54 lines
2.2 KiB
SQL
54 lines
2.2 KiB
SQL
-- 028: Slim bundles for custom Access Control roles that should see only the
|
|
-- Requisitions and Interviews/Calendar tabs. The tags already exist (001, 019);
|
|
-- the seeded bundles are too wide — requisitions_management includes
|
|
-- requisitions.manage (org-wide list), analytics_dashboard hangs interviews.view
|
|
-- off dashboard/analytics/offers, hiring_forms has interview writes but no view.
|
|
--
|
|
-- These two are NOT attached to seeded staff roles (those already have the wide
|
|
-- bundles). Admins tick them on a new role in Access Control.
|
|
-- Applied at startup by alembic_setup.run_manual_sql(). Log in again after.
|
|
|
|
-- =============================================================================
|
|
-- 1. Own requisitions only (omit .manage so is_admin() stays false)
|
|
-- =============================================================================
|
|
INSERT INTO app.permissions (name, description, permission_tags, is_system, created_at, updated_at, is_active, is_deleted)
|
|
SELECT
|
|
'requisitions_self',
|
|
'Own employee requisition forms: view, create, edit (not org-wide manage)',
|
|
(
|
|
SELECT COALESCE(jsonb_agg(id ORDER BY id), '[]'::jsonb)
|
|
FROM app.permission_tags
|
|
WHERE is_deleted = false
|
|
AND tag_name IN ('requisitions.view', 'requisitions.create', 'requisitions.edit')
|
|
),
|
|
true,
|
|
NOW(),
|
|
NOW(),
|
|
true,
|
|
false
|
|
WHERE NOT EXISTS (
|
|
SELECT 1 FROM app.permissions WHERE name = 'requisitions_self'
|
|
);
|
|
|
|
-- =============================================================================
|
|
-- 2. Interviews / Calendar tab (view + schedule + amend)
|
|
-- =============================================================================
|
|
INSERT INTO app.permissions (name, description, permission_tags, is_system, created_at, updated_at, is_active, is_deleted)
|
|
SELECT
|
|
'interviews_tab',
|
|
'Interviews and Calendar tabs: list, schedule, reschedule',
|
|
(
|
|
SELECT COALESCE(jsonb_agg(id ORDER BY id), '[]'::jsonb)
|
|
FROM app.permission_tags
|
|
WHERE is_deleted = false
|
|
AND tag_name IN ('interviews.view', 'interviews.create', 'interviews.edit')
|
|
),
|
|
true,
|
|
NOW(),
|
|
NOW(),
|
|
true,
|
|
false
|
|
WHERE NOT EXISTS (
|
|
SELECT 1 FROM app.permissions WHERE name = 'interviews_tab'
|
|
);
|