Ksparkyfitness-server | dataType: undefined,
|
|
[2Ksparkyfitness-server | constraint: undefined,
|
|
[2Ksparkyfitness-server | file: 'namespace.c',
|
|
[2Ksparkyfitness-server | line: '631',
|
|
[2Ksparkyfitness-server | routine: 'RangeVarGetRelidExtended'
|
|
[2Ksparkyfitness-server | }
|
|
[2Ksparkyfitness-server | Failed to start server: error: relation "public.user_custom_symptom_locations" does not exist
|
|
[2Ksparkyfitness-server | at /app/SparkyFitnessServer/node_modules/.pnpm/pg@8.20.0/node_modules/pg/lib/client.js:631:17
|
|
[2Ksparkyfitness-server | at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
|
|
[2Ksparkyfitness-server | at async applyRlsPolicies (/app/SparkyFitnessServer/utils/applyRlsPolicies.ts:15:5) {
|
|
[2Ksparkyfitness-server | length: 282,
|
|
[2Ksparkyfitness-server | severity: 'ERROR',
|
|
[2Ksparkyfitness-server | code: '42P01',
|
|
[2Ksparkyfitness-server | detail: undefined,
|
|
[2Ksparkyfitness-server | hint: undefined,
|
|
[2Ksparkyfitness-server | position: undefined,
|
|
[2Ksparkyfitness-server | internalPosition: undefined,
|
|
[2Ksparkyfitness-server | internalQuery: undefined,
|
|
[2Ksparkyfitness-server | where: 'SQL statement "ALTER TABLE public.user_custom_symptom_locations ENABLE ROW LEVEL SECURITY;"\n' +
|
|
[2Ksparkyfitness-server | 'PL/pgSQL function inline_code_block line 86 at EXECUTE',
|
|
[2Ksparkyfitness-server | schema: undefined,
|
|
[2Ksparkyfitness-server | table: undefined,
|
|
[2Ksparkyfitness-server | column: undefined,
|
|
[2K[2Ksparkyfitness-server | dataType: undefined,
|
|
sparkyfitness-db | -- INSERT policy: Users can create their own settings, admins can create public settings
|
|
[2Ksparkyfitness-server | constraint: undefined,
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_insert_policy ON public.ai_service_settings FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-server | file: 'namespace.c',
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-server | line: '631',
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- UPDATE policy: Users can update their own settings, admins can update public settings
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_update_policy ON public.ai_service_settings FOR UPDATE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- DELETE policy: Users can delete their own settings, admins can delete public settings
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_delete_policy ON public.ai_service_settings FOR DELETE TO PUBLIC
|
|
[2Ksparkyfitness-server | routine: 'RangeVarGetRelidExtended'
|
|
[2Ksparkyfitness-server | }
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Owner-only access tables
|
|
[2Ksparkyfitness-db | -- Tier 1: Strictly Private (no delegation allowed)
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('api_key', 'reference_id');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_oidc_links');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('sparky_chat_history');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Profiles: delegates can read (with any meaningful permission) but only owner can write.
|
|
[2Ksparkyfitness-db | -- Delegates do not need to modify another user's profile to manage their diary.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.profiles FOR SELECT TO PUBLIC USING (has_profile_read_access(id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.profiles FOR ALL TO PUBLIC USING (authenticated_user_id() = id) WITH CHECK (authenticated_user_id() = id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_preferences FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_preferences FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_goals');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('weekly_goal_plans');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_water_containers');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_custom_nutrients');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_allergen_preferences');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Nutrient display preferences: delegates can read but only owner can rearrange their own columns.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_nutrient_display_preferences FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_nutrient_display_preferences FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Dashboard layouts: delegates can read but only owner can rearrange their own dashboard.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_dashboard_layouts FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_dashboard_layouts FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('goal_presets');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('meal_plans');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('mood_entries');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Admin Activity Logs: Only the admin who performed the action or other admins can view
|
|
[2Ksparkyfitness-db | CREATE POLICY admin_only_select ON public.admin_activity_logs FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (admin_user_id = current_user_id() OR is_admin());
|
|
[2Ksparkyfitness-db | CREATE POLICY admin_only_insert ON public.admin_activity_logs FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (admin_user_id = current_user_id() AND is_admin());
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Diary access tables
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('check_in_measurements');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('check_in_photos');
|
|
[2Ksparkyfitness-db | -- Custom categories/measurements are surfaced through the check-in feature and
|
|
[2Ksparkyfitness-db | -- every /measurements route is guarded by checkPermissionMiddleware('checkin'),
|
|
[2Ksparkyfitness-db | -- so their RLS must use the check-in policy. The previous diary policy required
|
|
[2Ksparkyfitness-db | -- can_manage_diary to write, which blocked check-in delegates (e.g. the GLP-1
|
|
[2Ksparkyfitness-db | -- daily check-in) from saving even though the route allowed them.
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('custom_categories');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('custom_measurements');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('exercise_entries');
|
|
[2Ksparkyfitness-db | -- Custom policy for exercise_entries to allow access if linked to an owned exercise_preset_entry
|
|
[2Ksparkyfitness-db | CREATE POLICY select_exercise_preset_entry_linked_policy ON public.exercise_entries FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | exercise_preset_entry_id IS NOT NULL AND EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.exercise_preset_entries epe
|
|
[2Ksparkyfitness-db | WHERE epe.id = exercise_entries.exercise_preset_entry_id AND has_diary_read_access(epe.user_id)
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- The modify policy for exercise_entries is already handled by create_diary_policy('exercise_entries')
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('exercise_preset_entries');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('food_entry_meals');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('sleep_entries');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('sleep_entry_stages');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('water_intake');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('water_intake_entries');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Library access tables
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('exercises', 'shared_with_public', ARRAY['can_view_exercise_library', 'can_manage_diary']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('foods', 'shared_with_public', ARRAY['can_view_food_library', 'can_manage_diary']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('meals', 'is_public', ARRAY['can_view_food_library', 'can_manage_diary']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('meal_plan_templates', 'false', ARRAY['can_view_food_library']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('workout_plan_templates', 'false', ARRAY['can_view_exercise_library']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('workout_presets', 'is_public', ARRAY['can_view_exercise_library','can_manage_diary']);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Medication & GLP-1 tracker (see migration 20260624000000_add_medication_glp1_schema.sql).
|
|
[2Ksparkyfitness-db | -- These tables are managed by create_medication_policy at the bottom of this file (Tier 3).
|
|
[2Ksparkyfitness-db | -- Do NOT apply create_library_policy or create_diary_policy to medication tables.
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_medication_display_preferences');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Cycle & Pregnancy hub (see migration 20260702180000_add_cycle_tracking_schema.sql).
|
|
[2Ksparkyfitness-db | -- Tier 1 — owner-only. Deliberately stricter than medications: this reproductive
|
|
[2Ksparkyfitness-db | -- health data is NEVER shared or delegated in v1 (no family/caregiver access).
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycle_settings');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycle_daily_entries');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycles');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_cycle_display_preferences');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycle_test_entries');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Pregnancy mode (see migration 20260702200000_add_pregnancy_schema.sql). Tier 1
|
|
[2Ksparkyfitness-db | -- owner-only. health_appointments is generic but still owner-only in v1.
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancies');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_kick_sessions');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_contractions');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_photos');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_checklist_state');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('health_appointments');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- User-defined mood tags. Mood is check-in data (mood_entries uses the check-in
|
|
[2Ksparkyfitness-db | -- policy), and custom check-in definitions like custom_categories are shared with
|
|
[2Ksparkyfitness-db | -- check-in delegates — so custom moods follow the same check-in policy for
|
|
[2Ksparkyfitness-db | -- consistency (a delegate managing the owner's check-in sees the owner's moods).
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('user_custom_moods');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Mood display preferences: personal picker config, owner-only.
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_mood_display_preferences');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Custom policies for special cases
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.exercise_entry_sets FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_sets.exercise_entry_id AND has_diary_read_access(ee.user_id)));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.exercise_entry_sets FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_sets.exercise_entry_id AND has_diary_access(ee.user_id)))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_sets.exercise_entry_id AND has_diary_access(ee.user_id)));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Provider configs: admin-global (is_public) OR own OR family delegation
|
|
[2Ksparkyfitness-db | -- Drop any old policy names first (idempotent)
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS select_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS modify_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS insert_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS update_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS delete_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- SELECT: admin-global (authenticated users), own, or explicit family delegation
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.external_data_providers FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | -- Admin-created global providers: all authenticated users can see them if active
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_active = TRUE AND authenticated_user_id() IS NOT NULL)
|
|
[2Ksparkyfitness-db | -- Owner always sees their own providers
|
|
[2Ksparkyfitness-db | OR (is_public = FALSE AND current_user_id() = user_id)
|
|
[2Ksparkyfitness-db | OR (
|
|
[2Ksparkyfitness-db | -- Explicit family delegation: share_external_providers permission, non-strictly-private only, must be active
|
|
[2Ksparkyfitness-db | is_public = FALSE AND is_active = TRUE AND has_family_access(user_id, 'share_external_providers') AND EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.external_provider_types ept
|
|
[2Ksparkyfitness-db | WHERE ept.id = external_data_providers.provider_type
|
|
[2Ksparkyfitness-db | AND ept.is_strictly_private = FALSE
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- INSERT: users create their own (is_public=FALSE), admins create global (is_public=TRUE)
|
|
[2Ksparkyfitness-db | CREATE POLICY insert_policy ON public.external_data_providers FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- UPDATE: users update own, admins update global
|
|
[2Ksparkyfitness-db | CREATE POLICY update_policy ON public.external_data_providers FOR UPDATE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- DELETE: users delete own, admins delete global
|
|
[2Ksparkyfitness-db | CREATE POLICY delete_policy ON public.external_data_providers FOR DELETE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.family_access FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = owner_user_id OR authenticated_user_id() = family_user_id);
|
|
[2Ksparkyfitness-db | CREATE POLICY insert_policy ON public.family_access FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = owner_user_id);
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.family_access FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = owner_user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = owner_user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.food_entries FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY insert_policy ON public.food_entries FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | has_diary_access(user_id) AND (
|
|
[2Ksparkyfitness-db | (food_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = food_entries.food_id)) OR
|
|
[2Ksparkyfitness-db | (meal_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.meals m WHERE m.id = food_entries.meal_id))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | CREATE POLICY update_policy ON public.food_entries FOR UPDATE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_access(user_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (has_diary_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY delete_policy ON public.food_entries FOR DELETE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_access(user_id));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.food_variants FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.foods f
|
|
[2Ksparkyfitness-db | WHERE f.id = food_variants.food_id
|
|
[2Ksparkyfitness-db | AND has_library_access_with_public(f.user_id, f.shared_with_public, ARRAY['can_view_food_library', 'can_manage_diary'])
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- Food variants are library data: only the owner of the parent food may write
|
|
[2Ksparkyfitness-db | -- them. Delegates (even can_manage_diary) get read-only access via select_policy
|
|
[2Ksparkyfitness-db | -- so they can pick serving sizes while logging, but cannot mutate the library.
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.food_variants FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.foods f
|
|
[2Ksparkyfitness-db | WHERE f.id = food_variants.food_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = f.user_id
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.foods f
|
|
[2Ksparkyfitness-db | WHERE f.id = food_variants.food_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = f.user_id
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- meal_foods is polymorphic: a row references either a food (item_type='food')
|
|
[2Ksparkyfitness-db | -- or another meal (item_type='meal', a reusable sub-meal). Read access follows
|
|
[2Ksparkyfitness-db | -- the parent meal. Write access requires the caller owns the parent meal AND the
|
|
[2Ksparkyfitness-db | -- referenced ingredient is accessible to them: a food they can view, or a child
|
|
[2Ksparkyfitness-db | -- meal they have library access to (prevents linking a meal you cannot see).
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.meal_foods FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_foods.meal_id AND has_library_access_with_public(m.user_id, m.is_public, ARRAY['can_view_food_library', 'can_manage_diary'])));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.meal_foods FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_foods.meal_id AND authenticated_user_id() = m.user_id)
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_foods.meal_id AND authenticated_user_id() = m.user_id)
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (meal_foods.food_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = meal_foods.food_id))
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | (meal_foods.child_meal_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.meals cm WHERE cm.id = meal_foods.child_meal_id AND has_library_access_with_public(cm.user_id, cm.is_public, ARRAY['can_view_food_library', 'can_manage_diary'])))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.meal_plan_template_assignments FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.meal_plan_templates mpt WHERE mpt.id = meal_plan_template_assignments.template_id AND has_diary_access(mpt.user_id)) AND
|
|
[2Ksparkyfitness-db | (((item_type = 'food') AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = meal_plan_template_assignments.food_id)) OR
|
|
[2Ksparkyfitness-db | ((item_type = 'meal') AND EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_plan_template_assignments.meal_id))))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.meal_plan_templates mpt WHERE mpt.id = meal_plan_template_assignments.template_id AND has_diary_access(mpt.user_id)) AND
|
|
[2Ksparkyfitness-db | (((item_type = 'food') AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = meal_plan_template_assignments.food_id)) OR
|
|
[2Ksparkyfitness-db | ((item_type = 'meal') AND EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_plan_template_assignments.meal_id))));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.workout_plan_assignment_sets FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_plan_template_assignments wpta WHERE wpta.id = workout_plan_assignment_sets.assignment_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.workout_plan_template_assignments wpta WHERE wpta.id = workout_plan_assignment_sets.assignment_id));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.workout_plan_template_assignments FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_plan_templates wpt WHERE wpt.id = workout_plan_template_assignments.template_id AND has_diary_access(wpt.user_id)))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.workout_plan_templates wpt WHERE wpt.id = workout_plan_template_assignments.template_id AND has_diary_access(wpt.user_id)));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.workout_preset_exercise_sets FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_preset_exercises wpe WHERE wpe.id = workout_preset_exercise_sets.workout_preset_exercise_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.workout_preset_exercise_sets FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_preset_exercises wpe
|
|
[2Ksparkyfitness-db | JOIN public.workout_presets wp ON wp.id = wpe.workout_preset_id
|
|
[2Ksparkyfitness-db | WHERE wpe.id = workout_preset_exercise_sets.workout_preset_exercise_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_preset_exercises wpe
|
|
[2Ksparkyfitness-db | JOIN public.workout_presets wp ON wp.id = wpe.workout_preset_id
|
|
[2Ksparkyfitness-db | WHERE wpe.id = workout_preset_exercise_sets.workout_preset_exercise_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.workout_preset_exercises FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_presets wp WHERE wp.id = workout_preset_exercises.workout_preset_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.workout_preset_exercises FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_presets wp
|
|
[2Ksparkyfitness-db | WHERE wp.id = workout_preset_exercises.workout_preset_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_presets wp
|
|
[2Ksparkyfitness-db | WHERE wp.id = workout_preset_exercises.workout_preset_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Strictly Private (Tier 1)
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_ignored_updates');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Meal types: access if user_id is null (system) or if user has diary access
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.meal_types FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (user_id IS NULL OR has_diary_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.meal_types FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (user_id = authenticated_user_id())
|
|
[2Ksparkyfitness-db | WITH CHECK (user_id = authenticated_user_id());
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Activity details: access if linked exercise entry or preset entry is accessible
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.exercise_entry_activity_details FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (exercise_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_id AND has_diary_read_access(ee.user_id))) OR
|
|
[2Ksparkyfitness-db | (exercise_preset_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_preset_entries epe WHERE epe.id = exercise_preset_entry_id AND has_diary_read_access(epe.user_id)))
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.exercise_entry_activity_details FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (exercise_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_id AND has_diary_access(ee.user_id))) OR
|
|
[2Ksparkyfitness-db | (exercise_preset_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_preset_entries epe WHERE epe.id = exercise_preset_entry_id AND has_diary_access(epe.user_id)))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (exercise_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_id AND has_diary_access(ee.user_id))) OR
|
|
[2Ksparkyfitness-db | (exercise_preset_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_preset_entries epe WHERE epe.id = exercise_preset_entry_id AND has_diary_access(epe.user_id)))
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Shared View-Only (Tier 2)
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('fasting_logs');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_meal_visibilities');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('sleep_need_calculations');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('daily_sleep_need');
|
|
[2Ksparkyfitness-db | -- Day classification is a sleep/wellness (check-in) feature, used only by the
|
|
[2Ksparkyfitness-db | -- sleep-science service. It must use the check-in policy so check-in delegates
|
|
[2Ksparkyfitness-db | -- can manage it; the previous diary policy was a misclassification.
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('day_classification_cache');
|
|
[2Ksparkyfitness-db | -- Onboarding data/status: delegates can read (to avoid repeated onboarding prompts when viewing
|
|
[2Ksparkyfitness-db | -- another user's diary) but only the account owner can submit or reset their own onboarding.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.onboarding_data FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.onboarding_data FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.onboarding_status FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.onboarding_status FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Medications & Symptoms (Tier 3 - Delegate Writable with medications permission)
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medications');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_schedules');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_entries');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_pens');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('injection_entries');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_titration_steps');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('user_custom_symptoms');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('symptom_entries');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('user_custom_symptom_locations');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Medications Display Preferences (Tier 2 - Owner-Only Write, Delegate Read)
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_medication_display_preferences FOR SELECT TO PUBLIC USING (has_medication_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_medication_display_preferences FOR ALL TO PUBLIC USING (authenticated_user_id() = user_id) WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | 2026-11-03 02:58:58.177 CET [704] ERROR: relation "public.user_custom_symptom_locations" does not exist
|
|
[2Ksparkyfitness-db | 2026-11-03 02:58:58.177 CET [704] CONTEXT: SQL statement "ALTER TABLE public.user_custom_symptom_locations ENABLE ROW LEVEL SECURITY;"
|
|
[2Ksparkyfitness-db | PL/pgSQL function inline_code_block line 86 at EXECUTE
|
|
[2Ksparkyfitness-db | 2026-11-03 02:58:58.177 CET [704] STATEMENT: -- File: rls_policies.sql
|
|
[2Ksparkyfitness-db | -- =============================================================================
|
|
[2Ksparkyfitness-db | -- THIS FILE IS THE SINGLE SOURCE OF TRUTH FOR ALL RLS POLICIES IN THE APPLICATION.
|
|
[2Ksparkyfitness-db | -- It is executed on every server startup after migrations to ensure a consistent security state.
|
|
[2Ksparkyfitness-db | -- This script is generated from the db_schema_backup.sql to ensure all custom policies are included.
|
|
[2Ksparkyfitness-db | -- =============================================================================
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 1: Purge all existing RLS policies from the public schema in a single operation.
|
|
[2Ksparkyfitness-db | DO $$
|
|
[2Ksparkyfitness-db | DECLARE
|
|
[2Ksparkyfitness-db | pol RECORD;
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | FOR pol IN SELECT * FROM pg_policies WHERE schemaname = 'public'
|
|
[2Ksparkyfitness-db | LOOP
|
|
[2Ksparkyfitness-db | EXECUTE 'DROP POLICY IF EXISTS ' || quote_ident(pol.policyname) || ' ON ' || quote_ident(pol.schemaname) || '.' || quote_ident(pol.tablename);
|
|
[2Ksparkyfitness-db | END LOOP;
|
|
[2Ksparkyfitness-db | END $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 2: Enable RLS on all relevant tables to ensure consistent security state.
|
|
[2Ksparkyfitness-db | DO $$
|
|
[2Ksparkyfitness-db | DECLARE
|
|
[2Ksparkyfitness-db | table_name text;
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | FOR table_name IN SELECT unnest(ARRAY[
|
|
[2Ksparkyfitness-db | 'ai_service_settings',
|
|
[2Ksparkyfitness-db | 'check_in_measurements',
|
|
[2Ksparkyfitness-db | 'check_in_photos',
|
|
[2Ksparkyfitness-db | 'custom_categories',
|
|
[2Ksparkyfitness-db | 'custom_measurements',
|
|
[2Ksparkyfitness-db | 'exercise_entries',
|
|
[2Ksparkyfitness-db | 'exercise_entry_sets',
|
|
[2Ksparkyfitness-db | 'exercise_entry_activity_details',
|
|
[2Ksparkyfitness-db | 'exercises',
|
|
[2Ksparkyfitness-db | 'exercise_preset_entries',
|
|
[2Ksparkyfitness-db | 'external_data_providers',
|
|
[2Ksparkyfitness-db | 'family_access',
|
|
[2Ksparkyfitness-db | 'food_entries',
|
|
[2Ksparkyfitness-db | 'food_entry_meals',
|
|
[2Ksparkyfitness-db | 'food_variants',
|
|
[2Ksparkyfitness-db | 'foods',
|
|
[2Ksparkyfitness-db | 'goal_presets',
|
|
[2Ksparkyfitness-db | 'meal_foods',
|
|
[2Ksparkyfitness-db | 'meal_plan_template_assignments',
|
|
[2Ksparkyfitness-db | 'meal_plan_templates',
|
|
[2Ksparkyfitness-db | 'meal_plans',
|
|
[2Ksparkyfitness-db | 'meals',
|
|
[2Ksparkyfitness-db | 'meal_types',
|
|
[2Ksparkyfitness-db | 'mood_entries',
|
|
[2Ksparkyfitness-db | 'onboarding_data',
|
|
[2Ksparkyfitness-db | 'onboarding_status',
|
|
[2Ksparkyfitness-db | 'profiles',
|
|
[2Ksparkyfitness-db | 'sparky_chat_history',
|
|
[2Ksparkyfitness-db | 'admin_activity_logs',
|
|
[2Ksparkyfitness-db | 'api_key',
|
|
[2Ksparkyfitness-db | 'user_goals',
|
|
[2Ksparkyfitness-db | 'user_ignored_updates',
|
|
[2Ksparkyfitness-db | 'user_meal_visibilities',
|
|
[2Ksparkyfitness-db | 'user_nutrient_display_preferences',
|
|
[2Ksparkyfitness-db | 'user_oidc_links',
|
|
[2Ksparkyfitness-db | 'user_preferences',
|
|
[2Ksparkyfitness-db | 'user_water_containers',
|
|
[2Ksparkyfitness-db | 'water_intake',
|
|
[2Ksparkyfitness-db | 'water_intake_entries',
|
|
[2Ksparkyfitness-db | 'weekly_goal_plans',
|
|
[2Ksparkyfitness-db | 'workout_plan_assignment_sets',
|
|
[2Ksparkyfitness-db | 'workout_plan_template_assignments',
|
|
[2Ksparkyfitness-db | 'workout_plan_templates',
|
|
[2Ksparkyfitness-db | 'workout_preset_exercise_sets',
|
|
[2Ksparkyfitness-db | 'workout_preset_exercises',
|
|
[2Ksparkyfitness-db | 'workout_presets',
|
|
[2Ksparkyfitness-db | 'sleep_entries',
|
|
[2Ksparkyfitness-db | 'sleep_entry_stages',
|
|
[2Ksparkyfitness-db | 'fasting_logs',
|
|
[2Ksparkyfitness-db | 'user_custom_nutrients',
|
|
[2Ksparkyfitness-db | 'user_allergen_preferences',
|
|
[2Ksparkyfitness-db | 'user_dashboard_layouts',
|
|
[2Ksparkyfitness-db | 'sleep_need_calculations',
|
|
[2Ksparkyfitness-db | 'daily_sleep_need',
|
|
[2Ksparkyfitness-db | 'day_classification_cache',
|
|
[2Ksparkyfitness-db | 'medications',
|
|
[2Ksparkyfitness-db | 'medication_schedules',
|
|
[2Ksparkyfitness-db | 'medication_entries',
|
|
[2Ksparkyfitness-db | 'medication_pens',
|
|
[2Ksparkyfitness-db | 'injection_entries',
|
|
[2Ksparkyfitness-db | 'medication_titration_steps',
|
|
[2Ksparkyfitness-db | 'user_custom_symptoms',
|
|
[2Ksparkyfitness-db | 'symptom_entries',
|
|
[2Ksparkyfitness-db | 'user_medication_display_preferences',
|
|
[2Ksparkyfitness-db | 'user_custom_symptom_locations',
|
|
[2Ksparkyfitness-db | 'cycle_settings',
|
|
[2Ksparkyfitness-db | 'cycle_daily_entries',
|
|
[2Ksparkyfitness-db | 'cycles',
|
|
[2Ksparkyfitness-db | 'user_cycle_display_preferences',
|
|
[2Ksparkyfitness-db | 'cycle_test_entries',
|
|
[2Ksparkyfitness-db | 'pregnancies',
|
|
[2Ksparkyfitness-db | 'pregnancy_kick_sessions',
|
|
[2Ksparkyfitness-db | 'pregnancy_contractions',
|
|
[2Ksparkyfitness-db | 'pregnancy_photos',
|
|
[2Ksparkyfitness-db | 'pregnancy_checklist_state',
|
|
[2Ksparkyfitness-db | 'health_appointments',
|
|
[2Ksparkyfitness-db | 'user_custom_moods',
|
|
[2Ksparkyfitness-db | 'user_mood_display_preferences'
|
|
[2Ksparkyfitness-db | ]::text[])
|
|
[2Ksparkyfitness-db | LOOP
|
|
[2Ksparkyfitness-db | EXECUTE 'ALTER TABLE public.' || quote_ident(table_name) || ' ENABLE ROW LEVEL SECURITY;';
|
|
[2Ksparkyfitness-db | END LOOP;
|
|
[2Ksparkyfitness-db | END $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 3: Define reusable helper functions for common RLS conditions.
