233 lines
10 KiB
SQL
233 lines
10 KiB
SQL
-- RLS Policies and Seeding Script for Hoteles Estelar Variable Remuneration System
|
|
SET app.current_user_role = 'admin';
|
|
|
|
-- ==========================================
|
|
-- 0. TEMPORARILY DISABLE RLS FOR SEEDING
|
|
-- ==========================================
|
|
ALTER TABLE "regions" DISABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "hotels" DISABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "users" DISABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "goals" DISABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "sales_results" DISABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "settlements" DISABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "audit_logs" DISABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "compensation_plans" DISABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "calculation_rules" DISABLE ROW LEVEL SECURITY;
|
|
|
|
-- ==========================================
|
|
-- 1. CLEAN UP OLD POLICIES
|
|
-- ==========================================
|
|
DROP POLICY IF EXISTS audit_logs_insert_policy ON "audit_logs";
|
|
DROP POLICY IF EXISTS audit_logs_select_policy ON "audit_logs";
|
|
DROP POLICY IF EXISTS regions_select_policy ON "regions";
|
|
DROP POLICY IF EXISTS regions_modify_policy ON "regions";
|
|
DROP POLICY IF EXISTS hotels_select_policy ON "hotels";
|
|
DROP POLICY IF EXISTS hotels_modify_policy ON "hotels";
|
|
DROP POLICY IF EXISTS users_select_policy ON "users";
|
|
DROP POLICY IF EXISTS users_modify_policy ON "users";
|
|
DROP POLICY IF EXISTS goals_select_policy ON "goals";
|
|
DROP POLICY IF EXISTS goals_modify_policy ON "goals";
|
|
DROP POLICY IF EXISTS sales_results_select_policy ON "sales_results";
|
|
DROP POLICY IF EXISTS sales_results_modify_policy ON "sales_results";
|
|
DROP POLICY IF EXISTS settlements_select_policy ON "settlements";
|
|
DROP POLICY IF EXISTS settlements_modify_policy ON "settlements";
|
|
DROP POLICY IF EXISTS plans_select_policy ON "compensation_plans";
|
|
DROP POLICY IF EXISTS plans_modify_policy ON "compensation_plans";
|
|
DROP POLICY IF EXISTS rules_select_policy ON "calculation_rules";
|
|
DROP POLICY IF EXISTS rules_modify_policy ON "calculation_rules";
|
|
|
|
-- ==========================================
|
|
-- 2. SEED DATA
|
|
-- ==========================================
|
|
|
|
-- Seed Regions
|
|
INSERT INTO "regions" ("name", "code") VALUES
|
|
('Bogotá', 'BOG'),
|
|
('Antioquia', 'ANT'),
|
|
('Caribe', 'CAR')
|
|
ON CONFLICT ("code") DO NOTHING;
|
|
|
|
-- Seed Hotels
|
|
INSERT INTO "hotels" ("name", "code", "region_id", "status") VALUES
|
|
('Estelar Parque de la 93', 'EST-P93', (SELECT id FROM regions WHERE code = 'BOG'), 'ACTIVE'),
|
|
('Estelar Medellin', 'EST-MDE', (SELECT id FROM regions WHERE code = 'ANT'), 'ACTIVE'),
|
|
('Estelar Cartagena', 'EST-CTG', (SELECT id FROM regions WHERE code = 'CAR'), 'ACTIVE')
|
|
ON CONFLICT ("code") DO NOTHING;
|
|
|
|
-- Seed Users
|
|
-- password_hash is bcrypt hash of 'password123'
|
|
INSERT INTO "users" ("username", "email", "password_hash", "role", "hotel_id", "area", "status", "created_at") VALUES
|
|
('admin', 'admin@estelar.com', '$2b$10$lRn/GrwzaEGxWqqQGGz0f.44nBywObKkGWRajlxWeDGZ3o4f7ayjy', 'admin', (SELECT id FROM hotels WHERE code = 'EST-P93'), 'Sistemas', 'ACTIVE', NOW()),
|
|
('director', 'director@estelar.com', '$2b$10$lRn/GrwzaEGxWqqQGGz0f.44nBywObKkGWRajlxWeDGZ3o4f7ayjy', 'director', (SELECT id FROM hotels WHERE code = 'EST-P93'), 'Comercial', 'ACTIVE', NOW()),
|
|
('gerente_mde', 'gerente.mde@estelar.com', '$2b$10$lRn/GrwzaEGxWqqQGGz0f.44nBywObKkGWRajlxWeDGZ3o4f7ayjy', 'hotel_manager', (SELECT id FROM hotels WHERE code = 'EST-MDE'), 'Administracion', 'ACTIVE', NOW()),
|
|
