feat(multi-tenant): add Team model and RLS policies
Implements #9, #10 - Team model with workspace membership - TeamMember model with role-based access (OWNER, ADMIN, MEMBER) - Row-Level Security policies for tenant isolation on 19 tables - Helper functions: current_user_id(), is_workspace_member(), is_workspace_admin() - Developer utilities in src/lib/db-context.ts for easy RLS integration - Comprehensive documentation in docs/design/multi-tenant-rls.md Database migrations: - 20260129220941_add_team_model: Adds Team and TeamMember tables - 20260129221004_add_rls_policies: Enables RLS and creates policies Security features: - Complete database-level tenant isolation - Automatic query filtering based on workspace membership - Defense-in-depth security with application and database layers - Performance-optimized with indexes on workspace_id
This commit is contained in:
Jason Woltje
@@ -45,6 +45,12 @@ enum WorkspaceMemberRole {
|
||||
GUEST
|
||||
}
|
||||
|
||||
enum TeamMemberRole {
|
||||
OWNER
|
||||
ADMIN
|
||||
MEMBER
|
||||
}
|
||||
|
||||
enum ActivityAction {
|
||||
CREATED
|
||||
UPDATED
|
||||
@@ -126,6 +132,7 @@ model User {
|
||||
// Relations
|
||||
ownedWorkspaces Workspace[] @relation("WorkspaceOwner")
|
||||
workspaceMemberships WorkspaceMember[]
|
||||
teamMemberships TeamMember[]
|
||||
assignedTasks Task[] @relation("TaskAssignee")
|
||||
createdTasks Task[] @relation("TaskCreator")
|
||||
createdEvents Event[] @relation("EventCreator")
|
||||
@@ -150,21 +157,22 @@ model Workspace {
|
||||
updatedAt DateTime @updatedAt @map("updated_at") @db.Timestamptz
|
||||
|
||||
// Relations
|
||||
owner User @relation("WorkspaceOwner", fields: [ownerId], references: [id], onDelete: Cascade)
|
||||
members WorkspaceMember[]
|
||||
tasks Task[]
|
||||
events Event[]
|
||||
projects Project[]
|
||||
activityLogs ActivityLog[]
|
||||
memoryEmbeddings MemoryEmbedding[]
|
||||
domains Domain[]
|
||||
ideas Idea[]
|
||||
relationships Relationship[]
|
||||
agents Agent[]
|
||||
agentSessions AgentSession[]
|
||||
userLayouts UserLayout[]
|
||||
knowledgeEntries KnowledgeEntry[]
|
||||
knowledgeTags KnowledgeTag[]
|
||||
owner User @relation("WorkspaceOwner", fields: [ownerId], references: [id], onDelete: Cascade)
|
||||
members WorkspaceMember[]
|
||||
teams Team[]
|
||||
tasks Task[]
|
||||
events Event[]
|
||||
projects Project[]
|
||||
activityLogs ActivityLog[]
|
||||
memoryEmbeddings MemoryEmbedding[]
|
||||
domains Domain[]
|
||||
ideas Idea[]
|
||||
relationships Relationship[]
|
||||
agents Agent[]
|
||||
agentSessions AgentSession[]
|
||||
userLayouts UserLayout[]
|
||||
knowledgeEntries KnowledgeEntry[]
|
||||
knowledgeTags KnowledgeTag[]
|
||||
|
||||
@@index([ownerId])
|
||||
@@map("workspaces")
|
||||
@@ -185,6 +193,38 @@ model WorkspaceMember {
|
||||
@@map("workspace_members")
|
||||
}
|
||||
|
||||
model Team {
|
||||
id String @id @default(uuid()) @db.Uuid
|
||||
workspaceId String @map("workspace_id") @db.Uuid
|
||||
name String
|
||||
description String? @db.Text
|
||||
metadata Json @default("{}")
|
||||
createdAt DateTime @default(now()) @map("created_at") @db.Timestamptz
|
||||
updatedAt DateTime @updatedAt @map("updated_at") @db.Timestamptz
|
||||
|
||||
// Relations
|
||||
workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
|
||||
members TeamMember[]
|
||||
|
||||
@@index([workspaceId])
|
||||
@@map("teams")
|
||||
}
|
||||
|
||||
model TeamMember {
|
||||
teamId String @map("team_id") @db.Uuid
|
||||
