From 820010a732f38c7bc5f50f641f191d9191cca90f Mon Sep 17 00:00:00 2001 From: Nathnael Date: Fri, 7 Aug 2026 07:41:01 +0000 Subject: [PATCH] chore(deploy): grant companion view keys in mapping SQL Position types holding only an action key are denied by their module's class-level view guard, so grant the matching :view alongside every action key a type already holds. --- deploy/position-type-grant-mapping.sql | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/deploy/position-type-grant-mapping.sql b/deploy/position-type-grant-mapping.sql index 8efe7baba..901191dd4 100644 --- a/deploy/position-type-grant-mapping.sql +++ b/deploy/position-type-grant-mapping.sql @@ -95,6 +95,20 @@ WHERE (pt.name::text ILIKE '%marketing%' OR pt.key ILIKE '%marketing%') ) ON CONFLICT (position_type_id, permission_id) DO NOTHING; +-- 7. Companion view keys. +-- Most freight controllers carry a class-level `:view` guard, and Nest +-- runs class AND method guards — so a type holding only `:` is +-- denied before the action key is ever checked. Grant the module's view key +-- alongside every action key the type already holds. View-only, so it widens +-- reads within a module the type already operates in, never across modules. +INSERT INTO iam.position_type_permissions (position_type_id, permission_id) +SELECT DISTINCT ptp.position_type_id, pview.id +FROM iam.position_type_permissions ptp +JOIN iam.permissions pact ON pact.id = ptp.permission_id + AND pact.key LIKE 'edr_freight_app:%' +JOIN iam.permissions pview ON pview.key = regexp_replace(pact.key, ':[^:]+$', ':view') +ON CONFLICT (position_type_id, permission_id) DO NOTHING; + COMMIT; -- Verification: expected non-zero counts per new key after running.