48178c5f60
Phase 4-lite C1. Make script ownership polymorphic so a script can be owned
by a GROUP (a template inherited by descendant apps) instead of an app —
mirroring vars/secrets (0048/0049), but ON DELETE RESTRICT (code is not data).
Schema (0050): `scripts.group_id` (nullable FK→groups RESTRICT), `app_id` made
nullable, `scripts_owner_exactly_one` CHECK, and the per-app name index split
into two per-owner partial-unique indexes. Existing app-owned rows keep their
exact `(app_id, lower(name))` uniqueness.
Type: `Script.app_id` becomes `Option<AppId>`; add `Script.group_id` +
`ScriptOwner` / `is_owned_by_app()`. `NewScript` gains the same polymorphic
owner. The execution-context app (what a script runs *under*) is supplied by
the invoking route/trigger/caller, never read off the script — group scripts
have no single app.
Behavior is fully preserved for app-owned scripts (the only kind creatable
today): every isolation backstop and authz site now uses `is_owned_by_app`,
which is byte-identical for app owners and **fails closed** for group owners.
A group script therefore can't yet be run, route/trigger-bound, invoked, or
managed via the app-script API — those land in C2 (group-script creation) and
C3 (chain-membership resolution + binding). The `/execute/{id}` bypass 404s a
group script (no app context to run under).
Re-blesses expected_schema.txt; note the golden was last blessed at migration
0044, so this also captures the already-committed 0045–0049 schema.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
41 lines
1.9 KiB
SQL
41 lines
1.9 KiB
SQL
-- Phase 4 (v1.2 Hierarchies): group-owned scripts.
|
|
--
|
|
-- Until now every script was owned by exactly one app (`app_id NOT NULL`,
|
|
-- ON DELETE RESTRICT). Phase 4 lets a script be owned by a GROUP instead, so
|
|
-- it is shared by every descendant app — resolved by name, nearest-owner
|
|
-- wins (CoW: an app's own script of the same name shadows the inherited one),
|
|
-- exactly like `vars`/`secrets` (0048/0049).
|
|
--
|
|
-- Phase 4-LITE scope: group-owned ENDPOINT scripts only. Group modules and
|
|
-- the origin-aware (lexical) import resolver are deferred to Phase 4b, so a
|
|
-- group-owned script must be self-contained (enforced in the service layer).
|
|
--
|
|
-- Reshape (mirrors vars/secrets, but RESTRICT not CASCADE — code is not data,
|
|
-- a group can't be deleted out from under the scripts it owns, matching the
|
|
-- existing app_id RESTRICT and the §5.6 delete=RESTRICT rule):
|
|
-- * `group_id` — nullable FK→groups, ON DELETE RESTRICT.
|
|
-- * `app_id` — made nullable (was NOT NULL); the exactly-one CHECK now
|
|
-- enforces "owned by an app XOR a group".
|
|
-- * the per-app unique name index becomes two partial indexes, one per owner.
|
|
|
|
ALTER TABLE scripts
|
|
ADD COLUMN group_id UUID REFERENCES groups(id) ON DELETE RESTRICT;
|
|
|
|
ALTER TABLE scripts
|
|
ALTER COLUMN app_id DROP NOT NULL;
|
|
|
|
ALTER TABLE scripts
|
|
ADD CONSTRAINT scripts_owner_exactly_one
|
|
CHECK ((group_id IS NULL) <> (app_id IS NULL));
|
|
|
|
-- Per-owner, case-insensitive name uniqueness. Partial so each owner column
|
|
-- only constrains its own rows; existing app rows (group_id NULL) keep the
|
|
-- exact same (app_id, LOWER(name)) uniqueness they had under the old index.
|
|
DROP INDEX scripts_name_uidx;
|
|
CREATE UNIQUE INDEX scripts_app_name_uidx
|
|
ON scripts (app_id, LOWER(name)) WHERE app_id IS NOT NULL;
|
|
CREATE UNIQUE INDEX scripts_group_name_uidx
|
|
ON scripts (group_id, LOWER(name)) WHERE group_id IS NOT NULL;
|
|
|
|
CREATE INDEX scripts_group_id_idx ON scripts (group_id) WHERE group_id IS NOT NULL;
|