mAi
ec0ec32271
Phase 3 Slice 1 audit-log foundation (design §2.8). The audit log
lands BEFORE the rule editor (Slice 11) so every future write to
paliad.deadline_rules is captured — including the Slice 2
backfill UPDATEs.
paliad.deadline_rule_audit columns mirror design §2.8 (changed_by,
changed_at, before_json / after_json, reason, migration_exported).
Two intentional deviations, documented inline:
1. changed_by is nullable, not NOT NULL. Trigger reads auth.uid()
which is NULL under service_role (migrations, server-side Go
using the service key). NOT NULL would block Slice 2 backfills
and every seed insert.
2. action values written by the trigger are 'create'|'update'|
'delete' (raw TG_OP). Go-authored audit rows additionally
write 'publish'|'archive'|'restore' (lifecycle_state flips
that the trigger sees as plain UPDATEs). The audit UI in
Slice 11 collapses the paired rows.
Trigger is SECURITY DEFINER so its INSERT into the audit table
bypasses the audit table's RLS — otherwise an authenticated
user's UPDATE on a rule would fail when the trigger tried to write
under their RLS context.
Audit-reason enforcement: trigger reads paliad.audit_reason via
current_setting(..., true) and raises EXCEPTION on UPDATE/DELETE
when unset. INSERT defaults to 'create' so seed migrations stay
ergonomic.
RLS: SELECT for global_admin only (mirrors mig 057 pattern). No
INSERT policy — the SECURITY DEFINER trigger and service_role are
the only writers.
16 lines
661 B
SQL
16 lines
661 B
SQL
-- t-paliad-182 down — reverses 079_deadline_rule_audit.up.sql.
|
|
--
|
|
-- Order: trigger → function → policy → indexes → table.
|
|
|
|
DROP TRIGGER IF EXISTS deadline_rules_audit_aiud ON paliad.deadline_rules;
|
|
DROP FUNCTION IF EXISTS paliad.deadline_rule_audit_trigger();
|
|
|
|
DROP POLICY IF EXISTS deadline_rule_audit_select ON paliad.deadline_rule_audit;
|
|
|
|
DROP INDEX IF EXISTS paliad.deadline_rule_audit_pending_export_idx;
|
|
DROP INDEX IF EXISTS paliad.deadline_rule_audit_changed_by_idx;
|
|
DROP INDEX IF EXISTS paliad.deadline_rule_audit_changed_at_idx;
|
|
DROP INDEX IF EXISTS paliad.deadline_rule_audit_rule_id_idx;
|
|
|
|
DROP TABLE IF EXISTS paliad.deadline_rule_audit;
|