24 lines
923 B
SQL
24 lines
923 B
SQL
-- Drop old policies that reference orders table
|
|
DROP POLICY IF EXISTS "history select by order role" ON order_history;
|
|
DROP POLICY IF EXISTS "history insert workflow" ON order_history;
|
|
|
|
-- New SELECT policy: users can read history for order_groups they have access to
|
|
CREATE POLICY "order_history_select" ON order_history
|
|
FOR SELECT TO authenticated
|
|
USING (
|
|
EXISTS (
|
|
SELECT 1 FROM order_groups og
|
|
WHERE og.id = order_history.order_group_id
|
|
AND (
|
|
current_role_name() = ANY (ARRAY['admin', 'mega_admin', 'production_lead'])
|
|
OR (current_role_name() = 'manager')
|
|
OR (current_role_name() = 'logistician')
|
|
OR (current_role_name() = 'driver' AND og.assigned_driver_id = auth.uid())
|
|
)
|
|
)
|
|
);
|
|
|
|
-- INSERT policy: only trigger (SECURITY DEFINER) inserts, users don't insert directly
|
|
CREATE POLICY "order_history_insert_trigger" ON order_history
|
|
FOR INSERT TO authenticated
|
|
WITH CHECK (true); |