Tria/edr-platform
1
0
Fork 0
mirror of https://github.com/Tria-plc/edr-platform.git synced 2026-08-26 18:42:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(deploy): grant companion view keys in mapping SQL

Browse Source 
Position types holding only an action key are denied by their module's
class-level view guard, so grant the matching <module>:view alongside
every action key a type already holds.
This commit is contained in:
Nathnael
2026-08-07 07:41:01 +00:00
parent d4917bc6ec
commit 820010a732
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
deploy/position-type-grant-mapping.sql
View File

@@ -95,6 +95,20 @@ WHERE (pt.name::text ILIKE '%marketing%' OR pt.key ILIKE '%marketing%')
)
ON CONFLICT (position_type_id, permission_id) DO NOTHING;
-- 7. Companion view keys.
-- Most freight controllers carry a class-level `<module>:view` guard, and Nest
-- runs class AND method guards — so a type holding only `<module>:<action>` is
-- denied before the action key is ever checked. Grant the module's view key
-- alongside every action key the type already holds. View-only, so it widens
-- reads within a module the type already operates in, never across modules.
INSERT INTO iam.position_type_permissions (position_type_id, permission_id)
SELECT DISTINCT ptp.position_type_id, pview.id
FROM iam.position_type_permissions ptp
JOIN iam.permissions pact ON pact.id = ptp.permission_id
AND pact.key LIKE 'edr_freight_app:%'
JOIN iam.permissions pview ON pview.key = regexp_replace(pact.key, ':[^:]+$', ':view')
ON CONFLICT (position_type_id, permission_id) DO NOTHING;
COMMIT;
-- Verification: expected non-zero counts per new key after running.