karti
13dec6b4b8
Seven parallel agents and an adversarial verification pass. The three things worth knowing before reading the diff: RBAC WAS ALREADY BUILT. docs/build-plan.md marks F2 and F3 outstanding and is stale — packages/core/src/permissions.ts and lib/mutation.ts shipped long ago. So this does not rebuild them; it closes the gaps an audit found. The big one is that reads were entirely ungoverned: every GET was "any authenticated member", so a junior demand rep and a research contractor could both pull per-block supplier cost and break-even prices from /api/capacity/margin, and every contract's negotiated terms. For a company whose margin is the business, that was the hole that mattered. Adds book:read / economics:read / team:read, a readGuard middleware, and a `viewer` role below member. THE BUTTON AND THE 403 DISAGREED — the exact thing F3 said must never happen. Contracts.tsx never called can() at all, so its save button was always enabled against a server requiring contract:sign; Capacity.tsx gated commitment creation on deal:write/demand while the server wanted commitment:write/supply. POST /api/activities was the one write bypassing executeMutation: no capability check, and any member could mutate accounts.lastActivityAt as a side effect. It is now a proper mutation() behind activity:write. The shell becomes three panes — a collapsible shadcn sidebar with an account switcher on the Piggy accent, a header with real search, and Piggy docked to the right, page-aware and persistent across navigation. The phone keeps its bottom tab bar, which is the thing this product already beat trycompai/crm on, and gains the sidebar as a sheet. Calendar is a projection over thirteen dated sources rather than a new table, because a table would duplicate dates that already live on contracts, deals and commitments and would drift — and one ledger answering the question is the whole argument. It surfaces export_authorizations and compliance_artifacts, which had indexed expires_at columns, schema comments saying they must be alerted on, and no read endpoint or UI anywhere. Learn carries two tracks. Concepts are members-only; the platform track can be opened with a share code by someone with no account. The code mints a scoped learn-only token and never a Principal — every route here resolves a principal and then checks capabilities, so a principal-minting code would be one missing check away from leaking the book. "Only platform-track rows may be code-visible" is a database CHECK constraint as well as a write-path rule, and a test asserts a valid learn token still gets 401 on /api/dashboard, /api/accounts and /api/contracts — the same invariant scripts/deploy.sh refuses to ship without. CD becomes tag-to-ship. CI publishes an image to the Gitea registry on a release-* tag and cloud-2 pulls it, so no credential on the shared runner can execute anything on production — by construction rather than by policy. Both halves of deploy.sh's original rule survive: nothing on the runner reaches the host, and a human still decides when it ships. deploy.sh gains a rollback and a public-origin check, and PIG_IMAGE now reaches compose through `sudo env`, without which sudo's env_reset silently resolved every release to pig:local. Tests 141 -> 261. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
58 lines
2.4 KiB
TypeScript
58 lines
2.4 KiB
TypeScript
import {
|
|
boolean,
|
|
check,
|
|
integer,
|
|
pgTable,
|
|
text,
|
|
timestamp,
|
|
uuid,
|
|
} from 'drizzle-orm/pg-core';
|
|
import { sql } from 'drizzle-orm';
|
|
import { users } from './identity';
|
|
|
|
/** Workspace-wide controls. The check keeps this deliberately single-tenant. */
|
|
export const platformSettings = pgTable(
|
|
'platform_settings',
|
|
{
|
|
id: text('id').primaryKey().default('default'),
|
|
piggyModel: text('piggy_model').notNull().default('nvidia/nemotron-3-nano-30b-a3b'),
|
|
piggyInferenceBase: text('piggy_inference_base')
|
|
.notNull()
|
|
.default('https://api.pinference.ai/api/v1'),
|
|
piggyEnabled: boolean('piggy_enabled').notNull().default(false),
|
|
/** AES-256-GCM envelope. Its key lives outside the database. */
|
|
primeApiKeyEncrypted: text('prime_api_key_encrypted'),
|
|
primeApiKeyUpdatedAt: timestamp('prime_api_key_updated_at', { withTimezone: true }),
|
|
primeSyncEnabled: boolean('prime_sync_enabled').notNull().default(false),
|
|
primeSyncIntervalMinutes: integer('prime_sync_interval_minutes').notNull().default(30),
|
|
/**
|
|
* The Learn share code, in the database because it is rotatable.
|
|
*
|
|
* Not an env var and not a constant: rotating it must be something an
|
|
* administrator does at 11pm when it has been forwarded outside the
|
|
* company, without a redeploy. Stored in clear rather than hashed because
|
|
* it is a passphrase a human reads aloud and an admin has to be able to
|
|
* see it to share it — and because it grants nothing but the platform
|
|
* track, which is marketing material. It is compared in constant time all
|
|
* the same; the timing of a wrong answer should not narrow the guess.
|
|
*
|
|
* The initial value is a column default so the row is never without one.
|
|
*/
|
|
learnAccessCode: text('learn_access_code').notNull().default('carlthefog'),
|
|
learnAccessCodeUpdatedAt: timestamp('learn_access_code_updated_at', { withTimezone: true }),
|
|
updatedByUserId: uuid('updated_by_user_id').references(() => users.id, {
|
|
onDelete: 'set null',
|
|
}),
|
|
updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),
|
|
},
|
|
(t) => [
|
|
check('platform_settings_singleton_check', sql`${t.id} = 'default'`),
|
|
check(
|
|
'platform_settings_sync_interval_check',
|
|
sql`${t.primeSyncIntervalMinutes} BETWEEN 1 AND 1440`,
|
|
),
|
|
],
|
|
);
|
|
|
|
export type PlatformSettings = typeof platformSettings.$inferSelect;
|