53 lines
2.2 KiB
SQL
53 lines
2.2 KiB
SQL
-- 008_hiring_forms_rbac.sql
|
|
-- Manual one-shot: a `hiring_forms` bundle granting interviews.create/edit/delete
|
|
-- so staff roles can fill and amend the digitized hiring forms (Annexure A
|
|
-- requisition, Annexure E interview analysis + cultural fit) served by the
|
|
-- candidate_forms domain. The interviews.* tags themselves were seeded by 001;
|
|
-- the analytics_dashboard bundle only carries interviews.view, which is why the
|
|
-- write tags need this bundle. Mirrors 007's idempotent pattern; applied
|
|
-- automatically at startup by alembic_setup.run_manual_sql() and recorded in
|
|
-- manual_migrations.
|
|
--
|
|
-- Users must log in again after this applies — permissions are resolved from
|
|
-- the DB per request, but the frontend caches the list from /users/me.
|
|
|
|
-- =============================================================================
|
|
-- 1. Bundle holding the interviews write tags
|
|
-- =============================================================================
|
|
INSERT INTO app.permissions (name, description, permission_tags, is_system, created_at, updated_at, is_active, is_deleted)
|
|
SELECT
|
|
'hiring_forms',
|
|
'Fill and amend candidate hiring forms (requisition, interview analysis, cultural fit)',
|
|
(
|
|
SELECT COALESCE(jsonb_agg(id ORDER BY id), '[]'::jsonb)
|
|
FROM app.permission_tags
|
|
WHERE is_deleted = false
|
|
AND tag_name IN ('interviews.create', 'interviews.edit', 'interviews.delete')
|
|
),
|
|
true,
|
|
NOW(),
|
|
NOW(),
|
|
true,
|
|
false
|
|
WHERE NOT EXISTS (
|
|
SELECT 1 FROM app.permissions WHERE name = 'hiring_forms'
|
|
);
|
|
|
|
-- =============================================================================
|
|
-- 2. Attach the bundle to the staff roles (idempotent; same role list as 007)
|
|
-- =============================================================================
|
|
UPDATE app.roles r
|
|
SET permissions = COALESCE(r.permissions, '[]'::jsonb) || jsonb_build_array(p.id),
|
|
updated_at = NOW()
|
|
FROM app.permissions p
|
|
WHERE p.name = 'hiring_forms'
|
|
AND r.role_name IN (
|
|
'system_administrator',
|
|
'hr_administrator',
|
|
'recruiter',
|
|
'hiring_manager',
|
|
'department_head',
|
|
'ceo'
|
|
)
|
|
AND NOT (COALESCE(r.permissions, '[]'::jsonb) @> jsonb_build_array(p.id));
|