74 lines
2.0 KiB
PL/PgSQL
74 lines
2.0 KiB
PL/PgSQL
|
|
-- Create enum for user roles
|
|
CREATE TYPE public.app_role AS ENUM ('admin', 'user');
|
|
|
|
-- Create user_roles table
|
|
CREATE TABLE public.user_roles (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
user_id UUID REFERENCES auth.users(id) ON DELETE CASCADE NOT NULL,
|
|
role app_role NOT NULL DEFAULT 'user',
|
|
created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
|
|
UNIQUE (user_id, role)
|
|
);
|
|
|
|
-- Enable RLS on user_roles table
|
|
ALTER TABLE public.user_roles ENABLE ROW LEVEL SECURITY;
|
|
|
|
-- Create security definer function to check user roles
|
|
CREATE OR REPLACE FUNCTION public.has_role(_user_id UUID, _role app_role)
|
|
RETURNS BOOLEAN
|
|
LANGUAGE SQL
|
|
STABLE
|
|
SECURITY DEFINER
|
|
SET search_path = public
|
|
AS $$
|
|
SELECT EXISTS (
|
|
SELECT 1
|
|
FROM public.user_roles
|
|
WHERE user_id = _user_id
|
|
AND role = _role
|
|
)
|
|
$$;
|
|
|
|
-- RLS policies for user_roles table
|
|
CREATE POLICY "Users can view their own roles"
|
|
ON public.user_roles
|
|
FOR SELECT
|
|
USING (auth.uid() = user_id);
|
|
|
|
CREATE POLICY "Only admins can manage roles"
|
|
ON public.user_roles
|
|
FOR ALL
|
|
USING (public.has_role(auth.uid(), 'admin'));
|
|
|
|
-- Add missing DELETE policy for profiles table
|
|
CREATE POLICY "Users can delete their own profile"
|
|
ON public.profiles
|
|
FOR DELETE
|
|
USING (auth.uid() = id);
|
|
|
|
-- Create trigger to assign default 'user' role to new users
|
|
CREATE OR REPLACE FUNCTION public.handle_new_user_role()
|
|
RETURNS TRIGGER
|
|
LANGUAGE plpgsql
|
|
SECURITY DEFINER SET search_path = public
|
|
AS $$
|
|
BEGIN
|
|
INSERT INTO public.user_roles (user_id, role)
|
|
VALUES (new.id, 'user');
|
|
RETURN new;
|
|
END;
|
|
$$;
|
|
|
|
CREATE TRIGGER on_auth_user_created_role
|
|
AFTER INSERT ON auth.users
|
|
FOR EACH ROW EXECUTE PROCEDURE public.handle_new_user_role();
|
|
|
|
-- Insert admin role for existing users (you can modify this as needed)
|
|
-- This will make the first user an admin - adjust the email as needed
|
|
INSERT INTO public.user_roles (user_id, role)
|
|
SELECT id, 'admin'
|
|
FROM auth.users
|
|
WHERE email = 'm.reifonas@gmail.com'
|
|
ON CONFLICT (user_id, role) DO NOTHING;
|