('lider_ctg', 'lider.ctg@estelar.com', '$2b$10$lRn/GrwzaEGxWqqQGGz0f.44nBywObKkGWRajlxWeDGZ3o4f7ayjy', 'commercial_leader', (SELECT id FROM hotels WHERE code = 'EST-CTG'), 'Ventas', 'ACTIVE', NOW()),
|
|
('analista', 'analista@estelar.com', '$2b$10$lRn/GrwzaEGxWqqQGGz0f.44nBywObKkGWRajlxWeDGZ3o4f7ayjy', 'analyst', (SELECT id FROM hotels WHERE code = 'EST-P93'), 'Finanzas', 'ACTIVE', NOW()),
|
|
('consulta', 'consulta@estelar.com', '$2b$10$lRn/GrwzaEGxWqqQGGz0f.44nBywObKkGWRajlxWeDGZ3o4f7ayjy', 'auditor', (SELECT id FROM hotels WHERE code = 'EST-P93'), 'Auditoria', 'ACTIVE', NOW()),
|
|
('colaborador_mde', 'colaborador.mde@estelar.com', '$2b$10$lRn/GrwzaEGxWqqQGGz0f.44nBywObKkGWRajlxWeDGZ3o4f7ayjy', 'collaborator', (SELECT id FROM hotels WHERE code = 'EST-MDE'), 'Ventas', 'ACTIVE', NOW())
|
|
ON CONFLICT ("username") DO UPDATE SET role = EXCLUDED.role;
|
|
|
|
|
|
-- ==========================================
|
|
-- 3. ENABLE ROW-LEVEL SECURITY
|
|
-- ==========================================
|
|
|
|
ALTER TABLE "regions" ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "hotels" ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "users" ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "goals" ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "sales_results" ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "settlements" ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "audit_logs" ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "compensation_plans" ENABLE ROW LEVEL SECURITY;
|
|
ALTER TABLE "calculation_rules" ENABLE ROW LEVEL SECURITY;
|
|
|
|
ALTER TABLE "regions" FORCE ROW LEVEL SECURITY;
|
|
ALTER TABLE "hotels" FORCE ROW LEVEL SECURITY;
|
|
ALTER TABLE "users" FORCE ROW LEVEL SECURITY;
|
|
ALTER TABLE "goals" FORCE ROW LEVEL SECURITY;
|
|
ALTER TABLE "sales_results" FORCE ROW LEVEL SECURITY;
|
|
ALTER TABLE "settlements" FORCE ROW LEVEL SECURITY;
|
|
ALTER TABLE "audit_logs" FORCE ROW LEVEL SECURITY;
|
|
ALTER TABLE "compensation_plans" FORCE ROW LEVEL SECURITY;
|
|
ALTER TABLE "calculation_rules" FORCE ROW LEVEL SECURITY;
|
|
|
|
|
|
-- ==========================================
|
|
-- 4. CREATE RLS POLICIES
|
|
-- ==========================================
|
|
|
|
-- A. Audit Logs Policies (Insert allowed for all, Select only for Admin/Analista, No Updates/Deletes)
|
|
CREATE POLICY audit_logs_insert_policy ON "audit_logs"
|
|
FOR INSERT WITH CHECK (true);
|
|
|
|
CREATE POLICY audit_logs_select_policy ON "audit_logs"
|
|
FOR SELECT USING (
|
|
current_setting('app.current_user_role', true) IN ('admin', 'analyst')
|
|
OR user_id = NULLIF(current_setting('app.current_user_id', true), '')::integer
|
|
);
|
|
|
|
|
|
-- B. Regions Policies
|
|
CREATE POLICY regions_select_policy ON "regions"
|
|
FOR SELECT USING (
|
|
current_setting('app.current_user_role', true) IN ('admin', 'analyst', 'director')
|
|
OR id = NULLIF(current_setting('app.current_region_id', true), '')::integer
|
|
);
|
|
|
|
CREATE POLICY regions_modify_policy ON "regions"
|
|
FOR ALL USING (current_setting('app.current_user_role', true) IN ('admin', 'director'));
|
|
|
|
|
|
-- C. Hotels Policies
|
|
CREATE POLICY hotels_select_policy ON "hotels"
|
|
FOR SELECT USING (
|
|
current_setting('app.current_user_role', true) IN ('admin', 'analyst', 'director')
|
|
OR region_id = NULLIF(current_setting('app.current_region_id', true), '')::integer
|
|
OR id = NULLIF(current_setting('app.current_hotel_id', true), '')::integer
|
|
);
|
|
|
|
CREATE POLICY hotels_modify_policy ON "hotels"
|
|
FOR ALL USING (current_setting('app.current_user_role', true) IN ('admin', 'director'));
|
|
|
|
|
|
-- D. Users Policies
|
|
CREATE POLICY users_select_policy ON "users"
|
|
FOR SELECT USING (
|
|
current_setting('app.current_user_role', true) IN ('admin', 'analyst', 'director')
|
|
OR (
|
|
current_setting('app.current_user_role', true) = 'hotel_manager'
|
|