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION current_user_id() RETURNS uuid
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT NULLIF(current_setting('app.user_id', true), '')::uuid;
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION authenticated_user_id() RETURNS uuid
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT NULLIF(current_setting('app.authenticated_user_id', true), '')::uuid;
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.get_accessible_users(p_user_id UUID)
|
|
[2Ksparkyfitness-db | RETURNS TABLE(
|
|
[2Ksparkyfitness-db | user_id UUID,
|
|
[2Ksparkyfitness-db | full_name TEXT,
|
|
[2Ksparkyfitness-db | email TEXT,
|
|
[2Ksparkyfitness-db | permissions JSONB,
|
|
[2Ksparkyfitness-db | access_end_date TIMESTAMP WITH TIME ZONE
|
|
[2Ksparkyfitness-db | ) AS $func$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | RETURN QUERY
|
|
[2Ksparkyfitness-db | SELECT
|
|
[2Ksparkyfitness-db | fa.owner_user_id,
|
|
[2Ksparkyfitness-db | p.full_name,
|
|
[2Ksparkyfitness-db | u.email::TEXT,
|
|
[2Ksparkyfitness-db | fa.access_permissions,
|
|
[2Ksparkyfitness-db | fa.access_end_date
|
|
[2Ksparkyfitness-db | FROM public.family_access fa
|
|
[2Ksparkyfitness-db | JOIN public.profiles p ON p.id = fa.owner_user_id
|
|
[2Ksparkyfitness-db | JOIN public."user" u ON u.id = fa.owner_user_id
|
|
[2Ksparkyfitness-db | WHERE fa.family_user_id = p_user_id
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND has_any_meaningful_permission(fa.access_permissions);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $func$ LANGUAGE plpgsql STABLE;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.find_user_by_email(p_email TEXT)
|
|
[2Ksparkyfitness-db | RETURNS UUID AS $func$
|
|
[2Ksparkyfitness-db | DECLARE
|
|
[2Ksparkyfitness-db | v_user_id UUID;
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | SELECT id INTO v_user_id
|
|
[2Ksparkyfitness-db | FROM public."user"
|
|
[2Ksparkyfitness-db | WHERE LOWER(email) = LOWER(p_email)
|
|
[2Ksparkyfitness-db | LIMIT 1;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | RETURN v_user_id;
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $func$ LANGUAGE plpgsql STABLE SECURITY DEFINER;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_family_access(owner_uuid uuid, perm text) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (fa.access_permissions ->> perm)::boolean = true
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_family_access_or(owner_uuid uuid, perms text[]) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM unnest(perms) p
|
|
[2Ksparkyfitness-db | WHERE (fa.access_permissions ->> p)::boolean = true
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_diary_access(owner_uuid uuid) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (fa.access_permissions->>'can_manage_diary')::boolean = true
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Centralized helper: returns true if the given permissions JSONB contains
|
|
[2Ksparkyfitness-db | -- at least one meaningful delegation permission. Used by has_profile_read_access
|
|
[2Ksparkyfitness-db | -- and get_accessible_users to avoid duplicating the permission key list.
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_any_meaningful_permission(perms jsonb) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql IMMUTABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT (
|
|
[2Ksparkyfitness-db | (perms->>'can_manage_diary')::boolean = true OR
|
|
[2Ksparkyfitness-db | (perms->>'can_manage_checkin')::boolean = true OR
|
|
[2Ksparkyfitness-db | (perms->>'can_view_reports')::boolean = true OR
|
|
[2Ksparkyfitness-db | (perms->>'can_manage_medications')::boolean = true
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_profile_read_access(owner_uuid uuid) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | -- Owner always has access. Family delegates require at least one meaningful permission
|
|
[2Ksparkyfitness-db | -- (diary, checkin, medications, or reports) to read profile/layout/onboarding data.
|
|
[2Ksparkyfitness-db | -- A bare family_access row with no permissions does not grant read access.
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND has_any_meaningful_permission(fa.access_permissions)
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_diary_read_access(owner_uuid uuid) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_manage_diary')::boolean = true OR
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_view_reports')::boolean = true
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_checkin_read_access(owner_uuid uuid) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_manage_checkin')::boolean = true OR
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_view_reports')::boolean = true
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.has_medication_access(owner_uuid uuid) RETURNS boolean
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (fa.access_permissions->>'can_manage_medications')::boolean = true
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.has_medication_read_access(owner_uuid uuid) RETURNS boolean
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_manage_medications')::boolean = true OR
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_view_reports')::boolean = true
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_library_access_with_public(owner_uuid uuid, is_shared bool, perms text[]) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid
|
|
[2Ksparkyfitness-db | OR is_shared
|
|
[2Ksparkyfitness-db | OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_view_reports')::boolean = true OR
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM unnest(perms) p
|
|
[2Ksparkyfitness-db | WHERE (fa.access_permissions ->> p)::boolean = true
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | p <> 'can_manage_diary'
|
|
[2Ksparkyfitness-db | OR current_user_id() = owner_uuid
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | DROP FUNCTION IF EXISTS public.set_app_context(UUID, UUID);
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.set_app_context(p_user_id UUID, p_authenticated_user_id UUID)
|
|
[2Ksparkyfitness-db | RETURNS void AS $$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | -- app.user_id is used by RLS to determine whose data is being accessed
|
|
[2Ksparkyfitness-db | PERFORM set_config('app.user_id', p_user_id::text, false);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- app.authenticated_user_id is the actual logged-in user
|
|
[2Ksparkyfitness-db | PERFORM set_config('app.authenticated_user_id', p_authenticated_user_id::text, false);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $$ LANGUAGE plpgsql SECURITY DEFINER;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | DROP FUNCTION IF EXISTS public.can_access_user_data(UUID, TEXT, UUID);
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.can_access_user_data(
|
|
[2Ksparkyfitness-db | target_user_id UUID,
|
|
[2Ksparkyfitness-db | permission_type TEXT,
|
|
[2Ksparkyfitness-db | auth_user_id UUID
|
|
[2Ksparkyfitness-db | ) RETURNS BOOLEAN AS $func$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | -- Self access
|
|
[2Ksparkyfitness-db | IF target_user_id = auth_user_id THEN
|
|
[2Ksparkyfitness-db | RETURN TRUE;
|
|
[2Ksparkyfitness-db | END IF;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Family access check
|
|
[2Ksparkyfitness-db | RETURN EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1
|
|
[2Ksparkyfitness-db | FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.family_user_id = auth_user_id
|
|
[2Ksparkyfitness-db | AND fa.owner_user_id = target_user_id
|
|
[2Ksparkyfitness-db | AND fa.is_active = TRUE
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > NOW())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>permission_type)::BOOLEAN = TRUE
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | -- Mapping for common permission names
|
|
[2Ksparkyfitness-db | (permission_type = 'diary' AND (fa.access_permissions->>'can_manage_diary')::BOOLEAN = TRUE)
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | (permission_type = 'checkin' AND (fa.access_permissions->>'can_manage_checkin')::BOOLEAN = TRUE)
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | (permission_type = 'reports' AND (fa.access_permissions->>'can_view_reports')::BOOLEAN = TRUE)
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | -- Inheritance: reports permission grants read access to others
|
|
[2Ksparkyfitness-db | (permission_type IN ('calorie', 'diary', 'mood', 'sleep', 'exercise', 'water', 'checkin')
|
|
[2Ksparkyfitness-db | AND (COALESCE((fa.access_permissions->>'reports')::BOOLEAN, FALSE)
|
|
[2Ksparkyfitness-db | OR COALESCE((fa.access_permissions->>'can_view_reports')::BOOLEAN, FALSE)))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $func$ LANGUAGE plpgsql STABLE;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Helper function to check if authenticated user is admin
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION is_admin() RETURNS boolean
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public."user" u
|
|
[2Ksparkyfitness-db | WHERE u.id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND u.role = 'admin'
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 4: Define generic policy creation functions.
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_owner_policy(table_name text, id_column text DEFAULT 'user_id') RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (%I = authenticated_user_id())
|
|
[2Ksparkyfitness-db | WITH CHECK (%I = authenticated_user_id());
|
|
[2Ksparkyfitness-db | ', table_name, id_column, id_column);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_shared_owner_policy(table_name text, id_column text DEFAULT 'user_id') RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (%I = current_user_id());
|
|
[2Ksparkyfitness-db | ', table_name, id_column);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (%I = authenticated_user_id())
|
|
[2Ksparkyfitness-db | WITH CHECK (%I = authenticated_user_id());
|
|
[2Ksparkyfitness-db | ', table_name, id_column, id_column);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_diary_policy(table_name text) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_access(user_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (has_diary_access(user_id));
|
|
[2Ksparkyfitness-db | ', table_name, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_checkin_policy(table_name text) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_checkin_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id OR has_family_access(user_id, ''can_manage_checkin''))
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id OR has_family_access(user_id, ''can_manage_checkin''));
|
|
[2Ksparkyfitness-db | ', table_name, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_library_policy(table_name text, shared_column text, permissions text[]) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | DECLARE
|
|
[2Ksparkyfitness-db | quoted_permissions text;
|
|
[2Ksparkyfitness-db | shared_expression text;
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | -- Quote each permission name to ensure valid ARRAY syntax
|
|
[2Ksparkyfitness-db | SELECT array_to_string(ARRAY(
|
|
[2Ksparkyfitness-db | SELECT quote_literal(p) FROM unnest(permissions) p
|
|
[2Ksparkyfitness-db | ), ',') INTO quoted_permissions;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Use boolean false if shared_column is 'false', otherwise treat as column name
|
|
[2Ksparkyfitness-db | IF shared_column = 'false' THEN
|
|
[2Ksparkyfitness-db | shared_expression := 'false';
|
|
[2Ksparkyfitness-db | ELSE
|
|
[2Ksparkyfitness-db | shared_expression := quote_ident(shared_column);
|
|
[2Ksparkyfitness-db | END IF;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_library_access_with_public(user_id, %s, ARRAY[%s]));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db | ', table_name, shared_expression, quoted_permissions, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.create_medication_policy(table_name text) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_medication_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_medication_access(user_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (has_medication_access(user_id));
|
|
[2Ksparkyfitness-db | ', table_name, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 5: Apply policies to all tables.
|
|
[2Ksparkyfitness-db | -- Custom policy for ai_service_settings to support admin-global + user-owned settings
|
|
[2Ksparkyfitness-db | -- Drop ALL possible old policy names before recreating
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS owner_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS select_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS modify_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_select_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_insert_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_update_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_delete_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | -- SELECT policy: All authenticated users can read public settings, users can read their own
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_select_policy ON public.ai_service_settings FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND authenticated_user_id() IS NOT NULL) OR
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- INSERT policy: Users can create their own settings, admins can create public settings
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_insert_policy ON public.ai_service_settings FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- UPDATE policy: Users can update their own settings, admins can update public settings
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_update_policy ON public.ai_service_settings FOR UPDATE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- DELETE policy: Users can delete their own settings, admins can delete public settings
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_delete_policy ON public.ai_service_settings FOR DELETE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Owner-only access tables
|
|
[2Ksparkyfitness-db | -- Tier 1: Strictly Private (no delegation allowed)
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('api_key', 'reference_id');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_oidc_links');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('sparky_chat_history');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Profiles: delegates can read (with any meaningful permission) but only owner can write.
|
|
[2Ksparkyfitness-db | -- Delegates do not need to modify another user's profile to manage their diary.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.profiles FOR SELECT TO PUBLIC USING (has_profile_read_access(id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.profiles FOR ALL TO PUBLIC USING (authenticated_user_id() = id) WITH CHECK (authenticated_user_id() = id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_preferences FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_preferences FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_goals');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('weekly_goal_plans');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_water_containers');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_custom_nutrients');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_allergen_preferences');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Nutrient display preferences: delegates can read but only owner can rearrange their own columns.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_nutrient_display_preferences FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_nutrient_display_preferences FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Dashboard layouts: delegates can read but only owner can rearrange their own dashboard.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_dashboard_layouts FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_dashboard_layouts FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('goal_presets');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('meal_plans');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('mood_entries');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Admin Activity Logs: Only the admin who performed the action or other admins can view
|
|
[2Ksparkyfitness-db | CREATE POLICY admin_only_select ON public.admin_activity_logs FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (admin_user_id = current_user_id() OR is_admin());
|
|
[2Ksparkyfitness-db | CREATE POLICY admin_only_insert ON public.admin_activity_logs FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (admin_user_id = current_user_id() AND is_admin());
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Diary access tables
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('check_in_measurements');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('check_in_photos');
|
|
[2Ksparkyfitness-db | -- Custom categories/measurements are surfaced through the check-in feature and
|
|
[2Ksparkyfitness-db | -- every /measurements route is guarded by checkPermissionMiddleware('checkin'),
|
|
[2Ksparkyfitness-db | -- so their RLS must use the check-in policy. The previous diary policy required
|
|
[2Ksparkyfitness-db | -- can_manage_diary to write, which blocked check-in delegates (e.g. the GLP-1
|
|
[2Ksparkyfitness-db | -- daily check-in) from saving even though the route allowed them.
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('custom_categories');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('custom_measurements');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('exercise_entries');
|
|
[2Ksparkyfitness-db | -- Custom policy for exercise_entries to allow access if linked to an owned exercise_preset_entry
|
|
[2Ksparkyfitness-db | CREATE POLICY select_exercise_preset_entry_linked_policy ON public.exercise_entries FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | exercise_preset_entry_id IS NOT NULL AND EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.exercise_preset_entries epe
|
|
[2Ksparkyfitness-db | WHERE epe.id = exercise_entries.exercise_preset_entry_id AND has_diary_read_access(epe.user_id)
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- The modify policy for exercise_entries is already handled by create_diary_policy('exercise_entries')
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('exercise_preset_entries');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('food_entry_meals');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('sleep_entries');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('sleep_entry_stages');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('water_intake');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('water_intake_entries');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Library access tables
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('exercises', 'shared_with_public', ARRAY['can_view_exercise_library', 'can_manage_diary']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('foods', 'shared_with_public', ARRAY['can_view_food_library', 'can_manage_diary']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('meals', 'is_public', ARRAY['can_view_food_library', 'can_manage_diary']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('meal_plan_templates', 'false', ARRAY['can_view_food_library']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('workout_plan_templates', 'false', ARRAY['can_view_exercise_library']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('workout_presets', 'is_public', ARRAY['can_view_exercise_library','can_manage_diary']);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Medication & GLP-1 tracker (see migration 20260624000000_add_medication_glp1_schema.sql).
|
|
[2Ksparkyfitness-db | -- These tables are managed by create_medication_policy at the bottom of this file (Tier 3).
|
|
[2Ksparkyfitness-db | -- Do NOT apply create_library_policy or create_diary_policy to medication tables.
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_medication_display_preferences');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Cycle & Pregnancy hub (see migration 20260702180000_add_cycle_tracking_schema.sql).
|
|
[2Ksparkyfitness-db | -- Tier 1 — owner-only. Deliberately stricter than medications: this reproductive
|
|
[2Ksparkyfitness-db | -- health data is NEVER shared or delegated in v1 (no family/caregiver access).
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycle_settings');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycle_daily_entries');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycles');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_cycle_display_preferences');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycle_test_entries');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Pregnancy mode (see migration 20260702200000_add_pregnancy_schema.sql). Tier 1
|
|
[2Ksparkyfitness-db | -- owner-only. health_appointments is generic but still owner-only in v1.
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancies');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_kick_sessions');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_contractions');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_photos');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_checklist_state');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('health_appointments');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- User-defined mood tags. Mood is check-in data (mood_entries uses the check-in
|
|
[2Ksparkyfitness-db | -- policy), and custom check-in definitions like custom_categories are shared with
|
|
[2Ksparkyfitness-db | -- check-in delegates — so custom moods follow the same check-in policy for
|
|
[2Ksparkyfitness-db | -- consistency (a delegate managing the owner's check-in sees the owner's moods).
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('user_custom_moods');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Mood display preferences: personal picker config, owner-only.
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_mood_display_preferences');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Custom policies for special cases
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.exercise_entry_sets FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_sets.exercise_entry_id AND has_diary_read_access(ee.user_id)));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.exercise_entry_sets FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_sets.exercise_entry_id AND has_diary_access(ee.user_id)))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_sets.exercise_entry_id AND has_diary_access(ee.user_id)));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Provider configs: admin-global (is_public) OR own OR family delegation
|
|
[2Ksparkyfitness-db | -- Drop any old policy names first (idempotent)
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS select_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS modify_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS insert_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS update_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS delete_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- SELECT: admin-global (authenticated users), own, or explicit family delegation
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.external_data_providers FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | -- Admin-created global providers: all authenticated users can see them if active
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_active = TRUE AND authenticated_user_id() IS NOT NULL)
|
|
[2Ksparkyfitness-db | -- Owner always sees their own providers
|
|
[2Ksparkyfitness-db | OR (is_public = FALSE AND current_user_id() = user_id)
|
|
[2Ksparkyfitness-db | OR (
|
|
[2Ksparkyfitness-db | -- Explicit family delegation: share_external_providers permission, non-strictly-private only, must be active
|
|
[2Ksparkyfitness-db | is_public = FALSE AND is_active = TRUE AND has_family_access(user_id, 'share_external_providers') AND EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.external_provider_types ept
|
|
[2Ksparkyfitness-db | WHERE ept.id = external_data_providers.provider_type
|
|
[2Ksparkyfitness-db | AND ept.is_strictly_private = FALSE
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- INSERT: users create their own (is_public=FALSE), admins create global (is_public=TRUE)
|
|
[2Ksparkyfitness-db | CREATE POLICY insert_policy ON public.external_data_providers FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- UPDATE: users update own, admins update global
|
|
[2Ksparkyfitness-db | CREATE POLICY update_policy ON public.external_data_providers FOR UPDATE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- DELETE: users delete own, admins delete global
|
|
[2Ksparkyfitness-db | CREATE POLICY delete_policy ON public.external_data_providers FOR DELETE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.family_access FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = owner_user_id OR authenticated_user_id() = family_user_id);
|
|
[2Ksparkyfitness-db | CREATE POLICY insert_policy ON public.family_access FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = owner_user_id);
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.family_access FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = owner_user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = owner_user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.food_entries FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY insert_policy ON public.food_entries FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | has_diary_access(user_id) AND (
|
|
[2Ksparkyfitness-db | (food_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = food_entries.food_id)) OR
|
|
[2Ksparkyfitness-db | (meal_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.meals m WHERE m.id = food_entries.meal_id))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | CREATE POLICY update_policy ON public.food_entries FOR UPDATE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_access(user_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (has_diary_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY delete_policy ON public.food_entries FOR DELETE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_access(user_id));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.food_variants FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.foods f
|
|
[2Ksparkyfitness-db | WHERE f.id = food_variants.food_id
|
|
[2Ksparkyfitness-db | AND has_library_access_with_public(f.user_id, f.shared_with_public, ARRAY['can_view_food_library', 'can_manage_diary'])
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- Food variants are library data: only the owner of the parent food may write
|
|
[2Ksparkyfitness-db | -- them. Delegates (even can_manage_diary) get read-only access via select_policy
|
|
[2Ksparkyfitness-db | -- so they can pick serving sizes while logging, but cannot mutate the library.
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.food_variants FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.foods f
|
|
[2Ksparkyfitness-db | WHERE f.id = food_variants.food_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = f.user_id
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.foods f
|
|
[2Ksparkyfitness-db | WHERE f.id = food_variants.food_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = f.user_id
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- meal_foods is polymorphic: a row references either a food (item_type='food')
|
|
[2Ksparkyfitness-db | -- or another meal (item_type='meal', a reusable sub-meal). Read access follows
|
|
[2Ksparkyfitness-db | -- the parent meal. Write access requires the caller owns the parent meal AND the
|
|
[2Ksparkyfitness-db | -- referenced ingredient is accessible to them: a food they can view, or a child
|
|
[2Ksparkyfitness-db | -- meal they have library access to (prevents linking a meal you cannot see).
