365c36d97b
- 0011: RBAC role flags and seed data - 0012: diagnostic grade_id - 0013: message recall - 0014: message templates - 0015: group messages and message reports/blocks - 0016: invitation codes - 0017: draft device sync - 0018: attendance status reason - 0019: attendance warning thresholds - 0020: leave requests - 0021: attendance period
86 lines
5.8 KiB
SQL
86 lines
5.8 KiB
SQL
-- 0011_rbac_role_flags_and_seed.sql
|
|
-- RBAC: add is_system/is_enabled columns to roles table and seed role_permissions.
|
|
|
|
-- 1. Add is_system and is_enabled columns to roles table.
|
|
ALTER TABLE `roles`
|
|
ADD COLUMN `is_system` boolean DEFAULT false NOT NULL,
|
|
ADD COLUMN `is_enabled` boolean DEFAULT true NOT NULL;
|
|
|
|
-- 2. Mark the 6 builtin roles as system roles.
|
|
UPDATE `roles` SET `is_system` = true
|
|
WHERE `name` IN ('admin', 'teacher', 'student', 'parent', 'grade_head', 'teaching_head');
|
|
|
|
-- 3. Seed role_permissions for builtin roles.
|
|
-- Uses INSERT IGNORE so re-running is safe (role_permissions has a composite PK).
|
|
-- Permissions are resolved from ROLE_PERMISSIONS_SEED in src/shared/lib/permissions.ts.
|
|
|
|
-- admin
|
|
INSERT IGNORE INTO `role_permissions` (`role_id`, `permission`)
|
|
SELECT id, 'exam:create' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'exam:read' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'exam:update' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'exam:delete' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'exam:duplicate' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'exam:publish' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'exam:ai_generate' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'homework:create' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'homework:grade' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'question:create' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'question:read' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'question:update' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'question:delete' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'textbook:create' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'textbook:read' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'textbook:update' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'textbook:delete' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'class:create' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'class:read' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'class:update' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'class:delete' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'class:enroll' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'class:schedule' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'school:manage' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'grade:manage' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'user:manage' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'user:profile_update' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'ai:chat' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'ai:configure' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'settings:admin' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'audit_log:read' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'announcement:manage' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'announcement:read' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'grade_record:manage' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'grade_record:read' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'course_plan:manage' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'course_plan:read' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'attendance:manage' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'attendance:read' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'message:send' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'message:read' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'message:delete' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'schedule:auto' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'schedule:adjust' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'elective:manage' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'elective:read' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'exam:proctor' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'exam:proctor:read' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'diagnostic:manage' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'diagnostic:read' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'lesson_plan:create' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'lesson_plan:read' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'lesson_plan:update' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'lesson_plan:delete' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'lesson_plan:publish' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'file:upload' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'file:read' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'file:delete' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'dashboard:admin_read' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'error_book:analytics_read' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'adaptive_practice:read' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'role:create' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'role:read' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'role:update' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'role:delete' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'role:assign' FROM `roles` WHERE `name` = 'admin'
|
|
UNION ALL SELECT id, 'permission:read' FROM `roles` WHERE `name` = 'admin';
|