35 lines
1.4 KiB
SQL
35 lines
1.4 KiB
SQL
-- 025_manager_role_candidates_rbac.sql
|
|
-- The Access Control role named Manager (Ahmed Baig) is not the seeded
|
|
-- hiring_manager role. 024 only attached manager_candidates to hiring_manager,
|
|
-- so Manager had 0 candidates.* tags and the Candidates nav item never appeared
|
|
-- (routes.js permission is candidates.view). Same hole broke Calendar:
|
|
-- GET /interview/fetch is gated on candidates.view, not interviews.view.
|
|
-- Applied at startup by alembic_setup.run_manual_sql(). Log in again after.
|
|
|
|
INSERT INTO app.permissions (name, description, permission_tags, is_system, created_at, updated_at, is_active, is_deleted)
|
|
SELECT
|
|
'manager_candidates',
|
|
'Hiring manager: list candidates on own requisition jobs, view profiles, write notes',
|
|
(
|
|
SELECT COALESCE(jsonb_agg(id ORDER BY id), '[]'::jsonb)
|
|
FROM app.permission_tags
|
|
WHERE is_deleted = false
|
|
AND tag_name IN ('candidates.view', 'candidates.create', 'candidates.edit')
|
|
),
|
|
true,
|
|
NOW(),
|
|
NOW(),
|
|
true,
|
|
false
|
|
WHERE NOT EXISTS (
|
|
SELECT 1 FROM app.permissions WHERE name = 'manager_candidates'
|
|
);
|
|
|
|
UPDATE app.roles r
|
|
SET permissions = COALESCE(r.permissions, '[]'::jsonb) || jsonb_build_array(p.id),
|
|
updated_at = NOW()
|
|
FROM app.permissions p
|
|
WHERE p.name = 'manager_candidates'
|
|
AND lower(r.role_name) IN ('hiring_manager', 'manager')
|
|
AND NOT (COALESCE(r.permissions, '[]'::jsonb) @> jsonb_build_array(p.id));
|