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.meal_foods FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_foods.meal_id AND has_library_access_with_public(m.user_id, m.is_public, ARRAY['can_view_food_library', 'can_manage_diary'])));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.meal_foods FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_foods.meal_id AND authenticated_user_id() = m.user_id)
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_foods.meal_id AND authenticated_user_id() = m.user_id)
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (meal_foods.food_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = meal_foods.food_id))
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | (meal_foods.child_meal_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.meals cm WHERE cm.id = meal_foods.child_meal_id AND has_library_access_with_public(cm.user_id, cm.is_public, ARRAY['can_view_food_library', 'can_manage_diary'])))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.meal_plan_template_assignments FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.meal_plan_templates mpt WHERE mpt.id = meal_plan_template_assignments.template_id AND has_diary_access(mpt.user_id)) AND
|
|
[2Ksparkyfitness-db | (((item_type = 'food') AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = meal_plan_template_assignments.food_id)) OR
|
|
[2Ksparkyfitness-db | ((item_type = 'meal') AND EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_plan_template_assignments.meal_id))))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.meal_plan_templates mpt WHERE mpt.id = meal_plan_template_assignments.template_id AND has_diary_access(mpt.user_id)) AND
|
|
[2Ksparkyfitness-db | (((item_type = 'food') AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = meal_plan_template_assignments.food_id)) OR
|
|
[2Ksparkyfitness-db | ((item_type = 'meal') AND EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_plan_template_assignments.meal_id))));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.workout_plan_assignment_sets FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_plan_template_assignments wpta WHERE wpta.id = workout_plan_assignment_sets.assignment_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.workout_plan_template_assignments wpta WHERE wpta.id = workout_plan_assignment_sets.assignment_id));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.workout_plan_template_assignments FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_plan_templates wpt WHERE wpt.id = workout_plan_template_assignments.template_id AND has_diary_access(wpt.user_id)))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.workout_plan_templates wpt WHERE wpt.id = workout_plan_template_assignments.template_id AND has_diary_access(wpt.user_id)));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.workout_preset_exercise_sets FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_preset_exercises wpe WHERE wpe.id = workout_preset_exercise_sets.workout_preset_exercise_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.workout_preset_exercise_sets FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_preset_exercises wpe
|
|
[2Ksparkyfitness-db | JOIN public.workout_presets wp ON wp.id = wpe.workout_preset_id
|
|
[2Ksparkyfitness-db | WHERE wpe.id = workout_preset_exercise_sets.workout_preset_exercise_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_preset_exercises wpe
|
|
[2Ksparkyfitness-db | JOIN public.workout_presets wp ON wp.id = wpe.workout_preset_id
|
|
[2Ksparkyfitness-db | WHERE wpe.id = workout_preset_exercise_sets.workout_preset_exercise_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.workout_preset_exercises FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_presets wp WHERE wp.id = workout_preset_exercises.workout_preset_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.workout_preset_exercises FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_presets wp
|
|
[2Ksparkyfitness-db | WHERE wp.id = workout_preset_exercises.workout_preset_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_presets wp
|
|
[2Ksparkyfitness-db | WHERE wp.id = workout_preset_exercises.workout_preset_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Strictly Private (Tier 1)
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_ignored_updates');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Meal types: access if user_id is null (system) or if user has diary access
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.meal_types FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (user_id IS NULL OR has_diary_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.meal_types FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (user_id = authenticated_user_id())
|
|
[2Ksparkyfitness-db | WITH CHECK (user_id = authenticated_user_id());
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Activity details: access if linked exercise entry or preset entry is accessible
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.exercise_entry_activity_details FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (exercise_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_id AND has_diary_read_access(ee.user_id))) OR
|
|
[2Ksparkyfitness-db | (exercise_preset_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_preset_entries epe WHERE epe.id = exercise_preset_entry_id AND has_diary_read_access(epe.user_id)))
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.exercise_entry_activity_details FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (exercise_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_id AND has_diary_access(ee.user_id))) OR
|
|
[2Ksparkyfitness-db | (exercise_preset_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_preset_entries epe WHERE epe.id = exercise_preset_entry_id AND has_diary_access(epe.user_id)))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (exercise_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_id AND has_diary_access(ee.user_id))) OR
|
|
[2Ksparkyfitness-db | (exercise_preset_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_preset_entries epe WHERE epe.id = exercise_preset_entry_id AND has_diary_access(epe.user_id)))
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Shared View-Only (Tier 2)
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('fasting_logs');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_meal_visibilities');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('sleep_need_calculations');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('daily_sleep_need');
|
|
[2Ksparkyfitness-db | -- Day classification is a sleep/wellness (check-in) feature, used only by the
|
|
[2Ksparkyfitness-db | -- sleep-science service. It must use the check-in policy so check-in delegates
|
|
[2Ksparkyfitness-db | -- can manage it; the previous diary policy was a misclassification.
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('day_classification_cache');
|
|
[2Ksparkyfitness-db | -- Onboarding data/status: delegates can read (to avoid repeated onboarding prompts when viewing
|
|
[2Ksparkyfitness-db | -- another user's diary) but only the account owner can submit or reset their own onboarding.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.onboarding_data FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.onboarding_data FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.onboarding_status FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.onboarding_status FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Medications & Symptoms (Tier 3 - Delegate Writable with medications permission)
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medications');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_schedules');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_entries');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_pens');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('injection_entries');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_titration_steps');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('user_custom_symptoms');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('symptom_entries');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('user_custom_symptom_locations');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Medications Display Preferences (Tier 2 - Owner-Only Write, Delegate Read)
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_medication_display_preferences FOR SELECT TO PUBLIC USING (has_medication_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_medication_display_preferences FOR ALL TO PUBLIC USING (authenticated_user_id() = user_id) WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | 2026-11-03 02:59:38.658 CET [736] ERROR: relation "public.user_custom_symptom_locations" does not exist
|
|
[2Ksparkyfitness-db | 2026-11-03 02:59:38.658 CET [736] CONTEXT: SQL statement "ALTER TABLE public.user_custom_symptom_locations ENABLE ROW LEVEL SECURITY;"
|
|
[2Ksparkyfitness-db | PL/pgSQL function inline_code_block line 86 at EXECUTE
|
|
[2Ksparkyfitness-db | 2026-11-03 02:59:38.658 CET [736] STATEMENT: -- File: rls_policies.sql
|
|
[2Ksparkyfitness-db | -- =============================================================================
|
|
[2Ksparkyfitness-db | -- THIS FILE IS THE SINGLE SOURCE OF TRUTH FOR ALL RLS POLICIES IN THE APPLICATION.
|
|
[2Ksparkyfitness-db | -- It is executed on every server startup after migrations to ensure a consistent security state.
|
|
[2Ksparkyfitness-db | -- This script is generated from the db_schema_backup.sql to ensure all custom policies are included.
|
|
[2Ksparkyfitness-db | -- =============================================================================
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 1: Purge all existing RLS policies from the public schema in a single operation.
|
|
[2Ksparkyfitness-db | DO $$
|
|
[2Ksparkyfitness-db | DECLARE
|
|
[2Ksparkyfitness-db | pol RECORD;
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | FOR pol IN SELECT * FROM pg_policies WHERE schemaname = 'public'
|
|
[2Ksparkyfitness-db | LOOP
|
|
[2Ksparkyfitness-db | EXECUTE 'DROP POLICY IF EXISTS ' || quote_ident(pol.policyname) || ' ON ' || quote_ident(pol.schemaname) || '.' || quote_ident(pol.tablename);
|
|
[2Ksparkyfitness-db | END LOOP;
|
|
[2Ksparkyfitness-db | END $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 2: Enable RLS on all relevant tables to ensure consistent security state.
|
|
[2Ksparkyfitness-db | DO $$
|
|
[2Ksparkyfitness-db | DECLARE
|
|
[2Ksparkyfitness-db | table_name text;
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | FOR table_name IN SELECT unnest(ARRAY[
|
|
[2Ksparkyfitness-db | 'ai_service_settings',
|
|
[2Ksparkyfitness-db | 'check_in_measurements',
|
|
[2Ksparkyfitness-db | 'check_in_photos',
|
|
[2Ksparkyfitness-db | 'custom_categories',
|
|
[2Ksparkyfitness-db | 'custom_measurements',
|
|
[2Ksparkyfitness-db | 'exercise_entries',
|
|
[2Ksparkyfitness-db | 'exercise_entry_sets',
|
|
[2Ksparkyfitness-db | 'exercise_entry_activity_details',
|
|
[2Ksparkyfitness-db | 'exercises',
|
|
[2Ksparkyfitness-db | 'exercise_preset_entries',
|
|
[2Ksparkyfitness-db | 'external_data_providers',
|
|
[2Ksparkyfitness-db | 'family_access',
|
|
[2Ksparkyfitness-db | 'food_entries',
|
|
[2Ksparkyfitness-db | 'food_entry_meals',
|
|
[2Ksparkyfitness-db | 'food_variants',
|
|
[2Ksparkyfitness-db | 'foods',
|
|
[2Ksparkyfitness-db | 'goal_presets',
|
|
[2Ksparkyfitness-db | 'meal_foods',
|
|
[2Ksparkyfitness-db | 'meal_plan_template_assignments',
|
|
[2Ksparkyfitness-db | 'meal_plan_templates',
|
|
[2Ksparkyfitness-db | 'meal_plans',
|
|
[2Ksparkyfitness-db | 'meals',
|
|
[2Ksparkyfitness-db | 'meal_types',
|
|
[2Ksparkyfitness-db | 'mood_entries',
|
|
[2Ksparkyfitness-db | 'onboarding_data',
|
|
[2Ksparkyfitness-db | 'onboarding_status',
|
|
[2Ksparkyfitness-db | 'profiles',
|
|
[2Ksparkyfitness-db | 'sparky_chat_history',
|
|
[2Ksparkyfitness-db | 'admin_activity_logs',
|
|
[2Ksparkyfitness-db | 'api_key',
|
|
[2Ksparkyfitness-db | 'user_goals',
|
|
[2Ksparkyfitness-db | 'user_ignored_updates',
|
|
[2Ksparkyfitness-db | 'user_meal_visibilities',
|
|
[2Ksparkyfitness-db | 'user_nutrient_display_preferences',
|
|
[2Ksparkyfitness-db | 'user_oidc_links',
|
|
[2Ksparkyfitness-db | 'user_preferences',
|
|
[2Ksparkyfitness-db | 'user_water_containers',
|
|
[2Ksparkyfitness-db | 'water_intake',
|
|
[2Ksparkyfitness-db | 'water_intake_entries',
|
|
[2Ksparkyfitness-db | 'weekly_goal_plans',
|
|
[2Ksparkyfitness-db | 'workout_plan_assignment_sets',
|
|
[2Ksparkyfitness-db | 'workout_plan_template_assignments',
|
|
[2Ksparkyfitness-db | 'workout_plan_templates',
|
|
[2Ksparkyfitness-db | 'workout_preset_exercise_sets',
|
|
[2Ksparkyfitness-db | 'workout_preset_exercises',
|
|
[2Ksparkyfitness-db | 'workout_presets',
|
|
[2Ksparkyfitness-db | 'sleep_entries',
|
|
[2Ksparkyfitness-db | 'sleep_entry_stages',
|
|
[2Ksparkyfitness-db | 'fasting_logs',
|
|
[2Ksparkyfitness-db | 'user_custom_nutrients',
|
|
[2Ksparkyfitness-db | 'user_allergen_preferences',
|
|
[2Ksparkyfitness-db | 'user_dashboard_layouts',
|
|
[2Ksparkyfitness-db | 'sleep_need_calculations',
|
|
[2Ksparkyfitness-db | 'daily_sleep_need',
|
|
[2Ksparkyfitness-db | 'day_classification_cache',
|
|
[2Ksparkyfitness-db | 'medications',
|
|
[2Ksparkyfitness-db | 'medication_schedules',
|
|
[2Ksparkyfitness-db | 'medication_entries',
|
|
[2Ksparkyfitness-db | 'medication_pens',
|
|
[2Ksparkyfitness-db | 'injection_entries',
|
|
[2Ksparkyfitness-db | 'medication_titration_steps',
|
|
[2Ksparkyfitness-db | 'user_custom_symptoms',
|
|
[2Ksparkyfitness-db | 'symptom_entries',
|
|
[2Ksparkyfitness-db | 'user_medication_display_preferences',
|
|
[2Ksparkyfitness-db | 'user_custom_symptom_locations',
|
|
[2Ksparkyfitness-db | 'cycle_settings',
|
|
[2Ksparkyfitness-db | 'cycle_daily_entries',
|
|
[2Ksparkyfitness-db | 'cycles',
|
|
[2Ksparkyfitness-db | 'user_cycle_display_preferences',
|
|
[2Ksparkyfitness-db | 'cycle_test_entries',
|
|
[2Ksparkyfitness-db | 'pregnancies',
|
|
[2Ksparkyfitness-db | 'pregnancy_kick_sessions',
|
|
[2Ksparkyfitness-db | 'pregnancy_contractions',
|
|
[2Ksparkyfitness-db | 'pregnancy_photos',
|
|
[2Ksparkyfitness-db | 'pregnancy_checklist_state',
|
|
[2Ksparkyfitness-db | 'health_appointments',
|
|
[2Ksparkyfitness-db | 'user_custom_moods',
|
|
[2Ksparkyfitness-db | 'user_mood_display_preferences'
|
|
[2Ksparkyfitness-db | ]::text[])
|
|
[2Ksparkyfitness-db | LOOP
|
|
[2Ksparkyfitness-db | EXECUTE 'ALTER TABLE public.' || quote_ident(table_name) || ' ENABLE ROW LEVEL SECURITY;';
|
|
[2Ksparkyfitness-db | END LOOP;
|
|
[2Ksparkyfitness-db | END $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 3: Define reusable helper functions for common RLS conditions.
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION current_user_id() RETURNS uuid
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT NULLIF(current_setting('app.user_id', true), '')::uuid;
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION authenticated_user_id() RETURNS uuid
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT NULLIF(current_setting('app.authenticated_user_id', true), '')::uuid;
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.get_accessible_users(p_user_id UUID)
|
|
[2Ksparkyfitness-db | RETURNS TABLE(
|
|
[2Ksparkyfitness-db | user_id UUID,
|
|
[2Ksparkyfitness-db | full_name TEXT,
|
|
[2Ksparkyfitness-db | email TEXT,
|
|
[2Ksparkyfitness-db | permissions JSONB,
|
|
[2Ksparkyfitness-db | access_end_date TIMESTAMP WITH TIME ZONE
|
|
[2Ksparkyfitness-db | ) AS $func$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | RETURN QUERY
|
|
[2Ksparkyfitness-db | SELECT
|
|
[2Ksparkyfitness-db | fa.owner_user_id,
|
|
[2Ksparkyfitness-db | p.full_name,
|
|
[2Ksparkyfitness-db | u.email::TEXT,
|
|
[2Ksparkyfitness-db | fa.access_permissions,
|
|
[2Ksparkyfitness-db | fa.access_end_date
|
|
[2Ksparkyfitness-db | FROM public.family_access fa
|
|
[2Ksparkyfitness-db | JOIN public.profiles p ON p.id = fa.owner_user_id
|
|
[2Ksparkyfitness-db | JOIN public."user" u ON u.id = fa.owner_user_id
|
|
[2Ksparkyfitness-db | WHERE fa.family_user_id = p_user_id
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND has_any_meaningful_permission(fa.access_permissions);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $func$ LANGUAGE plpgsql STABLE;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.find_user_by_email(p_email TEXT)
|
|
[2Ksparkyfitness-db | RETURNS UUID AS $func$
|
|
[2Ksparkyfitness-db | DECLARE
|
|
[2Ksparkyfitness-db | v_user_id UUID;
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | SELECT id INTO v_user_id
|
|
[2Ksparkyfitness-db | FROM public."user"
|
|
[2Ksparkyfitness-db | WHERE LOWER(email) = LOWER(p_email)
|
|
[2Ksparkyfitness-db | LIMIT 1;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | RETURN v_user_id;
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $func$ LANGUAGE plpgsql STABLE SECURITY DEFINER;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_family_access(owner_uuid uuid, perm text) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (fa.access_permissions ->> perm)::boolean = true
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_family_access_or(owner_uuid uuid, perms text[]) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM unnest(perms) p
|
|
[2Ksparkyfitness-db | WHERE (fa.access_permissions ->> p)::boolean = true
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_diary_access(owner_uuid uuid) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (fa.access_permissions->>'can_manage_diary')::boolean = true
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Centralized helper: returns true if the given permissions JSONB contains
|
|
[2Ksparkyfitness-db | -- at least one meaningful delegation permission. Used by has_profile_read_access
|
|
[2Ksparkyfitness-db | -- and get_accessible_users to avoid duplicating the permission key list.
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_any_meaningful_permission(perms jsonb) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql IMMUTABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT (
|
|
[2Ksparkyfitness-db | (perms->>'can_manage_diary')::boolean = true OR
|
|
[2Ksparkyfitness-db | (perms->>'can_manage_checkin')::boolean = true OR
|
|
[2Ksparkyfitness-db | (perms->>'can_view_reports')::boolean = true OR
|
|
[2Ksparkyfitness-db | (perms->>'can_manage_medications')::boolean = true
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_profile_read_access(owner_uuid uuid) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | -- Owner always has access. Family delegates require at least one meaningful permission
|
|
[2Ksparkyfitness-db | -- (diary, checkin, medications, or reports) to read profile/layout/onboarding data.
|
|
[2Ksparkyfitness-db | -- A bare family_access row with no permissions does not grant read access.
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND has_any_meaningful_permission(fa.access_permissions)
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_diary_read_access(owner_uuid uuid) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_manage_diary')::boolean = true OR
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_view_reports')::boolean = true
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_checkin_read_access(owner_uuid uuid) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_manage_checkin')::boolean = true OR
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_view_reports')::boolean = true
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.has_medication_access(owner_uuid uuid) RETURNS boolean
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (fa.access_permissions->>'can_manage_medications')::boolean = true
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.has_medication_read_access(owner_uuid uuid) RETURNS boolean
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_manage_medications')::boolean = true OR
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_view_reports')::boolean = true
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_library_access_with_public(owner_uuid uuid, is_shared bool, perms text[]) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid
|
|
[2Ksparkyfitness-db | OR is_shared
|
|
[2Ksparkyfitness-db | OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_view_reports')::boolean = true OR
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM unnest(perms) p
|
|
[2Ksparkyfitness-db | WHERE (fa.access_permissions ->> p)::boolean = true
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | p <> 'can_manage_diary'
|
|
[2Ksparkyfitness-db | OR current_user_id() = owner_uuid
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | DROP FUNCTION IF EXISTS public.set_app_context(UUID, UUID);
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.set_app_context(p_user_id UUID, p_authenticated_user_id UUID)
|
|
[2Ksparkyfitness-db | RETURNS void AS $$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | -- app.user_id is used by RLS to determine whose data is being accessed
|
|
[2Ksparkyfitness-db | PERFORM set_config('app.user_id', p_user_id::text, false);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- app.authenticated_user_id is the actual logged-in user
|
|
[2Ksparkyfitness-db | PERFORM set_config('app.authenticated_user_id', p_authenticated_user_id::text, false);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $$ LANGUAGE plpgsql SECURITY DEFINER;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | DROP FUNCTION IF EXISTS public.can_access_user_data(UUID, TEXT, UUID);
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.can_access_user_data(
|
|
[2Ksparkyfitness-db | target_user_id UUID,
|
|
[2Ksparkyfitness-db | permission_type TEXT,
|
|
[2Ksparkyfitness-db | auth_user_id UUID
|
|
[2Ksparkyfitness-db | ) RETURNS BOOLEAN AS $func$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | -- Self access
|
|
[2Ksparkyfitness-db | IF target_user_id = auth_user_id THEN
|
|
[2Ksparkyfitness-db | RETURN TRUE;
|
|
[2Ksparkyfitness-db | END IF;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Family access check
|
|
[2Ksparkyfitness-db | RETURN EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1
|
|
[2Ksparkyfitness-db | FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.family_user_id = auth_user_id
|
|
[2Ksparkyfitness-db | AND fa.owner_user_id = target_user_id
|
|
[2Ksparkyfitness-db | AND fa.is_active = TRUE
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > NOW())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>permission_type)::BOOLEAN = TRUE
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | -- Mapping for common permission names
|
|
[2Ksparkyfitness-db | (permission_type = 'diary' AND (fa.access_permissions->>'can_manage_diary')::BOOLEAN = TRUE)
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | (permission_type = 'checkin' AND (fa.access_permissions->>'can_manage_checkin')::BOOLEAN = TRUE)
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | (permission_type = 'reports' AND (fa.access_permissions->>'can_view_reports')::BOOLEAN = TRUE)
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | -- Inheritance: reports permission grants read access to others
|
|
[2Ksparkyfitness-db | (permission_type IN ('calorie', 'diary', 'mood', 'sleep', 'exercise', 'water', 'checkin')
|
|
[2Ksparkyfitness-db | AND (COALESCE((fa.access_permissions->>'reports')::BOOLEAN, FALSE)
|
|
[2Ksparkyfitness-db | OR COALESCE((fa.access_permissions->>'can_view_reports')::BOOLEAN, FALSE)))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $func$ LANGUAGE plpgsql STABLE;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Helper function to check if authenticated user is admin
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION is_admin() RETURNS boolean
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public."user" u
|
|
[2Ksparkyfitness-db | WHERE u.id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND u.role = 'admin'
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 4: Define generic policy creation functions.
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_owner_policy(table_name text, id_column text DEFAULT 'user_id') RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (%I = authenticated_user_id())
|
|
[2Ksparkyfitness-db | WITH CHECK (%I = authenticated_user_id());
|
|
[2Ksparkyfitness-db | ', table_name, id_column, id_column);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_shared_owner_policy(table_name text, id_column text DEFAULT 'user_id') RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (%I = current_user_id());
|
|
[2Ksparkyfitness-db | ', table_name, id_column);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (%I = authenticated_user_id())
|
|
[2Ksparkyfitness-db | WITH CHECK (%I = authenticated_user_id());
|
|
[2Ksparkyfitness-db | ', table_name, id_column, id_column);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_diary_policy(table_name text) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_access(user_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (has_diary_access(user_id));
|
|
[2Ksparkyfitness-db | ', table_name, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_checkin_policy(table_name text) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_checkin_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id OR has_family_access(user_id, ''can_manage_checkin''))
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id OR has_family_access(user_id, ''can_manage_checkin''));
|
|
[2Ksparkyfitness-db | ', table_name, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_library_policy(table_name text, shared_column text, permissions text[]) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | DECLARE
|
|
[2Ksparkyfitness-db | quoted_permissions text;
|
|
[2Ksparkyfitness-db | shared_expression text;
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | -- Quote each permission name to ensure valid ARRAY syntax
|
|
[2Ksparkyfitness-db | SELECT array_to_string(ARRAY(
|
|
[2Ksparkyfitness-db | SELECT quote_literal(p) FROM unnest(permissions) p
|
|
[2Ksparkyfitness-db | ), ',') INTO quoted_permissions;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Use boolean false if shared_column is 'false', otherwise treat as column name
|
|
[2Ksparkyfitness-db | IF shared_column = 'false' THEN
|
|
[2Ksparkyfitness-db | shared_expression := 'false';
|
|
[2Ksparkyfitness-db | ELSE
|
|
[2Ksparkyfitness-db | shared_expression := quote_ident(shared_column);
|
|
[2Ksparkyfitness-db | END IF;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_library_access_with_public(user_id, %s, ARRAY[%s]));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db | ', table_name, shared_expression, quoted_permissions, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.create_medication_policy(table_name text) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_medication_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_medication_access(user_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (has_medication_access(user_id));
|
|
[2Ksparkyfitness-db | ', table_name, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 5: Apply policies to all tables.
|
|
[2Ksparkyfitness-db | -- Custom policy for ai_service_settings to support admin-global + user-owned settings
|
|
[2Ksparkyfitness-db | -- Drop ALL possible old policy names before recreating
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS owner_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS select_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS modify_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_select_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_insert_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_update_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_delete_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | -- SELECT policy: All authenticated users can read public settings, users can read their own
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_select_policy ON public.ai_service_settings FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND authenticated_user_id() IS NOT NULL) OR
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- INSERT policy: Users can create their own settings, admins can create public settings
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_insert_policy ON public.ai_service_settings FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- UPDATE policy: Users can update their own settings, admins can update public settings
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_update_policy ON public.ai_service_settings FOR UPDATE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- DELETE policy: Users can delete their own settings, admins can delete public settings
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_delete_policy ON public.ai_service_settings FOR DELETE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Owner-only access tables
|
|
[2Ksparkyfitness-db | -- Tier 1: Strictly Private (no delegation allowed)
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('api_key', 'reference_id');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_oidc_links');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('sparky_chat_history');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Profiles: delegates can read (with any meaningful permission) but only owner can write.
|
|
[2Ksparkyfitness-db | -- Delegates do not need to modify another user's profile to manage their diary.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.profiles FOR SELECT TO PUBLIC USING (has_profile_read_access(id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.profiles FOR ALL TO PUBLIC USING (authenticated_user_id() = id) WITH CHECK (authenticated_user_id() = id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_preferences FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_preferences FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_goals');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('weekly_goal_plans');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_water_containers');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_custom_nutrients');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_allergen_preferences');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Nutrient display preferences: delegates can read but only owner can rearrange their own columns.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_nutrient_display_preferences FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_nutrient_display_preferences FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Dashboard layouts: delegates can read but only owner can rearrange their own dashboard.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_dashboard_layouts FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_dashboard_layouts FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('goal_presets');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('meal_plans');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('mood_entries');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Admin Activity Logs: Only the admin who performed the action or other admins can view
|
|
[2Ksparkyfitness-db | CREATE POLICY admin_only_select ON public.admin_activity_logs FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (admin_user_id = current_user_id() OR is_admin());
|
|
[2Ksparkyfitness-db | CREATE POLICY admin_only_insert ON public.admin_activity_logs FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (admin_user_id = current_user_id() AND is_admin());
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Diary access tables
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('check_in_measurements');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('check_in_photos');
|
|
[2Ksparkyfitness-db | -- Custom categories/measurements are surfaced through the check-in feature and
|
|
[2Ksparkyfitness-db | -- every /measurements route is guarded by checkPermissionMiddleware('checkin'),
|
|
[2Ksparkyfitness-db | -- so their RLS must use the check-in policy. The previous diary policy required
|
|
[2Ksparkyfitness-db | -- can_manage_diary to write, which blocked check-in delegates (e.g. the GLP-1
|
|
[2Ksparkyfitness-db | -- daily check-in) from saving even though the route allowed them.
