41 lines
1.7 KiB
SQL
41 lines
1.7 KiB
SQL
-- 024_manager_candidates_rbac.sql
|
|
-- Manual one-shot: hiring_manager can list candidates on their requisition
|
|
-- jobs and write notes on those profiles. Form fill already comes from
|
|
-- hiring_forms (interviews.create/edit) + analytics_dashboard (interviews.view).
|
|
-- Applied at startup by alembic_setup.run_manual_sql().
|
|
--
|
|
-- Users must log in again after this applies — the frontend caches /users/me.
|
|
|
|
-- =============================================================================
|
|
-- 1. Bundle: candidates.view / create / edit (list + notes)
|
|
-- =============================================================================
|
|
INSERT INTO app.permissions (name, description, permission_tags, is_system, created_at, updated_at, is_active, is_deleted)
|
|
SELECT
|
|
'manager_candidates',
|
|
'Hiring manager: list candidates on own requisition jobs, view profiles, write notes',
|
|
(
|
|
SELECT COALESCE(jsonb_agg(id ORDER BY id), '[]'::jsonb)
|
|
FROM app.permission_tags
|
|
WHERE is_deleted = false
|
|
AND tag_name IN ('candidates.view', 'candidates.create', 'candidates.edit')
|
|
),
|
|
true,
|
|
NOW(),
|
|
NOW(),
|
|
true,
|
|
false
|
|
WHERE NOT EXISTS (
|
|
SELECT 1 FROM app.permissions WHERE name = 'manager_candidates'
|
|
);
|
|
|
|
-- =============================================================================
|
|
-- 2. Attach the bundle to hiring_manager only
|
|
-- =============================================================================
|
|
UPDATE app.roles r
|
|
SET permissions = COALESCE(r.permissions, '[]'::jsonb) || jsonb_build_array(p.id),
|
|
updated_at = NOW()
|
|
FROM app.permissions p
|
|
WHERE p.name = 'manager_candidates'
|
|
AND r.role_name = 'hiring_manager'
|
|
AND NOT (COALESCE(r.permissions, '[]'::jsonb) @> jsonb_build_array(p.id));
|