AND hotel_id = NULLIF(current_setting('app.current_hotel_id', true), '')::integer
|
|
)
|
|
OR (
|
|
current_setting('app.current_user_role', true) = 'commercial_leader'
|
|
AND hotel_id IN (SELECT id FROM hotels WHERE region_id = NULLIF(current_setting('app.current_region_id', true), '')::integer)
|
|
)
|
|
OR id = NULLIF(current_setting('app.current_user_id', true), '')::integer
|
|
);
|
|
|
|
CREATE POLICY users_modify_policy ON "users"
|
|
FOR ALL USING (current_setting('app.current_user_role', true) = 'admin');
|
|
|
|
|
|
-- E. Goals Policies
|
|
CREATE POLICY goals_select_policy ON "goals"
|
|
FOR SELECT USING (
|
|
current_setting('app.current_user_role', true) IN ('admin', 'analyst', 'director')
|
|
OR target_id = NULLIF(current_setting('app.current_user_id', true), '')::integer
|
|
OR target_id IN (
|
|
SELECT u.id FROM users u WHERE u.hotel_id = NULLIF(current_setting('app.current_hotel_id', true), '')::integer
|
|
)
|
|
OR target_id IN (
|
|
SELECT u.id FROM users u JOIN hotels h ON u.hotel_id = h.id
|
|
WHERE h.region_id = NULLIF(current_setting('app.current_region_id', true), '')::integer
|
|
)
|
|
);
|
|
|
|
CREATE POLICY goals_modify_policy ON "goals"
|
|
FOR ALL USING (current_setting('app.current_user_role', true) IN ('admin', 'director'));
|
|
|
|
|
|
-- F. Sales Results Policies
|
|
CREATE POLICY sales_results_select_policy ON "sales_results"
|
|
FOR SELECT USING (
|
|
current_setting('app.current_user_role', true) IN ('admin', 'analyst', 'director')
|
|
OR user_id = NULLIF(current_setting('app.current_user_id', true), '')::integer
|
|
OR hotel_id = NULLIF(current_setting('app.current_hotel_id', true), '')::integer
|
|
OR hotel_id IN (
|
|
SELECT id FROM hotels WHERE region_id = NULLIF(current_setting('app.current_region_id', true), '')::integer
|
|
)
|
|
);
|
|
|
|
CREATE POLICY sales_results_modify_policy ON "sales_results"
|
|
FOR ALL USING (
|
|
current_setting('app.current_user_role', true) IN ('admin', 'analyst')
|
|
OR (
|
|
current_setting('app.current_user_role', true) = 'commercial_leader'
|
|
AND hotel_id IN (
|
|
SELECT id FROM hotels WHERE region_id = NULLIF(current_setting('app.current_region_id', true), '')::integer
|
|
)
|
|
)
|
|
);
|
|
|
|
|
|
-- G. Settlements Policies
|
|
CREATE POLICY settlements_select_policy ON "settlements"
|
|
FOR SELECT USING (
|
|
current_setting('app.current_user_role', true) IN ('admin', 'analyst', 'director')
|
|
OR user_id = NULLIF(current_setting('app.current_user_id', true), '')::integer
|
|
OR user_id IN (
|
|
SELECT u.id FROM users u WHERE u.hotel_id = NULLIF(current_setting('app.current_hotel_id', true), '')::integer
|
|
)
|
|
OR user_id IN (
|
|
SELECT u.id FROM users u JOIN hotels h ON u.hotel_id = h.id
|
|
WHERE h.region_id = NULLIF(current_setting('app.current_region_id', true), '')::integer
|
|
)
|
|
);
|
|
|
|
CREATE POLICY settlements_modify_policy ON "settlements"
|
|
FOR ALL USING (
|
|
current_setting('app.current_user_role', true) IN ('admin', 'analyst')
|
|
OR (
|
|
current_setting('app.current_user_role', true) = 'commercial_leader'
|
|
AND user_id IN (
|
|
SELECT u.id FROM users u JOIN hotels h ON u.hotel_id = h.id
|
|
WHERE h.region_id = NULLIF(current_setting('app.current_region_id', true), '')::integer
|
|
)
|
|
)
|
|
);
|
|
|
|
|
|
-- H. Compensation Plans Policies
|
|
CREATE POLICY plans_select_policy ON "compensation_plans"
|
|
FOR SELECT USING (true);
|
|
|
|
CREATE POLICY plans_modify_policy ON "compensation_plans"
|
|
FOR ALL USING (current_setting('app.current_user_role', true) IN ('admin', 'director', 'analyst'));
|
|
|
|
|
|
-- I. Calculation Rules Policies
|
|
CREATE POLICY rules_select_policy ON "calculation_rules"
|
|
FOR SELECT USING (true);
|
|
|
|
CREATE POLICY rules_modify_policy ON "calculation_rules"
|
|
FOR ALL USING (current_setting('app.current_user_role', true) IN ('admin', 'director', 'analyst'));
|