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('custom_categories');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('custom_measurements');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('exercise_entries');
|
|
[2Ksparkyfitness-db | -- Custom policy for exercise_entries to allow access if linked to an owned exercise_preset_entry
|
|
[2Ksparkyfitness-db | CREATE POLICY select_exercise_preset_entry_linked_policy ON public.exercise_entries FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | exercise_preset_entry_id IS NOT NULL AND EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.exercise_preset_entries epe
|
|
[2Ksparkyfitness-db | WHERE epe.id = exercise_entries.exercise_preset_entry_id AND has_diary_read_access(epe.user_id)
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- The modify policy for exercise_entries is already handled by create_diary_policy('exercise_entries')
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('exercise_preset_entries');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('food_entry_meals');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('sleep_entries');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('sleep_entry_stages');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('water_intake');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('water_intake_entries');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Library access tables
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('exercises', 'shared_with_public', ARRAY['can_view_exercise_library', 'can_manage_diary']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('foods', 'shared_with_public', ARRAY['can_view_food_library', 'can_manage_diary']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('meals', 'is_public', ARRAY['can_view_food_library', 'can_manage_diary']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('meal_plan_templates', 'false', ARRAY['can_view_food_library']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('workout_plan_templates', 'false', ARRAY['can_view_exercise_library']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('workout_presets', 'is_public', ARRAY['can_view_exercise_library','can_manage_diary']);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Medication & GLP-1 tracker (see migration 20260624000000_add_medication_glp1_schema.sql).
|
|
[2Ksparkyfitness-db | -- These tables are managed by create_medication_policy at the bottom of this file (Tier 3).
|
|
[2Ksparkyfitness-db | -- Do NOT apply create_library_policy or create_diary_policy to medication tables.
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_medication_display_preferences');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Cycle & Pregnancy hub (see migration 20260702180000_add_cycle_tracking_schema.sql).
|
|
[2Ksparkyfitness-db | -- Tier 1 — owner-only. Deliberately stricter than medications: this reproductive
|
|
[2Ksparkyfitness-db | -- health data is NEVER shared or delegated in v1 (no family/caregiver access).
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycle_settings');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycle_daily_entries');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycles');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_cycle_display_preferences');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycle_test_entries');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Pregnancy mode (see migration 20260702200000_add_pregnancy_schema.sql). Tier 1
|
|
[2Ksparkyfitness-db | -- owner-only. health_appointments is generic but still owner-only in v1.
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancies');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_kick_sessions');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_contractions');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_photos');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_checklist_state');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('health_appointments');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- User-defined mood tags. Mood is check-in data (mood_entries uses the check-in
|
|
[2Ksparkyfitness-db | -- policy), and custom check-in definitions like custom_categories are shared with
|
|
[2Ksparkyfitness-db | -- check-in delegates — so custom moods follow the same check-in policy for
|
|
[2Ksparkyfitness-db | -- consistency (a delegate managing the owner's check-in sees the owner's moods).
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('user_custom_moods');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Mood display preferences: personal picker config, owner-only.
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_mood_display_preferences');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Custom policies for special cases
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.exercise_entry_sets FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_sets.exercise_entry_id AND has_diary_read_access(ee.user_id)));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.exercise_entry_sets FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_sets.exercise_entry_id AND has_diary_access(ee.user_id)))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_sets.exercise_entry_id AND has_diary_access(ee.user_id)));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Provider configs: admin-global (is_public) OR own OR family delegation
|
|
[2Ksparkyfitness-db | -- Drop any old policy names first (idempotent)
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS select_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS modify_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS insert_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS update_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS delete_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- SELECT: admin-global (authenticated users), own, or explicit family delegation
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.external_data_providers FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | -- Admin-created global providers: all authenticated users can see them if active
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_active = TRUE AND authenticated_user_id() IS NOT NULL)
|
|
[2Ksparkyfitness-db | -- Owner always sees their own providers
|
|
[2Ksparkyfitness-db | OR (is_public = FALSE AND current_user_id() = user_id)
|
|
[2Ksparkyfitness-db | OR (
|
|
[2Ksparkyfitness-db | -- Explicit family delegation: share_external_providers permission, non-strictly-private only, must be active
|
|
[2Ksparkyfitness-db | is_public = FALSE AND is_active = TRUE AND has_family_access(user_id, 'share_external_providers') AND EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.external_provider_types ept
|
|
[2Ksparkyfitness-db | WHERE ept.id = external_data_providers.provider_type
|
|
[2Ksparkyfitness-db | AND ept.is_strictly_private = FALSE
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- INSERT: users create their own (is_public=FALSE), admins create global (is_public=TRUE)
|
|
[2Ksparkyfitness-db | CREATE POLICY insert_policy ON public.external_data_providers FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- UPDATE: users update own, admins update global
|
|
[2Ksparkyfitness-db | CREATE POLICY update_policy ON public.external_data_providers FOR UPDATE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- DELETE: users delete own, admins delete global
|
|
[2Ksparkyfitness-db | CREATE POLICY delete_policy ON public.external_data_providers FOR DELETE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.family_access FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = owner_user_id OR authenticated_user_id() = family_user_id);
|
|
[2Ksparkyfitness-db | CREATE POLICY insert_policy ON public.family_access FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = owner_user_id);
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.family_access FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = owner_user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = owner_user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.food_entries FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY insert_policy ON public.food_entries FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | has_diary_access(user_id) AND (
|
|
[2Ksparkyfitness-db | (food_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = food_entries.food_id)) OR
|
|
[2Ksparkyfitness-db | (meal_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.meals m WHERE m.id = food_entries.meal_id))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | CREATE POLICY update_policy ON public.food_entries FOR UPDATE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_access(user_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (has_diary_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY delete_policy ON public.food_entries FOR DELETE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_access(user_id));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.food_variants FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.foods f
|
|
[2Ksparkyfitness-db | WHERE f.id = food_variants.food_id
|
|
[2Ksparkyfitness-db | AND has_library_access_with_public(f.user_id, f.shared_with_public, ARRAY['can_view_food_library', 'can_manage_diary'])
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- Food variants are library data: only the owner of the parent food may write
|
|
[2Ksparkyfitness-db | -- them. Delegates (even can_manage_diary) get read-only access via select_policy
|
|
[2Ksparkyfitness-db | -- so they can pick serving sizes while logging, but cannot mutate the library.
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.food_variants FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.foods f
|
|
[2Ksparkyfitness-db | WHERE f.id = food_variants.food_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = f.user_id
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.foods f
|
|
[2Ksparkyfitness-db | WHERE f.id = food_variants.food_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = f.user_id
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- meal_foods is polymorphic: a row references either a food (item_type='food')
|
|
[2Ksparkyfitness-db | -- or another meal (item_type='meal', a reusable sub-meal). Read access follows
|
|
[2Ksparkyfitness-db | -- the parent meal. Write access requires the caller owns the parent meal AND the
|
|
[2Ksparkyfitness-db | -- referenced ingredient is accessible to them: a food they can view, or a child
|
|
[2Ksparkyfitness-db | -- meal they have library access to (prevents linking a meal you cannot see).
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.meal_foods FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_foods.meal_id AND has_library_access_with_public(m.user_id, m.is_public, ARRAY['can_view_food_library', 'can_manage_diary'])));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.meal_foods FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_foods.meal_id AND authenticated_user_id() = m.user_id)
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_foods.meal_id AND authenticated_user_id() = m.user_id)
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (meal_foods.food_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = meal_foods.food_id))
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | (meal_foods.child_meal_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.meals cm WHERE cm.id = meal_foods.child_meal_id AND has_library_access_with_public(cm.user_id, cm.is_public, ARRAY['can_view_food_library', 'can_manage_diary'])))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.meal_plan_template_assignments FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.meal_plan_templates mpt WHERE mpt.id = meal_plan_template_assignments.template_id AND has_diary_access(mpt.user_id)) AND
|
|
[2Ksparkyfitness-db | (((item_type = 'food') AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = meal_plan_template_assignments.food_id)) OR
|
|
[2Ksparkyfitness-db | ((item_type = 'meal') AND EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_plan_template_assignments.meal_id))))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.meal_plan_templates mpt WHERE mpt.id = meal_plan_template_assignments.template_id AND has_diary_access(mpt.user_id)) AND
|
|
[2Ksparkyfitness-db | (((item_type = 'food') AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = meal_plan_template_assignments.food_id)) OR
|
|
[2Ksparkyfitness-db | ((item_type = 'meal') AND EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_plan_template_assignments.meal_id))));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.workout_plan_assignment_sets FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_plan_template_assignments wpta WHERE wpta.id = workout_plan_assignment_sets.assignment_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.workout_plan_template_assignments wpta WHERE wpta.id = workout_plan_assignment_sets.assignment_id));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.workout_plan_template_assignments FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_plan_templates wpt WHERE wpt.id = workout_plan_template_assignments.template_id AND has_diary_access(wpt.user_id)))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.workout_plan_templates wpt WHERE wpt.id = workout_plan_template_assignments.template_id AND has_diary_access(wpt.user_id)));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.workout_preset_exercise_sets FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_preset_exercises wpe WHERE wpe.id = workout_preset_exercise_sets.workout_preset_exercise_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.workout_preset_exercise_sets FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_preset_exercises wpe
|
|
[2Ksparkyfitness-db | JOIN public.workout_presets wp ON wp.id = wpe.workout_preset_id
|
|
[2Ksparkyfitness-db | WHERE wpe.id = workout_preset_exercise_sets.workout_preset_exercise_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_preset_exercises wpe
|
|
[2Ksparkyfitness-db | JOIN public.workout_presets wp ON wp.id = wpe.workout_preset_id
|
|
[2Ksparkyfitness-db | WHERE wpe.id = workout_preset_exercise_sets.workout_preset_exercise_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.workout_preset_exercises FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_presets wp WHERE wp.id = workout_preset_exercises.workout_preset_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.workout_preset_exercises FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_presets wp
|
|
[2Ksparkyfitness-db | WHERE wp.id = workout_preset_exercises.workout_preset_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_presets wp
|
|
[2Ksparkyfitness-db | WHERE wp.id = workout_preset_exercises.workout_preset_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Strictly Private (Tier 1)
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_ignored_updates');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Meal types: access if user_id is null (system) or if user has diary access
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.meal_types FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (user_id IS NULL OR has_diary_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.meal_types FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (user_id = authenticated_user_id())
|
|
[2Ksparkyfitness-db | WITH CHECK (user_id = authenticated_user_id());
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Activity details: access if linked exercise entry or preset entry is accessible
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.exercise_entry_activity_details FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (exercise_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_id AND has_diary_read_access(ee.user_id))) OR
|
|
[2Ksparkyfitness-db | (exercise_preset_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_preset_entries epe WHERE epe.id = exercise_preset_entry_id AND has_diary_read_access(epe.user_id)))
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.exercise_entry_activity_details FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (exercise_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_id AND has_diary_access(ee.user_id))) OR
|
|
[2Ksparkyfitness-db | (exercise_preset_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_preset_entries epe WHERE epe.id = exercise_preset_entry_id AND has_diary_access(epe.user_id)))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (exercise_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_id AND has_diary_access(ee.user_id))) OR
|
|
[2Ksparkyfitness-db | (exercise_preset_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_preset_entries epe WHERE epe.id = exercise_preset_entry_id AND has_diary_access(epe.user_id)))
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Shared View-Only (Tier 2)
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('fasting_logs');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_meal_visibilities');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('sleep_need_calculations');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('daily_sleep_need');
|
|
[2Ksparkyfitness-db | -- Day classification is a sleep/wellness (check-in) feature, used only by the
|
|
[2Ksparkyfitness-db | -- sleep-science service. It must use the check-in policy so check-in delegates
|
|
[2Ksparkyfitness-db | -- can manage it; the previous diary policy was a misclassification.
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('day_classification_cache');
|
|
[2Ksparkyfitness-db | -- Onboarding data/status: delegates can read (to avoid repeated onboarding prompts when viewing
|
|
[2Ksparkyfitness-db | -- another user's diary) but only the account owner can submit or reset their own onboarding.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.onboarding_data FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.onboarding_data FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.onboarding_status FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.onboarding_status FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Medications & Symptoms (Tier 3 - Delegate Writable with medications permission)
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medications');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_schedules');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_entries');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_pens');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('injection_entries');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_titration_steps');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('user_custom_symptoms');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('symptom_entries');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('user_custom_symptom_locations');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Medications Display Preferences (Tier 2 - Owner-Only Write, Delegate Read)
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_medication_display_preferences FOR SELECT TO PUBLIC USING (has_medication_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_medication_display_preferences FOR ALL TO PUBLIC USING (authenticated_user_id() = user_id) WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | 2026-11-03 03:00:07.176 CET [62] LOG: checkpoint starting: time
|
|
[2Ksparkyfitness-db | 2026-11-03 03:00:18.352 CET [768] ERROR: relation "public.user_custom_symptom_locations" does not exist
|
|
[2Ksparkyfitness-db | 2026-11-03 03:00:18.352 CET [768] CONTEXT: SQL statement "ALTER TABLE public.user_custom_symptom_locations ENABLE ROW LEVEL SECURITY;"
|
|
[2Ksparkyfitness-db | PL/pgSQL function inline_code_block line 86 at EXECUTE
|
|
[2Ksparkyfitness-db | 2026-11-03 03:00:18.352 CET [768] STATEMENT: -- File: rls_policies.sql
|
|
[2Ksparkyfitness-db | -- =============================================================================
|
|
[2Ksparkyfitness-db | -- THIS FILE IS THE SINGLE SOURCE OF TRUTH FOR ALL RLS POLICIES IN THE APPLICATION.
|
|
[2Ksparkyfitness-db | -- It is executed on every server startup after migrations to ensure a consistent security state.
|
|
[2Ksparkyfitness-db | -- This script is generated from the db_schema_backup.sql to ensure all custom policies are included.
|
|
[2Ksparkyfitness-db | -- =============================================================================
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 1: Purge all existing RLS policies from the public schema in a single operation.
|
|
[2Ksparkyfitness-db | DO $$
|
|
[2Ksparkyfitness-db | DECLARE
|
|
[2Ksparkyfitness-db | pol RECORD;
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | FOR pol IN SELECT * FROM pg_policies WHERE schemaname = 'public'
|
|
[2Ksparkyfitness-db | LOOP
|
|
[2Ksparkyfitness-db | EXECUTE 'DROP POLICY IF EXISTS ' || quote_ident(pol.policyname) || ' ON ' || quote_ident(pol.schemaname) || '.' || quote_ident(pol.tablename);
|
|
[2Ksparkyfitness-db | END LOOP;
|
|
[2Ksparkyfitness-db | END $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 2: Enable RLS on all relevant tables to ensure consistent security state.
|
|
[2Ksparkyfitness-db | DO $$
|
|
[2Ksparkyfitness-db | DECLARE
|
|
[2Ksparkyfitness-db | table_name text;
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | FOR table_name IN SELECT unnest(ARRAY[
|
|
[2Ksparkyfitness-db | 'ai_service_settings',
|
|
[2Ksparkyfitness-db | 'check_in_measurements',
|
|
[2Ksparkyfitness-db | 'check_in_photos',
|
|
[2Ksparkyfitness-db | 'custom_categories',
|
|
[2Ksparkyfitness-db | 'custom_measurements',
|
|
[2Ksparkyfitness-db | 'exercise_entries',
|
|
[2Ksparkyfitness-db | 'exercise_entry_sets',
|
|
[2Ksparkyfitness-db | 'exercise_entry_activity_details',
|
|
[2Ksparkyfitness-db | 'exercises',
|
|
[2Ksparkyfitness-db | 'exercise_preset_entries',
|
|
[2Ksparkyfitness-db | 'external_data_providers',
|
|
[2Ksparkyfitness-db | 'family_access',
|
|
[2Ksparkyfitness-db | 'food_entries',
|
|
[2Ksparkyfitness-db | 'food_entry_meals',
|
|
[2Ksparkyfitness-db | 'food_variants',
|
|
[2Ksparkyfitness-db | 'foods',
|
|
[2Ksparkyfitness-db | 'goal_presets',
|
|
[2Ksparkyfitness-db | 'meal_foods',
|
|
[2Ksparkyfitness-db | 'meal_plan_template_assignments',
|
|
[2Ksparkyfitness-db | 'meal_plan_templates',
|
|
[2Ksparkyfitness-db | 'meal_plans',
|
|
[2Ksparkyfitness-db | 'meals',
|
|
[2Ksparkyfitness-db | 'meal_types',
|
|
[2Ksparkyfitness-db | 'mood_entries',
|
|
[2Ksparkyfitness-db | 'onboarding_data',
|
|
[2Ksparkyfitness-db | 'onboarding_status',
|
|
[2Ksparkyfitness-db | 'profiles',
|
|
[2Ksparkyfitness-db | 'sparky_chat_history',
|
|
[2Ksparkyfitness-db | 'admin_activity_logs',
|
|
[2Ksparkyfitness-db | 'api_key',
|
|
[2Ksparkyfitness-db | 'user_goals',
|
|
[2Ksparkyfitness-db | 'user_ignored_updates',
|
|
[2Ksparkyfitness-db | 'user_meal_visibilities',
|
|
[2Ksparkyfitness-db | 'user_nutrient_display_preferences',
|
|
[2Ksparkyfitness-db | 'user_oidc_links',
|
|
[2Ksparkyfitness-db | 'user_preferences',
|
|
[2Ksparkyfitness-db | 'user_water_containers',
|
|
[2Ksparkyfitness-db | 'water_intake',
|
|
[2Ksparkyfitness-db | 'water_intake_entries',
|
|
[2Ksparkyfitness-db | 'weekly_goal_plans',
|
|
[2Ksparkyfitness-db | 'workout_plan_assignment_sets',
|
|
[2Ksparkyfitness-db | 'workout_plan_template_assignments',
|
|
[2Ksparkyfitness-db | 'workout_plan_templates',
|
|
[2Ksparkyfitness-db | 'workout_preset_exercise_sets',
|
|
[2Ksparkyfitness-db | 'workout_preset_exercises',
|
|
[2Ksparkyfitness-db | 'workout_presets',
|
|
[2Ksparkyfitness-db | 'sleep_entries',
|
|
[2Ksparkyfitness-db | 'sleep_entry_stages',
|
|
[2Ksparkyfitness-db | 'fasting_logs',
|
|
[2Ksparkyfitness-db | 'user_custom_nutrients',
|
|
[2Ksparkyfitness-db | 'user_allergen_preferences',
|
|
[2Ksparkyfitness-db | 'user_dashboard_layouts',
|
|
[2Ksparkyfitness-db | 'sleep_need_calculations',
|
|
[2Ksparkyfitness-db | 'daily_sleep_need',
|
|
[2Ksparkyfitness-db | 'day_classification_cache',
|
|
[2Ksparkyfitness-db | 'medications',
|
|
[2Ksparkyfitness-db | 'medication_schedules',
|
|
[2Ksparkyfitness-db | 'medication_entries',
|
|
[2Ksparkyfitness-db | 'medication_pens',
|
|
[2Ksparkyfitness-db | 'injection_entries',
|
|
[2Ksparkyfitness-db | 'medication_titration_steps',
|
|
[2Ksparkyfitness-db | 'user_custom_symptoms',
|
|
[2Ksparkyfitness-db | 'symptom_entries',
|
|
[2Ksparkyfitness-db | 'user_medication_display_preferences',
|
|
[2Ksparkyfitness-db | 'user_custom_symptom_locations',
|
|
[2Ksparkyfitness-db | 'cycle_settings',
|
|
[2Ksparkyfitness-db | 'cycle_daily_entries',
|
|
[2Ksparkyfitness-db | 'cycles',
|
|
[2Ksparkyfitness-db | 'user_cycle_display_preferences',
|
|
[2Ksparkyfitness-db | 'cycle_test_entries',
|
|
[2Ksparkyfitness-db | 'pregnancies',
|
|
[2Ksparkyfitness-db | 'pregnancy_kick_sessions',
|
|
[2Ksparkyfitness-db | 'pregnancy_contractions',
|
|
[2Ksparkyfitness-db | 'pregnancy_photos',
|
|
[2Ksparkyfitness-db | 'pregnancy_checklist_state',
|
|
[2Ksparkyfitness-db | 'health_appointments',
|
|
[2Ksparkyfitness-db | 'user_custom_moods',
|
|
[2Ksparkyfitness-db | 'user_mood_display_preferences'
|
|
[2Ksparkyfitness-db | ]::text[])
|
|
[2Ksparkyfitness-db | LOOP
|
|
[2Ksparkyfitness-db | EXECUTE 'ALTER TABLE public.' || quote_ident(table_name) || ' ENABLE ROW LEVEL SECURITY;';
|
|
[2Ksparkyfitness-db | END LOOP;
|
|
[2Ksparkyfitness-db | END $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 3: Define reusable helper functions for common RLS conditions.
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION current_user_id() RETURNS uuid
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT NULLIF(current_setting('app.user_id', true), '')::uuid;
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION authenticated_user_id() RETURNS uuid
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT NULLIF(current_setting('app.authenticated_user_id', true), '')::uuid;
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.get_accessible_users(p_user_id UUID)
|
|
[2Ksparkyfitness-db | RETURNS TABLE(
|
|
[2Ksparkyfitness-db | user_id UUID,
|
|
[2Ksparkyfitness-db | full_name TEXT,
|
|
[2Ksparkyfitness-db | email TEXT,
|
|
[2Ksparkyfitness-db | permissions JSONB,
|
|
[2Ksparkyfitness-db | access_end_date TIMESTAMP WITH TIME ZONE
|
|
[2Ksparkyfitness-db | ) AS $func$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | RETURN QUERY
|
|
[2Ksparkyfitness-db | SELECT
|
|
[2Ksparkyfitness-db | fa.owner_user_id,
|
|
[2Ksparkyfitness-db | p.full_name,
|
|
[2Ksparkyfitness-db | u.email::TEXT,
|
|
[2Ksparkyfitness-db | fa.access_permissions,
|
|
[2Ksparkyfitness-db | fa.access_end_date
|
|
[2Ksparkyfitness-db | FROM public.family_access fa
|
|
[2Ksparkyfitness-db | JOIN public.profiles p ON p.id = fa.owner_user_id
|
|
[2Ksparkyfitness-db | JOIN public."user" u ON u.id = fa.owner_user_id
|
|
[2Ksparkyfitness-db | WHERE fa.family_user_id = p_user_id
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND has_any_meaningful_permission(fa.access_permissions);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $func$ LANGUAGE plpgsql STABLE;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.find_user_by_email(p_email TEXT)
|
|
[2Ksparkyfitness-db | RETURNS UUID AS $func$
|
|
[2Ksparkyfitness-db | DECLARE
|
|
[2Ksparkyfitness-db | v_user_id UUID;
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | SELECT id INTO v_user_id
|
|
[2Ksparkyfitness-db | FROM public."user"
|
|
[2Ksparkyfitness-db | WHERE LOWER(email) = LOWER(p_email)
|
|
[2Ksparkyfitness-db | LIMIT 1;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | RETURN v_user_id;
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $func$ LANGUAGE plpgsql STABLE SECURITY DEFINER;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_family_access(owner_uuid uuid, perm text) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (fa.access_permissions ->> perm)::boolean = true
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_family_access_or(owner_uuid uuid, perms text[]) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM unnest(perms) p
|
|
[2Ksparkyfitness-db | WHERE (fa.access_permissions ->> p)::boolean = true
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_diary_access(owner_uuid uuid) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (fa.access_permissions->>'can_manage_diary')::boolean = true
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Centralized helper: returns true if the given permissions JSONB contains
|
|
[2Ksparkyfitness-db | -- at least one meaningful delegation permission. Used by has_profile_read_access
|
|
[2Ksparkyfitness-db | -- and get_accessible_users to avoid duplicating the permission key list.