userId String @map("user_id") @db.Uuid
|
||||
role TeamMemberRole @default(MEMBER)
|
||||
joinedAt DateTime @default(now()) @map("joined_at") @db.Timestamptz
|
||||
|
||||
// Relations
|
||||
team Team @relation(fields: [teamId], references: [id], onDelete: Cascade)
|
||||
user User @relation(fields: [userId], references: [id], onDelete: Cascade)
|
||||
|
||||
@@id([teamId, userId])
|
||||
@@index([userId])
|
||||
@@map("team_members")
|
||||
}
|
||||
|
||||
model Task {
|
||||
id String @id @default(uuid()) @db.Uuid
|
||||
workspaceId String @map("workspace_id") @db.Uuid
|
||||
@@ -625,36 +665,36 @@ model Verification {
|
||||
// ============================================
|
||||
|
||||
model KnowledgeEntry {
|
||||
id String @id @default(uuid()) @db.Uuid
|
||||
workspaceId String @map("workspace_id") @db.Uuid
|
||||
workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
|
||||
id String @id @default(uuid()) @db.Uuid
|
||||
workspaceId String @map("workspace_id") @db.Uuid
|
||||
workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
|
||||
|
||||
// Identity
|
||||
slug String
|
||||
title String
|
||||
|
||||
slug String
|
||||
title String
|
||||
|
||||
// Content
|
||||
content String @db.Text
|
||||
contentHtml String? @map("content_html") @db.Text
|
||||
content String @db.Text
|
||||
contentHtml String? @map("content_html") @db.Text
|
||||
summary String?
|
||||
|
||||
|
||||
// Status
|
||||
status EntryStatus @default(DRAFT)
|
||||
visibility Visibility @default(PRIVATE)
|
||||
|
||||
status EntryStatus @default(DRAFT)
|
||||
visibility Visibility @default(PRIVATE)
|
||||
|
||||
// Audit
|
||||
createdAt DateTime @default(now()) @map("created_at") @db.Timestamptz
|
||||
updatedAt DateTime @updatedAt @map("updated_at") @db.Timestamptz
|
||||
createdBy String @map("created_by") @db.Uuid
|
||||
updatedBy String @map("updated_by") @db.Uuid
|
||||
|
||||
createdAt DateTime @default(now()) @map("created_at") @db.Timestamptz
|
||||
updatedAt DateTime @updatedAt @map("updated_at") @db.Timestamptz
|
||||
createdBy String @map("created_by") @db.Uuid
|
||||
updatedBy String @map("updated_by") @db.Uuid
|
||||
|
||||
// Relations
|
||||
tags KnowledgeEntryTag[]
|
||||
outgoingLinks KnowledgeLink[] @relation("SourceEntry")
|
||||
incomingLinks KnowledgeLink[] @relation("TargetEntry")
|
||||
outgoingLinks KnowledgeLink[] @relation("SourceEntry")
|
||||
incomingLinks KnowledgeLink[] @relation("TargetEntry")
|
||||
versions KnowledgeEntryVersion[]
|
||||
embedding KnowledgeEmbedding?
|
||||
|
||||
|
||||
@@unique([workspaceId, slug])
|
||||
@@index([workspaceId, status])
|
||||
@@index([workspaceId, updatedAt])
|
||||
@@ -664,39 +704,39 @@ model KnowledgeEntry {
|
||||
}
|
||||
|
||||
model KnowledgeEntryVersion {
|
||||
id String @id @default(uuid()) @db.Uuid
|
||||
entryId String @map("entry_id") @db.Uuid
|
||||
entry KnowledgeEntry @relation(fields: [entryId], references: [id], onDelete: Cascade)
|
||||
|
||||
version Int
|
||||
title String
|
||||
content String @db.Text
|
||||
summary String?
|
||||
|
||||
createdAt DateTime @default(now()) @map("created_at") @db.Timestamptz
|
||||
createdBy String @map("created_by") @db.Uuid
|
||||
changeNote String? @map("change_note")
|
||||
|
||||
id String @id @default(uuid()) @db.Uuid
|
||||
entryId String @map("entry_id") @db.Uuid
|
||||
entry KnowledgeEntry @relation(fields: [entryId], references: [id], onDelete: Cascade)
|
||||
|
||||
version Int
|
||||
title String
|
||||
content String @db.Text
|
||||
summary String?