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_any_meaningful_permission(perms jsonb) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql IMMUTABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT (
|
|
[2Ksparkyfitness-db | (perms->>'can_manage_diary')::boolean = true OR
|
|
[2Ksparkyfitness-db | (perms->>'can_manage_checkin')::boolean = true OR
|
|
[2Ksparkyfitness-db | (perms->>'can_view_reports')::boolean = true OR
|
|
[2Ksparkyfitness-db | (perms->>'can_manage_medications')::boolean = true
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_profile_read_access(owner_uuid uuid) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | -- Owner always has access. Family delegates require at least one meaningful permission
|
|
[2Ksparkyfitness-db | -- (diary, checkin, medications, or reports) to read profile/layout/onboarding data.
|
|
[2Ksparkyfitness-db | -- A bare family_access row with no permissions does not grant read access.
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND has_any_meaningful_permission(fa.access_permissions)
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_diary_read_access(owner_uuid uuid) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_manage_diary')::boolean = true OR
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_view_reports')::boolean = true
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_checkin_read_access(owner_uuid uuid) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_manage_checkin')::boolean = true OR
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_view_reports')::boolean = true
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.has_medication_access(owner_uuid uuid) RETURNS boolean
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (fa.access_permissions->>'can_manage_medications')::boolean = true
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.has_medication_read_access(owner_uuid uuid) RETURNS boolean
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_manage_medications')::boolean = true OR
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_view_reports')::boolean = true
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_library_access_with_public(owner_uuid uuid, is_shared bool, perms text[]) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid
|
|
[2Ksparkyfitness-db | OR is_shared
|
|
[2Ksparkyfitness-db | OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_view_reports')::boolean = true OR
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM unnest(perms) p
|
|
[2Ksparkyfitness-db | WHERE (fa.access_permissions ->> p)::boolean = true
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | p <> 'can_manage_diary'
|
|
[2Ksparkyfitness-db | OR current_user_id() = owner_uuid
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | DROP FUNCTION IF EXISTS public.set_app_context(UUID, UUID);
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.set_app_context(p_user_id UUID, p_authenticated_user_id UUID)
|
|
[2Ksparkyfitness-db | RETURNS void AS $$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | -- app.user_id is used by RLS to determine whose data is being accessed
|
|
[2Ksparkyfitness-db | PERFORM set_config('app.user_id', p_user_id::text, false);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- app.authenticated_user_id is the actual logged-in user
|
|
[2Ksparkyfitness-db | PERFORM set_config('app.authenticated_user_id', p_authenticated_user_id::text, false);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $$ LANGUAGE plpgsql SECURITY DEFINER;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | DROP FUNCTION IF EXISTS public.can_access_user_data(UUID, TEXT, UUID);
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.can_access_user_data(
|
|
[2Ksparkyfitness-db | target_user_id UUID,
|
|
[2Ksparkyfitness-db | permission_type TEXT,
|
|
[2Ksparkyfitness-db | auth_user_id UUID
|
|
[2Ksparkyfitness-db | ) RETURNS BOOLEAN AS $func$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | -- Self access
|
|
[2Ksparkyfitness-db | IF target_user_id = auth_user_id THEN
|
|
[2Ksparkyfitness-db | RETURN TRUE;
|
|
[2Ksparkyfitness-db | END IF;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Family access check
|
|
[2Ksparkyfitness-db | RETURN EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1
|
|
[2Ksparkyfitness-db | FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.family_user_id = auth_user_id
|
|
[2Ksparkyfitness-db | AND fa.owner_user_id = target_user_id
|
|
[2Ksparkyfitness-db | AND fa.is_active = TRUE
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > NOW())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>permission_type)::BOOLEAN = TRUE
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | -- Mapping for common permission names
|
|
[2Ksparkyfitness-db | (permission_type = 'diary' AND (fa.access_permissions->>'can_manage_diary')::BOOLEAN = TRUE)
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | (permission_type = 'checkin' AND (fa.access_permissions->>'can_manage_checkin')::BOOLEAN = TRUE)
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | (permission_type = 'reports' AND (fa.access_permissions->>'can_view_reports')::BOOLEAN = TRUE)
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | -- Inheritance: reports permission grants read access to others
|
|
[2Ksparkyfitness-db | (permission_type IN ('calorie', 'diary', 'mood', 'sleep', 'exercise', 'water', 'checkin')
|
|
[2Ksparkyfitness-db | AND (COALESCE((fa.access_permissions->>'reports')::BOOLEAN, FALSE)
|
|
[2Ksparkyfitness-db | OR COALESCE((fa.access_permissions->>'can_view_reports')::BOOLEAN, FALSE)))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $func$ LANGUAGE plpgsql STABLE;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Helper function to check if authenticated user is admin
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION is_admin() RETURNS boolean
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public."user" u
|
|
[2Ksparkyfitness-db | WHERE u.id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND u.role = 'admin'
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 4: Define generic policy creation functions.
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_owner_policy(table_name text, id_column text DEFAULT 'user_id') RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (%I = authenticated_user_id())
|
|
[2Ksparkyfitness-db | WITH CHECK (%I = authenticated_user_id());
|
|
[2Ksparkyfitness-db | ', table_name, id_column, id_column);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_shared_owner_policy(table_name text, id_column text DEFAULT 'user_id') RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (%I = current_user_id());
|
|
[2Ksparkyfitness-db | ', table_name, id_column);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (%I = authenticated_user_id())
|
|
[2Ksparkyfitness-db | WITH CHECK (%I = authenticated_user_id());
|
|
[2Ksparkyfitness-db | ', table_name, id_column, id_column);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_diary_policy(table_name text) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_access(user_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (has_diary_access(user_id));
|
|
[2Ksparkyfitness-db | ', table_name, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_checkin_policy(table_name text) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_checkin_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id OR has_family_access(user_id, ''can_manage_checkin''))
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id OR has_family_access(user_id, ''can_manage_checkin''));
|
|
[2Ksparkyfitness-db | ', table_name, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_library_policy(table_name text, shared_column text, permissions text[]) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | DECLARE
|
|
[2Ksparkyfitness-db | quoted_permissions text;
|
|
[2Ksparkyfitness-db | shared_expression text;
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | -- Quote each permission name to ensure valid ARRAY syntax
|
|
[2Ksparkyfitness-db | SELECT array_to_string(ARRAY(
|
|
[2Ksparkyfitness-db | SELECT quote_literal(p) FROM unnest(permissions) p
|
|
[2Ksparkyfitness-db | ), ',') INTO quoted_permissions;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Use boolean false if shared_column is 'false', otherwise treat as column name
|
|
[2Ksparkyfitness-db | IF shared_column = 'false' THEN
|
|
[2Ksparkyfitness-db | shared_expression := 'false';
|
|
[2Ksparkyfitness-db | ELSE
|
|
[2Ksparkyfitness-db | shared_expression := quote_ident(shared_column);
|
|
[2Ksparkyfitness-db | END IF;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_library_access_with_public(user_id, %s, ARRAY[%s]));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db | ', table_name, shared_expression, quoted_permissions, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.create_medication_policy(table_name text) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_medication_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_medication_access(user_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (has_medication_access(user_id));
|
|
[2Ksparkyfitness-db | ', table_name, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 5: Apply policies to all tables.
|
|
[2Ksparkyfitness-db | -- Custom policy for ai_service_settings to support admin-global + user-owned settings
|
|
[2Ksparkyfitness-db | -- Drop ALL possible old policy names before recreating
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS owner_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS select_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS modify_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_select_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_insert_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_update_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_delete_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | -- SELECT policy: All authenticated users can read public settings, users can read their own
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_select_policy ON public.ai_service_settings FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND authenticated_user_id() IS NOT NULL) OR
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- INSERT policy: Users can create their own settings, admins can create public settings
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_insert_policy ON public.ai_service_settings FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- UPDATE policy: Users can update their own settings, admins can update public settings
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_update_policy ON public.ai_service_settings FOR UPDATE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- DELETE policy: Users can delete their own settings, admins can delete public settings
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_delete_policy ON public.ai_service_settings FOR DELETE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Owner-only access tables
|
|
[2Ksparkyfitness-db | -- Tier 1: Strictly Private (no delegation allowed)
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('api_key', 'reference_id');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_oidc_links');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('sparky_chat_history');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Profiles: delegates can read (with any meaningful permission) but only owner can write.
|
|
[2Ksparkyfitness-db | -- Delegates do not need to modify another user's profile to manage their diary.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.profiles FOR SELECT TO PUBLIC USING (has_profile_read_access(id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.profiles FOR ALL TO PUBLIC USING (authenticated_user_id() = id) WITH CHECK (authenticated_user_id() = id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_preferences FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_preferences FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_goals');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('weekly_goal_plans');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_water_containers');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_custom_nutrients');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_allergen_preferences');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Nutrient display preferences: delegates can read but only owner can rearrange their own columns.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_nutrient_display_preferences FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_nutrient_display_preferences FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Dashboard layouts: delegates can read but only owner can rearrange their own dashboard.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_dashboard_layouts FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_dashboard_layouts FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('goal_presets');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('meal_plans');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('mood_entries');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Admin Activity Logs: Only the admin who performed the action or other admins can view
|
|
[2Ksparkyfitness-db | CREATE POLICY admin_only_select ON public.admin_activity_logs FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (admin_user_id = current_user_id() OR is_admin());
|
|
[2Ksparkyfitness-db | CREATE POLICY admin_only_insert ON public.admin_activity_logs FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (admin_user_id = current_user_id() AND is_admin());
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Diary access tables
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('check_in_measurements');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('check_in_photos');
|
|
[2Ksparkyfitness-db | -- Custom categories/measurements are surfaced through the check-in feature and
|
|
[2Ksparkyfitness-db | -- every /measurements route is guarded by checkPermissionMiddleware('checkin'),
|
|
[2Ksparkyfitness-db | -- so their RLS must use the check-in policy. The previous diary policy required
|
|
[2Ksparkyfitness-db | -- can_manage_diary to write, which blocked check-in delegates (e.g. the GLP-1
|
|
[2Ksparkyfitness-db | -- daily check-in) from saving even though the route allowed them.
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('custom_categories');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('custom_measurements');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('exercise_entries');
|
|
[2Ksparkyfitness-db | -- Custom policy for exercise_entries to allow access if linked to an owned exercise_preset_entry
|
|
[2Ksparkyfitness-db | CREATE POLICY select_exercise_preset_entry_linked_policy ON public.exercise_entries FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | exercise_preset_entry_id IS NOT NULL AND EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.exercise_preset_entries epe
|
|
[2Ksparkyfitness-db | WHERE epe.id = exercise_entries.exercise_preset_entry_id AND has_diary_read_access(epe.user_id)
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- The modify policy for exercise_entries is already handled by create_diary_policy('exercise_entries')
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('exercise_preset_entries');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('food_entry_meals');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('sleep_entries');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('sleep_entry_stages');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('water_intake');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('water_intake_entries');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Library access tables
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('exercises', 'shared_with_public', ARRAY['can_view_exercise_library', 'can_manage_diary']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('foods', 'shared_with_public', ARRAY['can_view_food_library', 'can_manage_diary']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('meals', 'is_public', ARRAY['can_view_food_library', 'can_manage_diary']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('meal_plan_templates', 'false', ARRAY['can_view_food_library']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('workout_plan_templates', 'false', ARRAY['can_view_exercise_library']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('workout_presets', 'is_public', ARRAY['can_view_exercise_library','can_manage_diary']);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Medication & GLP-1 tracker (see migration 20260624000000_add_medication_glp1_schema.sql).
|
|
[2Ksparkyfitness-db | -- These tables are managed by create_medication_policy at the bottom of this file (Tier 3).
|
|
[2Ksparkyfitness-db | -- Do NOT apply create_library_policy or create_diary_policy to medication tables.
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_medication_display_preferences');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Cycle & Pregnancy hub (see migration 20260702180000_add_cycle_tracking_schema.sql).
|
|
[2Ksparkyfitness-db | -- Tier 1 — owner-only. Deliberately stricter than medications: this reproductive
|
|
[2Ksparkyfitness-db | -- health data is NEVER shared or delegated in v1 (no family/caregiver access).
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycle_settings');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycle_daily_entries');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycles');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_cycle_display_preferences');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycle_test_entries');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Pregnancy mode (see migration 20260702200000_add_pregnancy_schema.sql). Tier 1
|
|
[2Ksparkyfitness-db | -- owner-only. health_appointments is generic but still owner-only in v1.
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancies');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_kick_sessions');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_contractions');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_photos');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_checklist_state');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('health_appointments');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- User-defined mood tags. Mood is check-in data (mood_entries uses the check-in
|
|
[2Ksparkyfitness-db | -- policy), and custom check-in definitions like custom_categories are shared with
|
|
[2Ksparkyfitness-db | -- check-in delegates — so custom moods follow the same check-in policy for
|
|
[2Ksparkyfitness-db | -- consistency (a delegate managing the owner's check-in sees the owner's moods).
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('user_custom_moods');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Mood display preferences: personal picker config, owner-only.
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_mood_display_preferences');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Custom policies for special cases
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.exercise_entry_sets FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_sets.exercise_entry_id AND has_diary_read_access(ee.user_id)));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.exercise_entry_sets FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_sets.exercise_entry_id AND has_diary_access(ee.user_id)))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_sets.exercise_entry_id AND has_diary_access(ee.user_id)));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Provider configs: admin-global (is_public) OR own OR family delegation
|
|
[2Ksparkyfitness-db | -- Drop any old policy names first (idempotent)
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS select_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS modify_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS insert_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS update_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS delete_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- SELECT: admin-global (authenticated users), own, or explicit family delegation
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.external_data_providers FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | -- Admin-created global providers: all authenticated users can see them if active
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_active = TRUE AND authenticated_user_id() IS NOT NULL)
|
|
[2Ksparkyfitness-db | -- Owner always sees their own providers
|
|
[2Ksparkyfitness-db | OR (is_public = FALSE AND current_user_id() = user_id)
|
|
[2Ksparkyfitness-db | OR (
|
|
[2Ksparkyfitness-db | -- Explicit family delegation: share_external_providers permission, non-strictly-private only, must be active
|
|
[2Ksparkyfitness-db | is_public = FALSE AND is_active = TRUE AND has_family_access(user_id, 'share_external_providers') AND EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.external_provider_types ept
|
|
[2Ksparkyfitness-db | WHERE ept.id = external_data_providers.provider_type
|
|
[2Ksparkyfitness-db | AND ept.is_strictly_private = FALSE
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- INSERT: users create their own (is_public=FALSE), admins create global (is_public=TRUE)
|
|
[2Ksparkyfitness-db | CREATE POLICY insert_policy ON public.external_data_providers FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- UPDATE: users update own, admins update global
|
|
[2Ksparkyfitness-db | CREATE POLICY update_policy ON public.external_data_providers FOR UPDATE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- DELETE: users delete own, admins delete global
|
|
[2Ksparkyfitness-db | CREATE POLICY delete_policy ON public.external_data_providers FOR DELETE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.family_access FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = owner_user_id OR authenticated_user_id() = family_user_id);
|
|
[2Ksparkyfitness-db | CREATE POLICY insert_policy ON public.family_access FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = owner_user_id);
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.family_access FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = owner_user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = owner_user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.food_entries FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY insert_policy ON public.food_entries FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | has_diary_access(user_id) AND (
|
|
[2Ksparkyfitness-db | (food_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = food_entries.food_id)) OR
|
|
[2Ksparkyfitness-db | (meal_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.meals m WHERE m.id = food_entries.meal_id))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | CREATE POLICY update_policy ON public.food_entries FOR UPDATE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_access(user_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (has_diary_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY delete_policy ON public.food_entries FOR DELETE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_access(user_id));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.food_variants FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.foods f
|
|
[2Ksparkyfitness-db | WHERE f.id = food_variants.food_id
|
|
[2Ksparkyfitness-db | AND has_library_access_with_public(f.user_id, f.shared_with_public, ARRAY['can_view_food_library', 'can_manage_diary'])
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- Food variants are library data: only the owner of the parent food may write
|
|
[2Ksparkyfitness-db | -- them. Delegates (even can_manage_diary) get read-only access via select_policy
|
|
[2Ksparkyfitness-db | -- so they can pick serving sizes while logging, but cannot mutate the library.
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.food_variants FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.foods f
|
|
[2Ksparkyfitness-db | WHERE f.id = food_variants.food_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = f.user_id
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.foods f
|
|
[2Ksparkyfitness-db | WHERE f.id = food_variants.food_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = f.user_id
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- meal_foods is polymorphic: a row references either a food (item_type='food')
|
|
[2Ksparkyfitness-db | -- or another meal (item_type='meal', a reusable sub-meal). Read access follows
|
|
[2Ksparkyfitness-db | -- the parent meal. Write access requires the caller owns the parent meal AND the
|
|
[2Ksparkyfitness-db | -- referenced ingredient is accessible to them: a food they can view, or a child
|
|
[2Ksparkyfitness-db | -- meal they have library access to (prevents linking a meal you cannot see).
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.meal_foods FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_foods.meal_id AND has_library_access_with_public(m.user_id, m.is_public, ARRAY['can_view_food_library', 'can_manage_diary'])));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.meal_foods FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_foods.meal_id AND authenticated_user_id() = m.user_id)
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_foods.meal_id AND authenticated_user_id() = m.user_id)
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (meal_foods.food_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = meal_foods.food_id))
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | (meal_foods.child_meal_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.meals cm WHERE cm.id = meal_foods.child_meal_id AND has_library_access_with_public(cm.user_id, cm.is_public, ARRAY['can_view_food_library', 'can_manage_diary'])))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.meal_plan_template_assignments FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.meal_plan_templates mpt WHERE mpt.id = meal_plan_template_assignments.template_id AND has_diary_access(mpt.user_id)) AND
|
|
[2Ksparkyfitness-db | (((item_type = 'food') AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = meal_plan_template_assignments.food_id)) OR
|
|
[2Ksparkyfitness-db | ((item_type = 'meal') AND EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_plan_template_assignments.meal_id))))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.meal_plan_templates mpt WHERE mpt.id = meal_plan_template_assignments.template_id AND has_diary_access(mpt.user_id)) AND
|
|
[2Ksparkyfitness-db | (((item_type = 'food') AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = meal_plan_template_assignments.food_id)) OR
|
|
[2Ksparkyfitness-db | ((item_type = 'meal') AND EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_plan_template_assignments.meal_id))));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.workout_plan_assignment_sets FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_plan_template_assignments wpta WHERE wpta.id = workout_plan_assignment_sets.assignment_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.workout_plan_template_assignments wpta WHERE wpta.id = workout_plan_assignment_sets.assignment_id));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.workout_plan_template_assignments FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_plan_templates wpt WHERE wpt.id = workout_plan_template_assignments.template_id AND has_diary_access(wpt.user_id)))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.workout_plan_templates wpt WHERE wpt.id = workout_plan_template_assignments.template_id AND has_diary_access(wpt.user_id)));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.workout_preset_exercise_sets FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_preset_exercises wpe WHERE wpe.id = workout_preset_exercise_sets.workout_preset_exercise_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.workout_preset_exercise_sets FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_preset_exercises wpe
|
|
[2Ksparkyfitness-db | JOIN public.workout_presets wp ON wp.id = wpe.workout_preset_id
|
|
[2Ksparkyfitness-db | WHERE wpe.id = workout_preset_exercise_sets.workout_preset_exercise_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_preset_exercises wpe
|
|
[2Ksparkyfitness-db | JOIN public.workout_presets wp ON wp.id = wpe.workout_preset_id
|
|
[2Ksparkyfitness-db | WHERE wpe.id = workout_preset_exercise_sets.workout_preset_exercise_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.workout_preset_exercises FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_presets wp WHERE wp.id = workout_preset_exercises.workout_preset_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.workout_preset_exercises FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_presets wp
|
|
[2Ksparkyfitness-db | WHERE wp.id = workout_preset_exercises.workout_preset_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_presets wp
|
|
[2Ksparkyfitness-db | WHERE wp.id = workout_preset_exercises.workout_preset_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Strictly Private (Tier 1)
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_ignored_updates');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Meal types: access if user_id is null (system) or if user has diary access
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.meal_types FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (user_id IS NULL OR has_diary_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.meal_types FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (user_id = authenticated_user_id())
|
|
[2Ksparkyfitness-db | WITH CHECK (user_id = authenticated_user_id());
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Activity details: access if linked exercise entry or preset entry is accessible
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.exercise_entry_activity_details FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (exercise_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_id AND has_diary_read_access(ee.user_id))) OR
|
|
[2Ksparkyfitness-db | (exercise_preset_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_preset_entries epe WHERE epe.id = exercise_preset_entry_id AND has_diary_read_access(epe.user_id)))
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.exercise_entry_activity_details FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (exercise_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_id AND has_diary_access(ee.user_id))) OR
|
|
[2Ksparkyfitness-db | (exercise_preset_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_preset_entries epe WHERE epe.id = exercise_preset_entry_id AND has_diary_access(epe.user_id)))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (exercise_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_id AND has_diary_access(ee.user_id))) OR
|
|
[2Ksparkyfitness-db | (exercise_preset_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_preset_entries epe WHERE epe.id = exercise_preset_entry_id AND has_diary_access(epe.user_id)))
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Shared View-Only (Tier 2)
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('fasting_logs');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_meal_visibilities');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('sleep_need_calculations');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('daily_sleep_need');
|
|
[2Ksparkyfitness-db | -- Day classification is a sleep/wellness (check-in) feature, used only by the
|
|
[2Ksparkyfitness-db | -- sleep-science service. It must use the check-in policy so check-in delegates
|
|
[2Ksparkyfitness-db | -- can manage it; the previous diary policy was a misclassification.
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('day_classification_cache');
|
|
[2Ksparkyfitness-db | -- Onboarding data/status: delegates can read (to avoid repeated onboarding prompts when viewing
|
|
[2Ksparkyfitness-db | -- another user's diary) but only the account owner can submit or reset their own onboarding.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.onboarding_data FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.onboarding_data FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.onboarding_status FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.onboarding_status FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Medications & Symptoms (Tier 3 - Delegate Writable with medications permission)
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medications');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_schedules');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_entries');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_pens');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('injection_entries');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_titration_steps');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('user_custom_symptoms');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('symptom_entries');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('user_custom_symptom_locations');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Medications Display Preferences (Tier 2 - Owner-Only Write, Delegate Read)
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_medication_display_preferences FOR SELECT TO PUBLIC USING (has_medication_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_medication_display_preferences FOR ALL TO PUBLIC USING (authenticated_user_id() = user_id) WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | 2026-11-03 03:00:22.746 CET [62] LOG: checkpoint complete: wrote 155 buffers (0.9%), wrote 1 SLRU buffers; 0 WAL file(s) added, 0 removed, 0 recycled; write=15.533 s, sync=0.021 s, total=15.571 s; sync files=23, longest=0.015 s, average=0.001 s; distance=1370 kB, estimate=10122 kB; lsn=0/28A83F8, redo lsn=0/27D4BC8
|
|
[2Ksparkyfitness-db | 2026-11-03 03:00:58.633 CET [800] ERROR: relation "public.user_custom_symptom_locations" does not exist
|
|
[2Ksparkyfitness-db | 2026-11-03 03:00:58.633 CET [800] CONTEXT: SQL statement "ALTER TABLE public.user_custom_symptom_locations ENABLE ROW LEVEL SECURITY;"
|
|
[2Ksparkyfitness-db | PL/pgSQL function inline_code_block line 86 at EXECUTE
|
|
[2Ksparkyfitness-db | 2026-11-03 03:00:58.633 CET [800] STATEMENT: -- File: rls_policies.sql
|
|
[2Ksparkyfitness-db | -- =============================================================================
|
|
[2Ksparkyfitness-db | -- THIS FILE IS THE SINGLE SOURCE OF TRUTH FOR ALL RLS POLICIES IN THE APPLICATION.
|
|
[2Ksparkyfitness-db | -- It is executed on every server startup after migrations to ensure a consistent security state.
|
|
[2Ksparkyfitness-db | -- This script is generated from the db_schema_backup.sql to ensure all custom policies are included.
|
|
[2Ksparkyfitness-db | -- =============================================================================
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 1: Purge all existing RLS policies from the public schema in a single operation.
|
|
[2Ksparkyfitness-db | DO $$
|
|
[2Ksparkyfitness-db | DECLARE
|
|
[2Ksparkyfitness-db | pol RECORD;
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | FOR pol IN SELECT * FROM pg_policies WHERE schemaname = 'public'
|
|
[2Ksparkyfitness-db | LOOP
|
|
[2Ksparkyfitness-db | EXECUTE 'DROP POLICY IF EXISTS ' || quote_ident(pol.policyname) || ' ON ' || quote_ident(pol.schemaname) || '.' || quote_ident(pol.tablename);
|
|
[2Ksparkyfitness-db | END LOOP;
|
|
[2Ksparkyfitness-db | END $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 2: Enable RLS on all relevant tables to ensure consistent security state.
|
|
[2Ksparkyfitness-db | DO $$
|
|
[2Ksparkyfitness-db | DECLARE
|
|
[2Ksparkyfitness-db | table_name text;
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | FOR table_name IN SELECT unnest(ARRAY[
|
|
[2Ksparkyfitness-db | 'ai_service_settings',
|
|
[2Ksparkyfitness-db | 'check_in_measurements',
|
|
[2Ksparkyfitness-db | 'check_in_photos',
|
|
[2Ksparkyfitness-db | 'custom_categories',
|
|
[2Ksparkyfitness-db | 'custom_measurements',
|
|
[2Ksparkyfitness-db | 'exercise_entries',
|
|
[2Ksparkyfitness-db | 'exercise_entry_sets',
|
|
[2Ksparkyfitness-db | 'exercise_entry_activity_details',
|
|
[2Ksparkyfitness-db | 'exercises',
|
|
[2Ksparkyfitness-db | 'exercise_preset_entries',
|
|
[2Ksparkyfitness-db | 'external_data_providers',
|
|
[2Ksparkyfitness-db | 'family_access',
|
|
[2Ksparkyfitness-db | 'food_entries',
|
|
[2Ksparkyfitness-db | 'food_entry_meals',
|
|
[2Ksparkyfitness-db | 'food_variants',
|
|
[2Ksparkyfitness-db | 'foods',
|
|
[2Ksparkyfitness-db | 'goal_presets',
|
|
[2Ksparkyfitness-db | 'meal_foods',
|
|
[2Ksparkyfitness-db | 'meal_plan_template_assignments',
|
|
[2Ksparkyfitness-db | 'meal_plan_templates',
|
|
[2Ksparkyfitness-db | 'meal_plans',
|
|
[2Ksparkyfitness-db | 'meals',
|
|
[2Ksparkyfitness-db | 'meal_types',
|
|
[2Ksparkyfitness-db | 'mood_entries',
|
|
[2Ksparkyfitness-db | 'onboarding_data',
|
|
[2Ksparkyfitness-db | 'onboarding_status',
|
|
[2Ksparkyfitness-db | 'profiles',
|
|
[2Ksparkyfitness-db | 'sparky_chat_history',
|
|
[2Ksparkyfitness-db | 'admin_activity_logs',
|
|
[2Ksparkyfitness-db | 'api_key',
|
|
[2Ksparkyfitness-db | 'user_goals',
|
|
[2Ksparkyfitness-db | 'user_ignored_updates',
|
|
[2Ksparkyfitness-db | 'user_meal_visibilities',
|
|
[2Ksparkyfitness-db | 'user_nutrient_display_preferences',
|
|
[2Ksparkyfitness-db | 'user_oidc_links',
|
|
[2Ksparkyfitness-db | 'user_preferences',
|
|
[2Ksparkyfitness-db | 'user_water_containers',
|
|
[2Ksparkyfitness-db | 'water_intake',
|
|
[2Ksparkyfitness-db | 'water_intake_entries',
|
|
[2Ksparkyfitness-db | 'weekly_goal_plans',
|
|
[2Ksparkyfitness-db | 'workout_plan_assignment_sets',
|
|
[2Ksparkyfitness-db | 'workout_plan_template_assignments',
|
|
[2Ksparkyfitness-db | 'workout_plan_templates',
|
|
[2Ksparkyfitness-db | 'workout_preset_exercise_sets',
|
|
[2Ksparkyfitness-db | 'workout_preset_exercises',
|
|
[2Ksparkyfitness-db | 'workout_presets',
|
|
[2Ksparkyfitness-db | 'sleep_entries',
|
|
[2Ksparkyfitness-db | 'sleep_entry_stages',
|
|
[2Ksparkyfitness-db | 'fasting_logs',
|
|
[2Ksparkyfitness-db | 'user_custom_nutrients',
|
|
[2Ksparkyfitness-db | 'user_allergen_preferences',
|
|
[2Ksparkyfitness-db | 'user_dashboard_layouts',
|
|
[2Ksparkyfitness-db | 'sleep_need_calculations',
|
|
[2Ksparkyfitness-db | 'daily_sleep_need',
|
|
[2Ksparkyfitness-db | 'day_classification_cache',
|
|
[2Ksparkyfitness-db | 'medications',
|
|
[2Ksparkyfitness-db | 'medication_schedules',
|
|
[2Ksparkyfitness-db | 'medication_entries',
|
|
[2Ksparkyfitness-db | 'medication_pens',
|
|
[2Ksparkyfitness-db | 'injection_entries',
|
|
[2Ksparkyfitness-db | 'medication_titration_steps',
|
|
[2Ksparkyfitness-db | 'user_custom_symptoms',
|
|
[2Ksparkyfitness-db | 'symptom_entries',
|
|
[2Ksparkyfitness-db | 'user_medication_display_preferences',
|
|
[2Ksparkyfitness-db | 'user_custom_symptom_locations',
|
|
[2Ksparkyfitness-db | 'cycle_settings',
|
|
[2Ksparkyfitness-db | 'cycle_daily_entries',
|
|
[2Ksparkyfitness-db | 'cycles',
|
|
[2Ksparkyfitness-db | 'user_cycle_display_preferences',
|
|
[2Ksparkyfitness-db | 'cycle_test_entries',
|
|
[2Ksparkyfitness-db | 'pregnancies',
|
|
[2Ksparkyfitness-db | 'pregnancy_kick_sessions',
|
|
[2Ksparkyfitness-db | 'pregnancy_contractions',
|
|
[2Ksparkyfitness-db | 'pregnancy_photos',
|
|
[2Ksparkyfitness-db | 'pregnancy_checklist_state',
|
|
[2Ksparkyfitness-db | 'health_appointments',
|
|
[2Ksparkyfitness-db | 'user_custom_moods',
|
|
[2Ksparkyfitness-db | 'user_mood_display_preferences'
|
|
[2Ksparkyfitness-db | ]::text[])
|
|
[2Ksparkyfitness-db | LOOP
|
|
[2Ksparkyfitness-db | EXECUTE 'ALTER TABLE public.' || quote_ident(table_name) || ' ENABLE ROW LEVEL SECURITY;';
|
|
[2Ksparkyfitness-db | END LOOP;
|
|
[2Ksparkyfitness-db | END $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 3: Define reusable helper functions for common RLS conditions.
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION current_user_id() RETURNS uuid
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT NULLIF(current_setting('app.user_id', true), '')::uuid;
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION authenticated_user_id() RETURNS uuid
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT NULLIF(current_setting('app.authenticated_user_id', true), '')::uuid;
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.get_accessible_users(p_user_id UUID)
|
|
[2Ksparkyfitness-db | RETURNS TABLE(
|
|
[2Ksparkyfitness-db | user_id UUID,
|
|
[2Ksparkyfitness-db | full_name TEXT,
|
|
[2Ksparkyfitness-db | email TEXT,
|
|
[2Ksparkyfitness-db | permissions JSONB,
|
|
[2Ksparkyfitness-db | access_end_date TIMESTAMP WITH TIME ZONE
|
|
[2Ksparkyfitness-db | ) AS $func$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | RETURN QUERY
|
|
[2Ksparkyfitness-db | SELECT
|
|
[2Ksparkyfitness-db | fa.owner_user_id,
|
|
[2Ksparkyfitness-db | p.full_name,
|
|
[2Ksparkyfitness-db | u.email::TEXT,
|
|
[2Ksparkyfitness-db | fa.access_permissions,
|
|
[2Ksparkyfitness-db | fa.access_end_date
|
|
[2Ksparkyfitness-db | FROM public.family_access fa
|
|
[2Ksparkyfitness-db | JOIN public.profiles p ON p.id = fa.owner_user_id
|
|
[2Ksparkyfitness-db | JOIN public."user" u ON u.id = fa.owner_user_id
|
|
[2Ksparkyfitness-db | WHERE fa.family_user_id = p_user_id
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND has_any_meaningful_permission(fa.access_permissions);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $func$ LANGUAGE plpgsql STABLE;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.find_user_by_email(p_email TEXT)
|
|
[2Ksparkyfitness-db | RETURNS UUID AS $func$
|
|
[2Ksparkyfitness-db | DECLARE
|
|
[2Ksparkyfitness-db | v_user_id UUID;
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | SELECT id INTO v_user_id
|
|
[2Ksparkyfitness-db | FROM public."user"
|
|
[2Ksparkyfitness-db | WHERE LOWER(email) = LOWER(p_email)
|
|
[2Ksparkyfitness-db | LIMIT 1;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | RETURN v_user_id;
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $func$ LANGUAGE plpgsql STABLE SECURITY DEFINER;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_family_access(owner_uuid uuid, perm text) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (fa.access_permissions ->> perm)::boolean = true
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_family_access_or(owner_uuid uuid, perms text[]) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM unnest(perms) p
|
|
[2Ksparkyfitness-db | WHERE (fa.access_permissions ->> p)::boolean = true
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_diary_access(owner_uuid uuid) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (fa.access_permissions->>'can_manage_diary')::boolean = true
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Centralized helper: returns true if the given permissions JSONB contains
|
|
[2Ksparkyfitness-db | -- at least one meaningful delegation permission. Used by has_profile_read_access
|
|
[2Ksparkyfitness-db | -- and get_accessible_users to avoid duplicating the permission key list.
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_any_meaningful_permission(perms jsonb) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql IMMUTABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT (
|
|
[2Ksparkyfitness-db | (perms->>'can_manage_diary')::boolean = true OR
|
|
[2Ksparkyfitness-db | (perms->>'can_manage_checkin')::boolean = true OR
|
|
[2Ksparkyfitness-db | (perms->>'can_view_reports')::boolean = true OR
|
|
[2Ksparkyfitness-db | (perms->>'can_manage_medications')::boolean = true
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_profile_read_access(owner_uuid uuid) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | -- Owner always has access. Family delegates require at least one meaningful permission
|
|
[2Ksparkyfitness-db | -- (diary, checkin, medications, or reports) to read profile/layout/onboarding data.
|
|
[2Ksparkyfitness-db | -- A bare family_access row with no permissions does not grant read access.
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND has_any_meaningful_permission(fa.access_permissions)
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_diary_read_access(owner_uuid uuid) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_manage_diary')::boolean = true OR
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_view_reports')::boolean = true
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_checkin_read_access(owner_uuid uuid) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_manage_checkin')::boolean = true OR
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_view_reports')::boolean = true
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.has_medication_access(owner_uuid uuid) RETURNS boolean
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (fa.access_permissions->>'can_manage_medications')::boolean = true
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.has_medication_read_access(owner_uuid uuid) RETURNS boolean
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_manage_medications')::boolean = true OR
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_view_reports')::boolean = true
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_library_access_with_public(owner_uuid uuid, is_shared bool, perms text[]) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid
|
|
[2Ksparkyfitness-db | OR is_shared
|
|
[2Ksparkyfitness-db | OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_view_reports')::boolean = true OR
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM unnest(perms) p
|
|
[2Ksparkyfitness-db | WHERE (fa.access_permissions ->> p)::boolean = true
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | p <> 'can_manage_diary'
|
|
[2Ksparkyfitness-db | OR current_user_id() = owner_uuid
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | DROP FUNCTION IF EXISTS public.set_app_context(UUID, UUID);
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.set_app_context(p_user_id UUID, p_authenticated_user_id UUID)
|
|
[2Ksparkyfitness-db | RETURNS void AS $$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | -- app.user_id is used by RLS to determine whose data is being accessed
|
|
[2Ksparkyfitness-db | PERFORM set_config('app.user_id', p_user_id::text, false);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- app.authenticated_user_id is the actual logged-in user
|
|
[2Ksparkyfitness-db | PERFORM set_config('app.authenticated_user_id', p_authenticated_user_id::text, false);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $$ LANGUAGE plpgsql SECURITY DEFINER;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | DROP FUNCTION IF EXISTS public.can_access_user_data(UUID, TEXT, UUID);
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.can_access_user_data(
|
|
[2Ksparkyfitness-db | target_user_id UUID,
|
|
[2Ksparkyfitness-db | permission_type TEXT,
|
|
[2Ksparkyfitness-db | auth_user_id UUID
|
|
[2Ksparkyfitness-db | ) RETURNS BOOLEAN AS $func$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | -- Self access
|
|
[2Ksparkyfitness-db | IF target_user_id = auth_user_id THEN
|
|
[2Ksparkyfitness-db | RETURN TRUE;
|
|
[2Ksparkyfitness-db | END IF;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Family access check
|
|
[2Ksparkyfitness-db | RETURN EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1
|
|
[2Ksparkyfitness-db | FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.family_user_id = auth_user_id
|
|
[2Ksparkyfitness-db | AND fa.owner_user_id = target_user_id
|
|
[2Ksparkyfitness-db | AND fa.is_active = TRUE
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > NOW())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>permission_type)::BOOLEAN = TRUE
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | -- Mapping for common permission names
|
|
[2Ksparkyfitness-db | (permission_type = 'diary' AND (fa.access_permissions->>'can_manage_diary')::BOOLEAN = TRUE)
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | (permission_type = 'checkin' AND (fa.access_permissions->>'can_manage_checkin')::BOOLEAN = TRUE)
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | (permission_type = 'reports' AND (fa.access_permissions->>'can_view_reports')::BOOLEAN = TRUE)
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | -- Inheritance: reports permission grants read access to others
|
|
[2Ksparkyfitness-db | (permission_type IN ('calorie', 'diary', 'mood', 'sleep', 'exercise', 'water', 'checkin')
|
|
[2Ksparkyfitness-db | AND (COALESCE((fa.access_permissions->>'reports')::BOOLEAN, FALSE)
|
|
[2Ksparkyfitness-db | OR COALESCE((fa.access_permissions->>'can_view_reports')::BOOLEAN, FALSE)))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $func$ LANGUAGE plpgsql STABLE;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Helper function to check if authenticated user is admin
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION is_admin() RETURNS boolean
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public."user" u
|
|
[2Ksparkyfitness-db | WHERE u.id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND u.role = 'admin'
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 4: Define generic policy creation functions.
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_owner_policy(table_name text, id_column text DEFAULT 'user_id') RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (%I = authenticated_user_id())
|
|
[2Ksparkyfitness-db | WITH CHECK (%I = authenticated_user_id());
|
|
[2Ksparkyfitness-db | ', table_name, id_column, id_column);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_shared_owner_policy(table_name text, id_column text DEFAULT 'user_id') RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (%I = current_user_id());
|
|
[2Ksparkyfitness-db | ', table_name, id_column);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (%I = authenticated_user_id())
|
|
[2Ksparkyfitness-db | WITH CHECK (%I = authenticated_user_id());
|
|
[2Ksparkyfitness-db | ', table_name, id_column, id_column);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_diary_policy(table_name text) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_access(user_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (has_diary_access(user_id));
|
|
[2Ksparkyfitness-db | ', table_name, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_checkin_policy(table_name text) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_checkin_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id OR has_family_access(user_id, ''can_manage_checkin''))
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id OR has_family_access(user_id, ''can_manage_checkin''));
|
|
[2Ksparkyfitness-db | ', table_name, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_library_policy(table_name text, shared_column text, permissions text[]) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | DECLARE
|
|
[2Ksparkyfitness-db | quoted_permissions text;
|
|
[2Ksparkyfitness-db | shared_expression text;
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | -- Quote each permission name to ensure valid ARRAY syntax
|
|
[2Ksparkyfitness-db | SELECT array_to_string(ARRAY(
|
|
[2Ksparkyfitness-db | SELECT quote_literal(p) FROM unnest(permissions) p
|
|
[2Ksparkyfitness-db | ), ',') INTO quoted_permissions;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Use boolean false if shared_column is 'false', otherwise treat as column name
|
|
[2Ksparkyfitness-db | IF shared_column = 'false' THEN
|
|
[2Ksparkyfitness-db | shared_expression := 'false';
|
|
[2Ksparkyfitness-db | ELSE
|
|
[2Ksparkyfitness-db | shared_expression := quote_ident(shared_column);
|
|
[2Ksparkyfitness-db | END IF;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_library_access_with_public(user_id, %s, ARRAY[%s]));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db | ', table_name, shared_expression, quoted_permissions, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.create_medication_policy(table_name text) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_medication_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_medication_access(user_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (has_medication_access(user_id));
|
|
[2Ksparkyfitness-db | ', table_name, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 5: Apply policies to all tables.
|
|
[2Ksparkyfitness-db | -- Custom policy for ai_service_settings to support admin-global + user-owned settings
|
|
[2Ksparkyfitness-db | -- Drop ALL possible old policy names before recreating
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS owner_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS select_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS modify_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_select_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_insert_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_update_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_delete_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | -- SELECT policy: All authenticated users can read public settings, users can read their own
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_select_policy ON public.ai_service_settings FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND authenticated_user_id() IS NOT NULL) OR
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- INSERT policy: Users can create their own settings, admins can create public settings
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_insert_policy ON public.ai_service_settings FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- UPDATE policy: Users can update their own settings, admins can update public settings
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_update_policy ON public.ai_service_settings FOR UPDATE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- DELETE policy: Users can delete their own settings, admins can delete public settings
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_delete_policy ON public.ai_service_settings FOR DELETE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Owner-only access tables
|
|
[2Ksparkyfitness-db | -- Tier 1: Strictly Private (no delegation allowed)
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('api_key', 'reference_id');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_oidc_links');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('sparky_chat_history');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Profiles: delegates can read (with any meaningful permission) but only owner can write.
|
|
[2Ksparkyfitness-db | -- Delegates do not need to modify another user's profile to manage their diary.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.profiles FOR SELECT TO PUBLIC USING (has_profile_read_access(id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.profiles FOR ALL TO PUBLIC USING (authenticated_user_id() = id) WITH CHECK (authenticated_user_id() = id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_preferences FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_preferences FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_goals');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('weekly_goal_plans');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_water_containers');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_custom_nutrients');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_allergen_preferences');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Nutrient display preferences: delegates can read but only owner can rearrange their own columns.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_nutrient_display_preferences FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_nutrient_display_preferences FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Dashboard layouts: delegates can read but only owner can rearrange their own dashboard.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_dashboard_layouts FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_dashboard_layouts FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('goal_presets');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('meal_plans');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('mood_entries');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Admin Activity Logs: Only the admin who performed the action or other admins can view
|
|
[2Ksparkyfitness-db | CREATE POLICY admin_only_select ON public.admin_activity_logs FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (admin_user_id = current_user_id() OR is_admin());
|
|
[2Ksparkyfitness-db | CREATE POLICY admin_only_insert ON public.admin_activity_logs FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (admin_user_id = current_user_id() AND is_admin());
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Diary access tables
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('check_in_measurements');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('check_in_photos');
|
|
[2Ksparkyfitness-db | -- Custom categories/measurements are surfaced through the check-in feature and
|
|
[2Ksparkyfitness-db | -- every /measurements route is guarded by checkPermissionMiddleware('checkin'),
|
|
[2Ksparkyfitness-db | -- so their RLS must use the check-in policy. The previous diary policy required
|
|
[2Ksparkyfitness-db | -- can_manage_diary to write, which blocked check-in delegates (e.g. the GLP-1
|
|
[2Ksparkyfitness-db | -- daily check-in) from saving even though the route allowed them.
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('custom_categories');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('custom_measurements');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('exercise_entries');
|
|
[2Ksparkyfitness-db | -- Custom policy for exercise_entries to allow access if linked to an owned exercise_preset_entry
|
|
[2Ksparkyfitness-db | CREATE POLICY select_exercise_preset_entry_linked_policy ON public.exercise_entries FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | exercise_preset_entry_id IS NOT NULL AND EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.exercise_preset_entries epe
|
|
[2Ksparkyfitness-db | WHERE epe.id = exercise_entries.exercise_preset_entry_id AND has_diary_read_access(epe.user_id)
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- The modify policy for exercise_entries is already handled by create_diary_policy('exercise_entries')
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('exercise_preset_entries');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('food_entry_meals');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('sleep_entries');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('sleep_entry_stages');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('water_intake');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('water_intake_entries');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Library access tables
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('exercises', 'shared_with_public', ARRAY['can_view_exercise_library', 'can_manage_diary']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('foods', 'shared_with_public', ARRAY['can_view_food_library', 'can_manage_diary']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('meals', 'is_public', ARRAY['can_view_food_library', 'can_manage_diary']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('meal_plan_templates', 'false', ARRAY['can_view_food_library']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('workout_plan_templates', 'false', ARRAY['can_view_exercise_library']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('workout_presets', 'is_public', ARRAY['can_view_exercise_library','can_manage_diary']);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Medication & GLP-1 tracker (see migration 20260624000000_add_medication_glp1_schema.sql).
|
|
[2Ksparkyfitness-db | -- These tables are managed by create_medication_policy at the bottom of this file (Tier 3).
|
|
[2Ksparkyfitness-db | -- Do NOT apply create_library_policy or create_diary_policy to medication tables.
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_medication_display_preferences');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Cycle & Pregnancy hub (see migration 20260702180000_add_cycle_tracking_schema.sql).
|
|
[2Ksparkyfitness-db | -- Tier 1 — owner-only. Deliberately stricter than medications: this reproductive
|
|
[2Ksparkyfitness-db | -- health data is NEVER shared or delegated in v1 (no family/caregiver access).
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycle_settings');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycle_daily_entries');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycles');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_cycle_display_preferences');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycle_test_entries');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Pregnancy mode (see migration 20260702200000_add_pregnancy_schema.sql). Tier 1
|
|
[2Ksparkyfitness-db | -- owner-only. health_appointments is generic but still owner-only in v1.