|
||||
|
||||
createdAt DateTime @default(now()) @map("created_at") @db.Timestamptz
|
||||
createdBy String @map("created_by") @db.Uuid
|
||||
changeNote String? @map("change_note")
|
||||
|
||||
@@unique([entryId, version])
|
||||
@@index([entryId, version])
|
||||
@@map("knowledge_entry_versions")
|
||||
}
|
||||
|
||||
model KnowledgeLink {
|
||||
id String @id @default(uuid()) @db.Uuid
|
||||
|
||||
sourceId String @map("source_id") @db.Uuid
|
||||
source KnowledgeEntry @relation("SourceEntry", fields: [sourceId], references: [id], onDelete: Cascade)
|
||||
|
||||
targetId String @map("target_id") @db.Uuid
|
||||
target KnowledgeEntry @relation("TargetEntry", fields: [targetId], references: [id], onDelete: Cascade)
|
||||
|
||||
id String @id @default(uuid()) @db.Uuid
|
||||
|
||||
sourceId String @map("source_id") @db.Uuid
|
||||
source KnowledgeEntry @relation("SourceEntry", fields: [sourceId], references: [id], onDelete: Cascade)
|
||||
|
||||
targetId String @map("target_id") @db.Uuid
|
||||
target KnowledgeEntry @relation("TargetEntry", fields: [targetId], references: [id], onDelete: Cascade)
|
||||
|
||||
// Link metadata
|
||||
linkText String @map("link_text")
|
||||
context String?
|
||||
|
||||
createdAt DateTime @default(now()) @map("created_at") @db.Timestamptz
|
||||
|
||||
linkText String @map("link_text")
|
||||
context String?
|
||||
|
||||
createdAt DateTime @default(now()) @map("created_at") @db.Timestamptz
|
||||
|
||||
@@unique([sourceId, targetId])
|
||||
@@index([sourceId])
|
||||
@@index([targetId])
|
||||
@@ -704,17 +744,17 @@ model KnowledgeLink {
|
||||
}
|
||||
|
||||
model KnowledgeTag {
|
||||
id String @id @default(uuid()) @db.Uuid
|
||||
workspaceId String @map("workspace_id") @db.Uuid
|
||||
id String @id @default(uuid()) @db.Uuid
|
||||
workspaceId String @map("workspace_id") @db.Uuid
|
||||
workspace Workspace @relation(fields: [workspaceId], references: [id], onDelete: Cascade)
|
||||
|
||||
|
||||
name String
|
||||
slug String
|
||||
color String?
|
||||
description String?
|
||||
|
||||
entries KnowledgeEntryTag[]
|
||||
|
||||
|
||||
entries KnowledgeEntryTag[]
|
||||
|
||||
@@unique([workspaceId, slug])
|
||||
@@index([workspaceId])
|
||||
@@map("knowledge_tags")
|
||||
@@ -723,10 +763,10 @@ model KnowledgeTag {
|
||||
model KnowledgeEntryTag {
|
||||
entryId String @map("entry_id") @db.Uuid
|
||||
entry KnowledgeEntry @relation(fields: [entryId], references: [id], onDelete: Cascade)
|
||||
|
||||
tagId String @map("tag_id") @db.Uuid
|
||||
tag KnowledgeTag @relation(fields: [tagId], references: [id], onDelete: Cascade)
|
||||
|
||||
|
||||
tagId String @map("tag_id") @db.Uuid
|
||||
tag KnowledgeTag @relation(fields: [tagId], references: [id], onDelete: Cascade)
|
||||
|
||||
@@id([entryId, tagId])
|
||||
@@index([entryId])
|
||||
@@index([tagId])
|
||||
@@ -734,16 +774,16 @@ model KnowledgeEntryTag {
|
||||
}
|
||||
|
||||
model KnowledgeEmbedding {
|
||||
id String @id @default(uuid()) @db.Uuid
|
||||
entryId String @unique @map("entry_id") @db.Uuid
|
||||
entry KnowledgeEntry @relation(fields: [entryId], references: [id], onDelete: Cascade)
|
||||
|
||||
id String @id @default(uuid()) @db.Uuid
|
||||
entryId String @unique @map("entry_id") @db.Uuid
|
||||
entry KnowledgeEntry @relation(fields: [entryId], references: [id], onDelete: Cascade)
|
||||
|
||||
embedding Unsupported("vector(1536)")
|
||||
model String
|
||||
|
||||
createdAt DateTime @default(now()) @map("created_at") @db.Timestamptz
|
||||
updatedAt DateTime @updatedAt @map("updated_at") @db.Timestamptz
|
||||
|
||||
|
||||
createdAt DateTime @default(now()) @map("created_at") @db.Timestamptz
|
||||
updatedAt DateTime @updatedAt @map("updated_at") @db.Timestamptz
|
||||
|
||||
@@index([entryId])
|
||||
@@map("knowledge_embeddings")
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user