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancies');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_kick_sessions');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_contractions');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_photos');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_checklist_state');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('health_appointments');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- User-defined mood tags. Mood is check-in data (mood_entries uses the check-in
|
|
[2Ksparkyfitness-db | -- policy), and custom check-in definitions like custom_categories are shared with
|
|
[2Ksparkyfitness-db | -- check-in delegates — so custom moods follow the same check-in policy for
|
|
[2Ksparkyfitness-db | -- consistency (a delegate managing the owner's check-in sees the owner's moods).
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('user_custom_moods');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Mood display preferences: personal picker config, owner-only.
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_mood_display_preferences');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Custom policies for special cases
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.exercise_entry_sets FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_sets.exercise_entry_id AND has_diary_read_access(ee.user_id)));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.exercise_entry_sets FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_sets.exercise_entry_id AND has_diary_access(ee.user_id)))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_sets.exercise_entry_id AND has_diary_access(ee.user_id)));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Provider configs: admin-global (is_public) OR own OR family delegation
|
|
[2Ksparkyfitness-db | -- Drop any old policy names first (idempotent)
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS select_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS modify_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS insert_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS update_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS delete_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- SELECT: admin-global (authenticated users), own, or explicit family delegation
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.external_data_providers FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | -- Admin-created global providers: all authenticated users can see them if active
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_active = TRUE AND authenticated_user_id() IS NOT NULL)
|
|
[2Ksparkyfitness-db | -- Owner always sees their own providers
|
|
[2Ksparkyfitness-db | OR (is_public = FALSE AND current_user_id() = user_id)
|
|
[2Ksparkyfitness-db | OR (
|
|
[2Ksparkyfitness-db | -- Explicit family delegation: share_external_providers permission, non-strictly-private only, must be active
|
|
[2Ksparkyfitness-db | is_public = FALSE AND is_active = TRUE AND has_family_access(user_id, 'share_external_providers') AND EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.external_provider_types ept
|
|
[2Ksparkyfitness-db | WHERE ept.id = external_data_providers.provider_type
|
|
[2Ksparkyfitness-db | AND ept.is_strictly_private = FALSE
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- INSERT: users create their own (is_public=FALSE), admins create global (is_public=TRUE)
|
|
[2Ksparkyfitness-db | CREATE POLICY insert_policy ON public.external_data_providers FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- UPDATE: users update own, admins update global
|
|
[2Ksparkyfitness-db | CREATE POLICY update_policy ON public.external_data_providers FOR UPDATE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- DELETE: users delete own, admins delete global
|
|
[2Ksparkyfitness-db | CREATE POLICY delete_policy ON public.external_data_providers FOR DELETE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.family_access FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = owner_user_id OR authenticated_user_id() = family_user_id);
|
|
[2Ksparkyfitness-db | CREATE POLICY insert_policy ON public.family_access FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = owner_user_id);
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.family_access FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = owner_user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = owner_user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.food_entries FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY insert_policy ON public.food_entries FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | has_diary_access(user_id) AND (
|
|
[2Ksparkyfitness-db | (food_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = food_entries.food_id)) OR
|
|
[2Ksparkyfitness-db | (meal_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.meals m WHERE m.id = food_entries.meal_id))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | CREATE POLICY update_policy ON public.food_entries FOR UPDATE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_access(user_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (has_diary_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY delete_policy ON public.food_entries FOR DELETE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_access(user_id));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.food_variants FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.foods f
|
|
[2Ksparkyfitness-db | WHERE f.id = food_variants.food_id
|
|
[2Ksparkyfitness-db | AND has_library_access_with_public(f.user_id, f.shared_with_public, ARRAY['can_view_food_library', 'can_manage_diary'])
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- Food variants are library data: only the owner of the parent food may write
|
|
[2Ksparkyfitness-db | -- them. Delegates (even can_manage_diary) get read-only access via select_policy
|
|
[2Ksparkyfitness-db | -- so they can pick serving sizes while logging, but cannot mutate the library.
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.food_variants FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.foods f
|
|
[2Ksparkyfitness-db | WHERE f.id = food_variants.food_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = f.user_id
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.foods f
|
|
[2Ksparkyfitness-db | WHERE f.id = food_variants.food_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = f.user_id
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- meal_foods is polymorphic: a row references either a food (item_type='food')
|
|
[2Ksparkyfitness-db | -- or another meal (item_type='meal', a reusable sub-meal). Read access follows
|
|
[2Ksparkyfitness-db | -- the parent meal. Write access requires the caller owns the parent meal AND the
|
|
[2Ksparkyfitness-db | -- referenced ingredient is accessible to them: a food they can view, or a child
|
|
[2Ksparkyfitness-db | -- meal they have library access to (prevents linking a meal you cannot see).
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.meal_foods FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_foods.meal_id AND has_library_access_with_public(m.user_id, m.is_public, ARRAY['can_view_food_library', 'can_manage_diary'])));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.meal_foods FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_foods.meal_id AND authenticated_user_id() = m.user_id)
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_foods.meal_id AND authenticated_user_id() = m.user_id)
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (meal_foods.food_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = meal_foods.food_id))
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | (meal_foods.child_meal_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.meals cm WHERE cm.id = meal_foods.child_meal_id AND has_library_access_with_public(cm.user_id, cm.is_public, ARRAY['can_view_food_library', 'can_manage_diary'])))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.meal_plan_template_assignments FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.meal_plan_templates mpt WHERE mpt.id = meal_plan_template_assignments.template_id AND has_diary_access(mpt.user_id)) AND
|
|
[2Ksparkyfitness-db | (((item_type = 'food') AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = meal_plan_template_assignments.food_id)) OR
|
|
[2Ksparkyfitness-db | ((item_type = 'meal') AND EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_plan_template_assignments.meal_id))))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.meal_plan_templates mpt WHERE mpt.id = meal_plan_template_assignments.template_id AND has_diary_access(mpt.user_id)) AND
|
|
[2Ksparkyfitness-db | (((item_type = 'food') AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = meal_plan_template_assignments.food_id)) OR
|
|
[2Ksparkyfitness-db | ((item_type = 'meal') AND EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_plan_template_assignments.meal_id))));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.workout_plan_assignment_sets FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_plan_template_assignments wpta WHERE wpta.id = workout_plan_assignment_sets.assignment_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.workout_plan_template_assignments wpta WHERE wpta.id = workout_plan_assignment_sets.assignment_id));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.workout_plan_template_assignments FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_plan_templates wpt WHERE wpt.id = workout_plan_template_assignments.template_id AND has_diary_access(wpt.user_id)))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.workout_plan_templates wpt WHERE wpt.id = workout_plan_template_assignments.template_id AND has_diary_access(wpt.user_id)));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.workout_preset_exercise_sets FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_preset_exercises wpe WHERE wpe.id = workout_preset_exercise_sets.workout_preset_exercise_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.workout_preset_exercise_sets FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_preset_exercises wpe
|
|
[2Ksparkyfitness-db | JOIN public.workout_presets wp ON wp.id = wpe.workout_preset_id
|
|
[2Ksparkyfitness-db | WHERE wpe.id = workout_preset_exercise_sets.workout_preset_exercise_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_preset_exercises wpe
|
|
[2Ksparkyfitness-db | JOIN public.workout_presets wp ON wp.id = wpe.workout_preset_id
|
|
[2Ksparkyfitness-db | WHERE wpe.id = workout_preset_exercise_sets.workout_preset_exercise_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.workout_preset_exercises FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_presets wp WHERE wp.id = workout_preset_exercises.workout_preset_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.workout_preset_exercises FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_presets wp
|
|
[2Ksparkyfitness-db | WHERE wp.id = workout_preset_exercises.workout_preset_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_presets wp
|
|
[2Ksparkyfitness-db | WHERE wp.id = workout_preset_exercises.workout_preset_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Strictly Private (Tier 1)
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_ignored_updates');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Meal types: access if user_id is null (system) or if user has diary access
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.meal_types FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (user_id IS NULL OR has_diary_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.meal_types FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (user_id = authenticated_user_id())
|
|
[2Ksparkyfitness-db | WITH CHECK (user_id = authenticated_user_id());
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Activity details: access if linked exercise entry or preset entry is accessible
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.exercise_entry_activity_details FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (exercise_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_id AND has_diary_read_access(ee.user_id))) OR
|
|
[2Ksparkyfitness-db | (exercise_preset_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_preset_entries epe WHERE epe.id = exercise_preset_entry_id AND has_diary_read_access(epe.user_id)))
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.exercise_entry_activity_details FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (exercise_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_id AND has_diary_access(ee.user_id))) OR
|
|
[2Ksparkyfitness-db | (exercise_preset_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_preset_entries epe WHERE epe.id = exercise_preset_entry_id AND has_diary_access(epe.user_id)))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (exercise_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_id AND has_diary_access(ee.user_id))) OR
|
|
[2Ksparkyfitness-db | (exercise_preset_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_preset_entries epe WHERE epe.id = exercise_preset_entry_id AND has_diary_access(epe.user_id)))
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Shared View-Only (Tier 2)
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('fasting_logs');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_meal_visibilities');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('sleep_need_calculations');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('daily_sleep_need');
|
|
[2Ksparkyfitness-db | -- Day classification is a sleep/wellness (check-in) feature, used only by the
|
|
[2Ksparkyfitness-db | -- sleep-science service. It must use the check-in policy so check-in delegates
|
|
[2Ksparkyfitness-db | -- can manage it; the previous diary policy was a misclassification.
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('day_classification_cache');
|
|
[2Ksparkyfitness-db | -- Onboarding data/status: delegates can read (to avoid repeated onboarding prompts when viewing
|
|
[2Ksparkyfitness-db | -- another user's diary) but only the account owner can submit or reset their own onboarding.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.onboarding_data FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.onboarding_data FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.onboarding_status FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.onboarding_status FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Medications & Symptoms (Tier 3 - Delegate Writable with medications permission)
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medications');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_schedules');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_entries');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_pens');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('injection_entries');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_titration_steps');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('user_custom_symptoms');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('symptom_entries');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('user_custom_symptom_locations');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Medications Display Preferences (Tier 2 - Owner-Only Write, Delegate Read)
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_medication_display_preferences FOR SELECT TO PUBLIC USING (has_medication_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_medication_display_preferences FOR ALL TO PUBLIC USING (authenticated_user_id() = user_id) WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | 2026-11-03 03:01:39.844 CET [832] ERROR: relation "public.user_custom_symptom_locations" does not exist
|
|
[2Ksparkyfitness-db | 2026-11-03 03:01:39.844 CET [832] CONTEXT: SQL statement "ALTER TABLE public.user_custom_symptom_locations ENABLE ROW LEVEL SECURITY;"
|
|
[2Ksparkyfitness-db | PL/pgSQL function inline_code_block line 86 at EXECUTE
|
|
[2Ksparkyfitness-db | 2026-11-03 03:01:39.844 CET [832] STATEMENT: -- File: rls_policies.sql
|
|
[2Ksparkyfitness-db | -- =============================================================================
|
|
[2Ksparkyfitness-db | -- THIS FILE IS THE SINGLE SOURCE OF TRUTH FOR ALL RLS POLICIES IN THE APPLICATION.
|
|
[2Ksparkyfitness-db | -- It is executed on every server startup after migrations to ensure a consistent security state.
|
|
[2Ksparkyfitness-db | -- This script is generated from the db_schema_backup.sql to ensure all custom policies are included.
|
|
[2Ksparkyfitness-db | -- =============================================================================
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 1: Purge all existing RLS policies from the public schema in a single operation.
|
|
[2Ksparkyfitness-db | DO $$
|
|
[2Ksparkyfitness-db | DECLARE
|
|
[2Ksparkyfitness-db | pol RECORD;
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | FOR pol IN SELECT * FROM pg_policies WHERE schemaname = 'public'
|
|
[2Ksparkyfitness-db | LOOP
|
|
[2Ksparkyfitness-db | EXECUTE 'DROP POLICY IF EXISTS ' || quote_ident(pol.policyname) || ' ON ' || quote_ident(pol.schemaname) || '.' || quote_ident(pol.tablename);
|
|
[2Ksparkyfitness-db | END LOOP;
|
|
[2Ksparkyfitness-db | END $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 2: Enable RLS on all relevant tables to ensure consistent security state.
|
|
[2Ksparkyfitness-db | DO $$
|
|
[2Ksparkyfitness-db | DECLARE
|
|
[2Ksparkyfitness-db | table_name text;
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | FOR table_name IN SELECT unnest(ARRAY[
|
|
[2Ksparkyfitness-db | 'ai_service_settings',
|
|
[2Ksparkyfitness-db | 'check_in_measurements',
|
|
[2Ksparkyfitness-db | 'check_in_photos',
|
|
[2Ksparkyfitness-db | 'custom_categories',
|
|
[2Ksparkyfitness-db | 'custom_measurements',
|
|
[2Ksparkyfitness-db | 'exercise_entries',
|
|
[2Ksparkyfitness-db | 'exercise_entry_sets',
|
|
[2Ksparkyfitness-db | 'exercise_entry_activity_details',
|
|
[2Ksparkyfitness-db | 'exercises',
|
|
[2Ksparkyfitness-db | 'exercise_preset_entries',
|
|
[2Ksparkyfitness-db | 'external_data_providers',
|
|
[2Ksparkyfitness-db | 'family_access',
|
|
[2Ksparkyfitness-db | 'food_entries',
|
|
[2Ksparkyfitness-db | 'food_entry_meals',
|
|
[2Ksparkyfitness-db | 'food_variants',
|
|
[2Ksparkyfitness-db | 'foods',
|
|
[2Ksparkyfitness-db | 'goal_presets',
|
|
[2Ksparkyfitness-db | 'meal_foods',
|
|
[2Ksparkyfitness-db | 'meal_plan_template_assignments',
|
|
[2Ksparkyfitness-db | 'meal_plan_templates',
|
|
[2Ksparkyfitness-db | 'meal_plans',
|
|
[2Ksparkyfitness-db | 'meals',
|
|
[2Ksparkyfitness-db | 'meal_types',
|
|
[2Ksparkyfitness-db | 'mood_entries',
|
|
[2Ksparkyfitness-db | 'onboarding_data',
|
|
[2Ksparkyfitness-db | 'onboarding_status',
|
|
[2Ksparkyfitness-db | 'profiles',
|
|
[2Ksparkyfitness-db | 'sparky_chat_history',
|
|
[2Ksparkyfitness-db | 'admin_activity_logs',
|
|
[2Ksparkyfitness-db | 'api_key',
|
|
[2Ksparkyfitness-db | 'user_goals',
|
|
[2Ksparkyfitness-db | 'user_ignored_updates',
|
|
[2Ksparkyfitness-db | 'user_meal_visibilities',
|
|
[2Ksparkyfitness-db | 'user_nutrient_display_preferences',
|
|
[2Ksparkyfitness-db | 'user_oidc_links',
|
|
[2Ksparkyfitness-db | 'user_preferences',
|
|
[2Ksparkyfitness-db | 'user_water_containers',
|
|
[2Ksparkyfitness-db | 'water_intake',
|
|
[2Ksparkyfitness-db | 'water_intake_entries',
|
|
[2Ksparkyfitness-db | 'weekly_goal_plans',
|
|
[2Ksparkyfitness-db | 'workout_plan_assignment_sets',
|
|
[2Ksparkyfitness-db | 'workout_plan_template_assignments',
|
|
[2Ksparkyfitness-db | 'workout_plan_templates',
|
|
[2Ksparkyfitness-db | 'workout_preset_exercise_sets',
|
|
[2Ksparkyfitness-db | 'workout_preset_exercises',
|
|
[2Ksparkyfitness-db | 'workout_presets',
|
|
[2Ksparkyfitness-db | 'sleep_entries',
|
|
[2Ksparkyfitness-db | 'sleep_entry_stages',
|
|
[2Ksparkyfitness-db | 'fasting_logs',
|
|
[2Ksparkyfitness-db | 'user_custom_nutrients',
|
|
[2Ksparkyfitness-db | 'user_allergen_preferences',
|
|
[2Ksparkyfitness-db | 'user_dashboard_layouts',
|
|
[2Ksparkyfitness-db | 'sleep_need_calculations',
|
|
[2Ksparkyfitness-db | 'daily_sleep_need',
|
|
[2Ksparkyfitness-db | 'day_classification_cache',
|
|
[2Ksparkyfitness-db | 'medications',
|
|
[2Ksparkyfitness-db | 'medication_schedules',
|
|
[2Ksparkyfitness-db | 'medication_entries',
|
|
[2Ksparkyfitness-db | 'medication_pens',
|
|
[2Ksparkyfitness-db | 'injection_entries',
|
|
[2Ksparkyfitness-db | 'medication_titration_steps',
|
|
[2Ksparkyfitness-db | 'user_custom_symptoms',
|
|
[2Ksparkyfitness-db | 'symptom_entries',
|
|
[2Ksparkyfitness-db | 'user_medication_display_preferences',
|
|
[2Ksparkyfitness-db | 'user_custom_symptom_locations',
|
|
[2Ksparkyfitness-db | 'cycle_settings',
|
|
[2Ksparkyfitness-db | 'cycle_daily_entries',
|
|
[2Ksparkyfitness-db | 'cycles',
|
|
[2Ksparkyfitness-db | 'user_cycle_display_preferences',
|
|
[2Ksparkyfitness-db | 'cycle_test_entries',
|
|
[2Ksparkyfitness-db | 'pregnancies',
|
|
[2Ksparkyfitness-db | 'pregnancy_kick_sessions',
|
|
[2Ksparkyfitness-db | 'pregnancy_contractions',
|
|
[2Ksparkyfitness-db | 'pregnancy_photos',
|
|
[2Ksparkyfitness-db | 'pregnancy_checklist_state',
|
|
[2Ksparkyfitness-db | 'health_appointments',
|
|
[2Ksparkyfitness-db | 'user_custom_moods',
|
|
[2Ksparkyfitness-db | 'user_mood_display_preferences'
|
|
[2Ksparkyfitness-db | ]::text[])
|
|
[2Ksparkyfitness-db | LOOP
|
|
[2Ksparkyfitness-db | EXECUTE 'ALTER TABLE public.' || quote_ident(table_name) || ' ENABLE ROW LEVEL SECURITY;';
|
|
[2Ksparkyfitness-db | END LOOP;
|
|
[2Ksparkyfitness-db | END $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 3: Define reusable helper functions for common RLS conditions.
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION current_user_id() RETURNS uuid
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT NULLIF(current_setting('app.user_id', true), '')::uuid;
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION authenticated_user_id() RETURNS uuid
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT NULLIF(current_setting('app.authenticated_user_id', true), '')::uuid;
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.get_accessible_users(p_user_id UUID)
|
|
[2Ksparkyfitness-db | RETURNS TABLE(
|
|
[2Ksparkyfitness-db | user_id UUID,
|
|
[2Ksparkyfitness-db | full_name TEXT,
|
|
[2Ksparkyfitness-db | email TEXT,
|
|
[2Ksparkyfitness-db | permissions JSONB,
|
|
[2Ksparkyfitness-db | access_end_date TIMESTAMP WITH TIME ZONE
|
|
[2Ksparkyfitness-db | ) AS $func$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | RETURN QUERY
|
|
[2Ksparkyfitness-db | SELECT
|
|
[2Ksparkyfitness-db | fa.owner_user_id,
|
|
[2Ksparkyfitness-db | p.full_name,
|
|
[2Ksparkyfitness-db | u.email::TEXT,
|
|
[2Ksparkyfitness-db | fa.access_permissions,
|
|
[2Ksparkyfitness-db | fa.access_end_date
|
|
[2Ksparkyfitness-db | FROM public.family_access fa
|
|
[2Ksparkyfitness-db | JOIN public.profiles p ON p.id = fa.owner_user_id
|
|
[2Ksparkyfitness-db | JOIN public."user" u ON u.id = fa.owner_user_id
|
|
[2Ksparkyfitness-db | WHERE fa.family_user_id = p_user_id
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND has_any_meaningful_permission(fa.access_permissions);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $func$ LANGUAGE plpgsql STABLE;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.find_user_by_email(p_email TEXT)
|
|
[2Ksparkyfitness-db | RETURNS UUID AS $func$
|
|
[2Ksparkyfitness-db | DECLARE
|
|
[2Ksparkyfitness-db | v_user_id UUID;
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | SELECT id INTO v_user_id
|
|
[2Ksparkyfitness-db | FROM public."user"
|
|
[2Ksparkyfitness-db | WHERE LOWER(email) = LOWER(p_email)
|
|
[2Ksparkyfitness-db | LIMIT 1;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | RETURN v_user_id;
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $func$ LANGUAGE plpgsql STABLE SECURITY DEFINER;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_family_access(owner_uuid uuid, perm text) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (fa.access_permissions ->> perm)::boolean = true
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_family_access_or(owner_uuid uuid, perms text[]) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM unnest(perms) p
|
|
[2Ksparkyfitness-db | WHERE (fa.access_permissions ->> p)::boolean = true
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_diary_access(owner_uuid uuid) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (fa.access_permissions->>'can_manage_diary')::boolean = true
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Centralized helper: returns true if the given permissions JSONB contains
|
|
[2Ksparkyfitness-db | -- at least one meaningful delegation permission. Used by has_profile_read_access
|
|
[2Ksparkyfitness-db | -- and get_accessible_users to avoid duplicating the permission key list.
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_any_meaningful_permission(perms jsonb) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql IMMUTABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT (
|
|
[2Ksparkyfitness-db | (perms->>'can_manage_diary')::boolean = true OR
|
|
[2Ksparkyfitness-db | (perms->>'can_manage_checkin')::boolean = true OR
|
|
[2Ksparkyfitness-db | (perms->>'can_view_reports')::boolean = true OR
|
|
[2Ksparkyfitness-db | (perms->>'can_manage_medications')::boolean = true
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_profile_read_access(owner_uuid uuid) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | -- Owner always has access. Family delegates require at least one meaningful permission
|
|
[2Ksparkyfitness-db | -- (diary, checkin, medications, or reports) to read profile/layout/onboarding data.
|
|
[2Ksparkyfitness-db | -- A bare family_access row with no permissions does not grant read access.
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND has_any_meaningful_permission(fa.access_permissions)
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_diary_read_access(owner_uuid uuid) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_manage_diary')::boolean = true OR
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_view_reports')::boolean = true
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_checkin_read_access(owner_uuid uuid) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_manage_checkin')::boolean = true OR
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_view_reports')::boolean = true
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.has_medication_access(owner_uuid uuid) RETURNS boolean
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (fa.access_permissions->>'can_manage_medications')::boolean = true
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.has_medication_read_access(owner_uuid uuid) RETURNS boolean
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_manage_medications')::boolean = true OR
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_view_reports')::boolean = true
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION has_library_access_with_public(owner_uuid uuid, is_shared bool, perms text[]) RETURNS bool
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT authenticated_user_id() = owner_uuid
|
|
[2Ksparkyfitness-db | OR is_shared
|
|
[2Ksparkyfitness-db | OR EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.owner_user_id = owner_uuid
|
|
[2Ksparkyfitness-db | AND fa.family_user_id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND fa.is_active = true
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > now())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>'can_view_reports')::boolean = true OR
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM unnest(perms) p
|
|
[2Ksparkyfitness-db | WHERE (fa.access_permissions ->> p)::boolean = true
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | p <> 'can_manage_diary'
|
|
[2Ksparkyfitness-db | OR current_user_id() = owner_uuid
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | DROP FUNCTION IF EXISTS public.set_app_context(UUID, UUID);
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.set_app_context(p_user_id UUID, p_authenticated_user_id UUID)
|
|
[2Ksparkyfitness-db | RETURNS void AS $$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | -- app.user_id is used by RLS to determine whose data is being accessed
|
|
[2Ksparkyfitness-db | PERFORM set_config('app.user_id', p_user_id::text, false);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- app.authenticated_user_id is the actual logged-in user
|
|
[2Ksparkyfitness-db | PERFORM set_config('app.authenticated_user_id', p_authenticated_user_id::text, false);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $$ LANGUAGE plpgsql SECURITY DEFINER;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | DROP FUNCTION IF EXISTS public.can_access_user_data(UUID, TEXT, UUID);
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.can_access_user_data(
|
|
[2Ksparkyfitness-db | target_user_id UUID,
|
|
[2Ksparkyfitness-db | permission_type TEXT,
|
|
[2Ksparkyfitness-db | auth_user_id UUID
|
|
[2Ksparkyfitness-db | ) RETURNS BOOLEAN AS $func$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | -- Self access
|
|
[2Ksparkyfitness-db | IF target_user_id = auth_user_id THEN
|
|
[2Ksparkyfitness-db | RETURN TRUE;
|
|
[2Ksparkyfitness-db | END IF;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Family access check
|
|
[2Ksparkyfitness-db | RETURN EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1
|
|
[2Ksparkyfitness-db | FROM public.family_access fa
|
|
[2Ksparkyfitness-db | WHERE fa.family_user_id = auth_user_id
|
|
[2Ksparkyfitness-db | AND fa.owner_user_id = target_user_id
|
|
[2Ksparkyfitness-db | AND fa.is_active = TRUE
|
|
[2Ksparkyfitness-db | AND (fa.access_end_date IS NULL OR fa.access_end_date > NOW())
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (fa.access_permissions->>permission_type)::BOOLEAN = TRUE
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | -- Mapping for common permission names
|
|
[2Ksparkyfitness-db | (permission_type = 'diary' AND (fa.access_permissions->>'can_manage_diary')::BOOLEAN = TRUE)
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | (permission_type = 'checkin' AND (fa.access_permissions->>'can_manage_checkin')::BOOLEAN = TRUE)
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | (permission_type = 'reports' AND (fa.access_permissions->>'can_view_reports')::BOOLEAN = TRUE)
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | -- Inheritance: reports permission grants read access to others
|
|
[2Ksparkyfitness-db | (permission_type IN ('calorie', 'diary', 'mood', 'sleep', 'exercise', 'water', 'checkin')
|
|
[2Ksparkyfitness-db | AND (COALESCE((fa.access_permissions->>'reports')::BOOLEAN, FALSE)
|
|
[2Ksparkyfitness-db | OR COALESCE((fa.access_permissions->>'can_view_reports')::BOOLEAN, FALSE)))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $func$ LANGUAGE plpgsql STABLE;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Helper function to check if authenticated user is admin
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION is_admin() RETURNS boolean
|
|
[2Ksparkyfitness-db | LANGUAGE sql STABLE
|
|
[2Ksparkyfitness-db | AS $function$
|
|
[2Ksparkyfitness-db | SELECT EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public."user" u
|
|
[2Ksparkyfitness-db | WHERE u.id = authenticated_user_id()
|
|
[2Ksparkyfitness-db | AND u.role = 'admin'
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | $function$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 4: Define generic policy creation functions.
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_owner_policy(table_name text, id_column text DEFAULT 'user_id') RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (%I = authenticated_user_id())
|
|
[2Ksparkyfitness-db | WITH CHECK (%I = authenticated_user_id());
|
|
[2Ksparkyfitness-db | ', table_name, id_column, id_column);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_shared_owner_policy(table_name text, id_column text DEFAULT 'user_id') RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS owner_modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (%I = current_user_id());
|
|
[2Ksparkyfitness-db | ', table_name, id_column);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (%I = authenticated_user_id())
|
|
[2Ksparkyfitness-db | WITH CHECK (%I = authenticated_user_id());
|
|
[2Ksparkyfitness-db | ', table_name, id_column, id_column);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_diary_policy(table_name text) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_access(user_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (has_diary_access(user_id));
|
|
[2Ksparkyfitness-db | ', table_name, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_checkin_policy(table_name text) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_checkin_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id OR has_family_access(user_id, ''can_manage_checkin''))
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id OR has_family_access(user_id, ''can_manage_checkin''));
|
|
[2Ksparkyfitness-db | ', table_name, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION create_library_policy(table_name text, shared_column text, permissions text[]) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $_$
|
|
[2Ksparkyfitness-db | DECLARE
|
|
[2Ksparkyfitness-db | quoted_permissions text;
|
|
[2Ksparkyfitness-db | shared_expression text;
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | -- Quote each permission name to ensure valid ARRAY syntax
|
|
[2Ksparkyfitness-db | SELECT array_to_string(ARRAY(
|
|
[2Ksparkyfitness-db | SELECT quote_literal(p) FROM unnest(permissions) p
|
|
[2Ksparkyfitness-db | ), ',') INTO quoted_permissions;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Use boolean false if shared_column is 'false', otherwise treat as column name
|
|
[2Ksparkyfitness-db | IF shared_column = 'false' THEN
|
|
[2Ksparkyfitness-db | shared_expression := 'false';
|
|
[2Ksparkyfitness-db | ELSE
|
|
[2Ksparkyfitness-db | shared_expression := quote_ident(shared_column);
|
|
[2Ksparkyfitness-db | END IF;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_library_access_with_public(user_id, %s, ARRAY[%s]));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db | ', table_name, shared_expression, quoted_permissions, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $_$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE OR REPLACE FUNCTION public.create_medication_policy(table_name text) RETURNS void
|
|
[2Ksparkyfitness-db | LANGUAGE plpgsql
|
|
[2Ksparkyfitness-db | AS $$
|
|
[2Ksparkyfitness-db | BEGIN
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS select_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db | EXECUTE format('DROP POLICY IF EXISTS modify_policy ON public.%I;', table_name);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | EXECUTE format('
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.%I FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_medication_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.%I FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_medication_access(user_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (has_medication_access(user_id));
|
|
[2Ksparkyfitness-db | ', table_name, table_name);
|
|
[2Ksparkyfitness-db | END;
|
|
[2Ksparkyfitness-db | $$;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Step 5: Apply policies to all tables.
|
|
[2Ksparkyfitness-db | -- Custom policy for ai_service_settings to support admin-global + user-owned settings
|
|
[2Ksparkyfitness-db | -- Drop ALL possible old policy names before recreating
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS owner_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS select_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS modify_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_select_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_insert_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_update_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS ai_service_settings_delete_policy ON public.ai_service_settings;
|
|
[2Ksparkyfitness-db | -- SELECT policy: All authenticated users can read public settings, users can read their own
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_select_policy ON public.ai_service_settings FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND authenticated_user_id() IS NOT NULL) OR
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- INSERT policy: Users can create their own settings, admins can create public settings
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_insert_policy ON public.ai_service_settings FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- UPDATE policy: Users can update their own settings, admins can update public settings
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_update_policy ON public.ai_service_settings FOR UPDATE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- DELETE policy: Users can delete their own settings, admins can delete public settings
|
|
[2Ksparkyfitness-db | CREATE POLICY ai_service_settings_delete_policy ON public.ai_service_settings FOR DELETE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Owner-only access tables
|
|
[2Ksparkyfitness-db | -- Tier 1: Strictly Private (no delegation allowed)
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('api_key', 'reference_id');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_oidc_links');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('sparky_chat_history');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Profiles: delegates can read (with any meaningful permission) but only owner can write.
|
|
[2Ksparkyfitness-db | -- Delegates do not need to modify another user's profile to manage their diary.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.profiles FOR SELECT TO PUBLIC USING (has_profile_read_access(id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.profiles FOR ALL TO PUBLIC USING (authenticated_user_id() = id) WITH CHECK (authenticated_user_id() = id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_preferences FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_preferences FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_goals');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('weekly_goal_plans');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_water_containers');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_custom_nutrients');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_allergen_preferences');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Nutrient display preferences: delegates can read but only owner can rearrange their own columns.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_nutrient_display_preferences FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_nutrient_display_preferences FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Dashboard layouts: delegates can read but only owner can rearrange their own dashboard.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_dashboard_layouts FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_dashboard_layouts FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('goal_presets');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('meal_plans');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('mood_entries');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Admin Activity Logs: Only the admin who performed the action or other admins can view
|
|
[2Ksparkyfitness-db | CREATE POLICY admin_only_select ON public.admin_activity_logs FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (admin_user_id = current_user_id() OR is_admin());
|
|
[2Ksparkyfitness-db | CREATE POLICY admin_only_insert ON public.admin_activity_logs FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (admin_user_id = current_user_id() AND is_admin());
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Diary access tables
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('check_in_measurements');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('check_in_photos');
|
|
[2Ksparkyfitness-db | -- Custom categories/measurements are surfaced through the check-in feature and
|
|
[2Ksparkyfitness-db | -- every /measurements route is guarded by checkPermissionMiddleware('checkin'),
|
|
[2Ksparkyfitness-db | -- so their RLS must use the check-in policy. The previous diary policy required
|
|
[2Ksparkyfitness-db | -- can_manage_diary to write, which blocked check-in delegates (e.g. the GLP-1
|
|
[2Ksparkyfitness-db | -- daily check-in) from saving even though the route allowed them.
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('custom_categories');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('custom_measurements');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('exercise_entries');
|
|
[2Ksparkyfitness-db | -- Custom policy for exercise_entries to allow access if linked to an owned exercise_preset_entry
|
|
[2Ksparkyfitness-db | CREATE POLICY select_exercise_preset_entry_linked_policy ON public.exercise_entries FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | exercise_preset_entry_id IS NOT NULL AND EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.exercise_preset_entries epe
|
|
[2Ksparkyfitness-db | WHERE epe.id = exercise_entries.exercise_preset_entry_id AND has_diary_read_access(epe.user_id)
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- The modify policy for exercise_entries is already handled by create_diary_policy('exercise_entries')
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('exercise_preset_entries');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('food_entry_meals');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('sleep_entries');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('sleep_entry_stages');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('water_intake');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('water_intake_entries');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Library access tables
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('exercises', 'shared_with_public', ARRAY['can_view_exercise_library', 'can_manage_diary']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('foods', 'shared_with_public', ARRAY['can_view_food_library', 'can_manage_diary']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('meals', 'is_public', ARRAY['can_view_food_library', 'can_manage_diary']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('meal_plan_templates', 'false', ARRAY['can_view_food_library']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('workout_plan_templates', 'false', ARRAY['can_view_exercise_library']);
|
|
[2Ksparkyfitness-db | SELECT create_library_policy('workout_presets', 'is_public', ARRAY['can_view_exercise_library','can_manage_diary']);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Medication & GLP-1 tracker (see migration 20260624000000_add_medication_glp1_schema.sql).
|
|
[2Ksparkyfitness-db | -- These tables are managed by create_medication_policy at the bottom of this file (Tier 3).
|
|
[2Ksparkyfitness-db | -- Do NOT apply create_library_policy or create_diary_policy to medication tables.
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_medication_display_preferences');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Cycle & Pregnancy hub (see migration 20260702180000_add_cycle_tracking_schema.sql).
|
|
[2Ksparkyfitness-db | -- Tier 1 — owner-only. Deliberately stricter than medications: this reproductive
|
|
[2Ksparkyfitness-db | -- health data is NEVER shared or delegated in v1 (no family/caregiver access).
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycle_settings');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycle_daily_entries');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycles');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_cycle_display_preferences');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('cycle_test_entries');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Pregnancy mode (see migration 20260702200000_add_pregnancy_schema.sql). Tier 1
|
|
[2Ksparkyfitness-db | -- owner-only. health_appointments is generic but still owner-only in v1.
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancies');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_kick_sessions');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_contractions');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_photos');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('pregnancy_checklist_state');
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('health_appointments');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- User-defined mood tags. Mood is check-in data (mood_entries uses the check-in
|
|
[2Ksparkyfitness-db | -- policy), and custom check-in definitions like custom_categories are shared with
|
|
[2Ksparkyfitness-db | -- check-in delegates — so custom moods follow the same check-in policy for
|
|
[2Ksparkyfitness-db | -- consistency (a delegate managing the owner's check-in sees the owner's moods).
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('user_custom_moods');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Mood display preferences: personal picker config, owner-only.
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_mood_display_preferences');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Custom policies for special cases
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.exercise_entry_sets FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_sets.exercise_entry_id AND has_diary_read_access(ee.user_id)));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.exercise_entry_sets FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_sets.exercise_entry_id AND has_diary_access(ee.user_id)))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_sets.exercise_entry_id AND has_diary_access(ee.user_id)));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Provider configs: admin-global (is_public) OR own OR family delegation
|
|
[2Ksparkyfitness-db | -- Drop any old policy names first (idempotent)
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS select_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS modify_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS insert_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS update_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db | DROP POLICY IF EXISTS delete_policy ON public.external_data_providers;
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- SELECT: admin-global (authenticated users), own, or explicit family delegation
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.external_data_providers FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | -- Admin-created global providers: all authenticated users can see them if active
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_active = TRUE AND authenticated_user_id() IS NOT NULL)
|
|
[2Ksparkyfitness-db | -- Owner always sees their own providers
|
|
[2Ksparkyfitness-db | OR (is_public = FALSE AND current_user_id() = user_id)
|
|
[2Ksparkyfitness-db | OR (
|
|
[2Ksparkyfitness-db | -- Explicit family delegation: share_external_providers permission, non-strictly-private only, must be active
|
|
[2Ksparkyfitness-db | is_public = FALSE AND is_active = TRUE AND has_family_access(user_id, 'share_external_providers') AND EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.external_provider_types ept
|
|
[2Ksparkyfitness-db | WHERE ept.id = external_data_providers.provider_type
|
|
[2Ksparkyfitness-db | AND ept.is_strictly_private = FALSE
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- INSERT: users create their own (is_public=FALSE), admins create global (is_public=TRUE)
|
|
[2Ksparkyfitness-db | CREATE POLICY insert_policy ON public.external_data_providers FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- UPDATE: users update own, admins update global
|
|
[2Ksparkyfitness-db | CREATE POLICY update_policy ON public.external_data_providers FOR UPDATE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- DELETE: users delete own, admins delete global
|
|
[2Ksparkyfitness-db | CREATE POLICY delete_policy ON public.external_data_providers FOR DELETE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (is_public = FALSE AND user_id = authenticated_user_id()) OR
|
|
[2Ksparkyfitness-db | (is_public = TRUE AND is_admin())
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.family_access FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = owner_user_id OR authenticated_user_id() = family_user_id);
|
|
[2Ksparkyfitness-db | CREATE POLICY insert_policy ON public.family_access FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = owner_user_id);
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.family_access FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = owner_user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = owner_user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.food_entries FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY insert_policy ON public.food_entries FOR INSERT TO PUBLIC
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | has_diary_access(user_id) AND (
|
|
[2Ksparkyfitness-db | (food_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = food_entries.food_id)) OR
|
|
[2Ksparkyfitness-db | (meal_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.meals m WHERE m.id = food_entries.meal_id))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | CREATE POLICY update_policy ON public.food_entries FOR UPDATE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_access(user_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (has_diary_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY delete_policy ON public.food_entries FOR DELETE TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (has_diary_access(user_id));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.food_variants FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.foods f
|
|
[2Ksparkyfitness-db | WHERE f.id = food_variants.food_id
|
|
[2Ksparkyfitness-db | AND has_library_access_with_public(f.user_id, f.shared_with_public, ARRAY['can_view_food_library', 'can_manage_diary'])
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | -- Food variants are library data: only the owner of the parent food may write
|
|
[2Ksparkyfitness-db | -- them. Delegates (even can_manage_diary) get read-only access via select_policy
|
|
[2Ksparkyfitness-db | -- so they can pick serving sizes while logging, but cannot mutate the library.
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.food_variants FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.foods f
|
|
[2Ksparkyfitness-db | WHERE f.id = food_variants.food_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = f.user_id
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.foods f
|
|
[2Ksparkyfitness-db | WHERE f.id = food_variants.food_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = f.user_id
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- meal_foods is polymorphic: a row references either a food (item_type='food')
|
|
[2Ksparkyfitness-db | -- or another meal (item_type='meal', a reusable sub-meal). Read access follows
|
|
[2Ksparkyfitness-db | -- the parent meal. Write access requires the caller owns the parent meal AND the
|
|
[2Ksparkyfitness-db | -- referenced ingredient is accessible to them: a food they can view, or a child
|
|
[2Ksparkyfitness-db | -- meal they have library access to (prevents linking a meal you cannot see).
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.meal_foods FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_foods.meal_id AND has_library_access_with_public(m.user_id, m.is_public, ARRAY['can_view_food_library', 'can_manage_diary'])));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.meal_foods FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_foods.meal_id AND authenticated_user_id() = m.user_id)
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_foods.meal_id AND authenticated_user_id() = m.user_id)
|
|
[2Ksparkyfitness-db | AND (
|
|
[2Ksparkyfitness-db | (meal_foods.food_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = meal_foods.food_id))
|
|
[2Ksparkyfitness-db | OR
|
|
[2Ksparkyfitness-db | (meal_foods.child_meal_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.meals cm WHERE cm.id = meal_foods.child_meal_id AND has_library_access_with_public(cm.user_id, cm.is_public, ARRAY['can_view_food_library', 'can_manage_diary'])))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.meal_plan_template_assignments FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.meal_plan_templates mpt WHERE mpt.id = meal_plan_template_assignments.template_id AND has_diary_access(mpt.user_id)) AND
|
|
[2Ksparkyfitness-db | (((item_type = 'food') AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = meal_plan_template_assignments.food_id)) OR
|
|
[2Ksparkyfitness-db | ((item_type = 'meal') AND EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_plan_template_assignments.meal_id))))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.meal_plan_templates mpt WHERE mpt.id = meal_plan_template_assignments.template_id AND has_diary_access(mpt.user_id)) AND
|
|
[2Ksparkyfitness-db | (((item_type = 'food') AND EXISTS (SELECT 1 FROM public.foods f WHERE f.id = meal_plan_template_assignments.food_id)) OR
|
|
[2Ksparkyfitness-db | ((item_type = 'meal') AND EXISTS (SELECT 1 FROM public.meals m WHERE m.id = meal_plan_template_assignments.meal_id))));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.workout_plan_assignment_sets FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_plan_template_assignments wpta WHERE wpta.id = workout_plan_assignment_sets.assignment_id))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.workout_plan_template_assignments wpta WHERE wpta.id = workout_plan_assignment_sets.assignment_id));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY owner_policy ON public.workout_plan_template_assignments FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_plan_templates wpt WHERE wpt.id = workout_plan_template_assignments.template_id AND has_diary_access(wpt.user_id)))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (SELECT 1 FROM public.workout_plan_templates wpt WHERE wpt.id = workout_plan_template_assignments.template_id AND has_diary_access(wpt.user_id)));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.workout_preset_exercise_sets FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_preset_exercises wpe WHERE wpe.id = workout_preset_exercise_sets.workout_preset_exercise_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.workout_preset_exercise_sets FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_preset_exercises wpe
|
|
[2Ksparkyfitness-db | JOIN public.workout_presets wp ON wp.id = wpe.workout_preset_id
|
|
[2Ksparkyfitness-db | WHERE wpe.id = workout_preset_exercise_sets.workout_preset_exercise_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_preset_exercises wpe
|
|
[2Ksparkyfitness-db | JOIN public.workout_presets wp ON wp.id = wpe.workout_preset_id
|
|
[2Ksparkyfitness-db | WHERE wpe.id = workout_preset_exercise_sets.workout_preset_exercise_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.workout_preset_exercises FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (SELECT 1 FROM public.workout_presets wp WHERE wp.id = workout_preset_exercises.workout_preset_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.workout_preset_exercises FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_presets wp
|
|
[2Ksparkyfitness-db | WHERE wp.id = workout_preset_exercises.workout_preset_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ))
|
|
[2Ksparkyfitness-db | WITH CHECK (EXISTS (
|
|
[2Ksparkyfitness-db | SELECT 1 FROM public.workout_presets wp
|
|
[2Ksparkyfitness-db | WHERE wp.id = workout_preset_exercises.workout_preset_id
|
|
[2Ksparkyfitness-db | AND authenticated_user_id() = wp.user_id
|
|
[2Ksparkyfitness-db | ));
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Strictly Private (Tier 1)
|
|
[2Ksparkyfitness-db | SELECT create_owner_policy('user_ignored_updates');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Meal types: access if user_id is null (system) or if user has diary access
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.meal_types FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (user_id IS NULL OR has_diary_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.meal_types FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (user_id = authenticated_user_id())
|
|
[2Ksparkyfitness-db | WITH CHECK (user_id = authenticated_user_id());
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Activity details: access if linked exercise entry or preset entry is accessible
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.exercise_entry_activity_details FOR SELECT TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (exercise_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_id AND has_diary_read_access(ee.user_id))) OR
|
|
[2Ksparkyfitness-db | (exercise_preset_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_preset_entries epe WHERE epe.id = exercise_preset_entry_id AND has_diary_read_access(epe.user_id)))
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.exercise_entry_activity_details FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (
|
|
[2Ksparkyfitness-db | (exercise_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_id AND has_diary_access(ee.user_id))) OR
|
|
[2Ksparkyfitness-db | (exercise_preset_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_preset_entries epe WHERE epe.id = exercise_preset_entry_id AND has_diary_access(epe.user_id)))
|
|
[2Ksparkyfitness-db | )
|
|
[2Ksparkyfitness-db | WITH CHECK (
|
|
[2Ksparkyfitness-db | (exercise_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_entries ee WHERE ee.id = exercise_entry_id AND has_diary_access(ee.user_id))) OR
|
|
[2Ksparkyfitness-db | (exercise_preset_entry_id IS NOT NULL AND EXISTS (SELECT 1 FROM public.exercise_preset_entries epe WHERE epe.id = exercise_preset_entry_id AND has_diary_access(epe.user_id)))
|
|
[2Ksparkyfitness-db | );
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Shared View-Only (Tier 2)
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('fasting_logs');
|
|
[2Ksparkyfitness-db | SELECT create_diary_policy('user_meal_visibilities');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('sleep_need_calculations');
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('daily_sleep_need');
|
|
[2Ksparkyfitness-db | -- Day classification is a sleep/wellness (check-in) feature, used only by the
|
|
[2Ksparkyfitness-db | -- sleep-science service. It must use the check-in policy so check-in delegates
|
|
[2Ksparkyfitness-db | -- can manage it; the previous diary policy was a misclassification.
|
|
[2Ksparkyfitness-db | SELECT create_checkin_policy('day_classification_cache');
|
|
[2Ksparkyfitness-db | -- Onboarding data/status: delegates can read (to avoid repeated onboarding prompts when viewing
|
|
[2Ksparkyfitness-db | -- another user's diary) but only the account owner can submit or reset their own onboarding.
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.onboarding_data FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.onboarding_data FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.onboarding_status FOR SELECT TO PUBLIC USING (has_profile_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.onboarding_status FOR ALL TO PUBLIC
|
|
[2Ksparkyfitness-db | USING (authenticated_user_id() = user_id)
|
|
[2Ksparkyfitness-db | WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Medications & Symptoms (Tier 3 - Delegate Writable with medications permission)
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medications');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_schedules');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_entries');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_pens');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('injection_entries');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('medication_titration_steps');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('user_custom_symptoms');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('symptom_entries');
|
|
[2Ksparkyfitness-db | SELECT create_medication_policy('user_custom_symptom_locations');
|
|
[2Ksparkyfitness-db |
|
|
[2Ksparkyfitness-db | -- Medications Display Preferences (Tier 2 - Owner-Only Write, Delegate Read)
|
|
[2Ksparkyfitness-db | CREATE POLICY select_policy ON public.user_medication_display_preferences FOR SELECT TO PUBLIC USING (has_medication_read_access(user_id));
|
|
[2Ksparkyfitness-db | CREATE POLICY modify_policy ON public.user_medication_display_preferences FOR ALL TO PUBLIC USING (authenticated_user_id() = user_id) WITH CHECK (authenticated_user_id() = user_id);
|
|
[2Ksparkyfitness-db |
|