8af75a0a1e
- Admin CRM: D3RO Console 스타일 전체 적용 (panelSx/tableSx/filterBtnSx) - 3단계 권한: manager/admin/super_admin (DB + Edge Functions + Frontend) - 랜딩 페이지: 1회 결제 → 월간/연간 구독 SaaS 모델 (10개 언어) - SSE 스트리밍: VoiceConversation Premium LLM 라우팅 + fallback - Supabase 클라이언트: packages/api-client 공통 추출 (browser+server) - RPC 함수 타입: 9개 정의 (admin_usage_by_feature 등) - callAdminApi 401 버그 수정 (getUser() 선행 토큰 갱신)
48 lines
2.6 KiB
SQL
48 lines
2.6 KiB
SQL
-- Phase V2-6.1: 3단계 권한 체계 — manager 역할 추가
|
|
-- manager: CS 업무 (조회 + 구독 수정/메모)
|
|
-- admin: 운영 전권 (구독 CRUD, 삭제, manager 관리)
|
|
-- super_admin: admin 계정 관리 (승격/강등)
|
|
|
|
-- 1. profiles.role CHECK 확장
|
|
ALTER TABLE public.profiles DROP CONSTRAINT profiles_role_check;
|
|
ALTER TABLE public.profiles
|
|
ADD CONSTRAINT profiles_role_check
|
|
CHECK (role IN ('user', 'manager', 'admin', 'super_admin'));
|
|
|
|
-- 2. RLS: manager도 읽기 허용
|
|
DROP POLICY IF EXISTS admin_read_all_profiles ON public.profiles;
|
|
CREATE POLICY admin_read_all_profiles ON public.profiles FOR SELECT
|
|
USING ((auth.jwt() -> 'app_metadata' ->> 'role') IN ('manager', 'admin', 'super_admin'));
|
|
|
|
DROP POLICY IF EXISTS admin_read_all_subscriptions ON public.subscriptions;
|
|
CREATE POLICY admin_read_all_subscriptions ON public.subscriptions FOR SELECT
|
|
USING ((auth.jwt() -> 'app_metadata' ->> 'role') IN ('manager', 'admin', 'super_admin'));
|
|
|
|
DROP POLICY IF EXISTS admin_read_all_daily_usage ON public.daily_usage;
|
|
CREATE POLICY admin_read_all_daily_usage ON public.daily_usage FOR SELECT
|
|
USING ((auth.jwt() -> 'app_metadata' ->> 'role') IN ('manager', 'admin', 'super_admin'));
|
|
|
|
DROP POLICY IF EXISTS admin_read_audit_log ON public.audit_log;
|
|
CREATE POLICY admin_read_audit_log ON public.audit_log FOR SELECT
|
|
USING ((auth.jwt() -> 'app_metadata' ->> 'role') IN ('manager', 'admin', 'super_admin'));
|
|
|
|
-- 3. RLS: admin도 subscriptions/profiles 쓰기 허용 (기존 super_admin 전용 → admin 이상)
|
|
DROP POLICY IF EXISTS super_admin_write_subscriptions ON public.subscriptions;
|
|
CREATE POLICY admin_write_subscriptions ON public.subscriptions
|
|
FOR ALL
|
|
USING ((auth.jwt() -> 'app_metadata' ->> 'role') IN ('admin', 'super_admin'))
|
|
WITH CHECK ((auth.jwt() -> 'app_metadata' ->> 'role') IN ('admin', 'super_admin'));
|
|
|
|
DROP POLICY IF EXISTS super_admin_update_profiles ON public.profiles;
|
|
CREATE POLICY admin_update_profiles ON public.profiles
|
|
FOR UPDATE
|
|
USING ((auth.jwt() -> 'app_metadata' ->> 'role') IN ('admin', 'super_admin'))
|
|
WITH CHECK ((auth.jwt() -> 'app_metadata' ->> 'role') IN ('admin', 'super_admin'));
|
|
|
|
-- 4. RLS: manager는 subscriptions 수정만 허용 (생성/삭제 불가)
|
|
-- manager가 UPDATE를 수행할 수 있도록 별도 정책 (위의 admin_write_subscriptions은 admin 이상만)
|
|
-- 주의: 위 정책이 FOR ALL이므로 admin/super_admin은 이미 커버. manager만 UPDATE 추가.
|
|
CREATE POLICY manager_update_subscriptions ON public.subscriptions
|
|
FOR UPDATE
|
|
USING ((auth.jwt() -> 'app_metadata' ->> 'role') = 'manager')
|
|
WITH CHECK ((auth.jwt() -> 'app_metadata' ->> 'role') = 'manager');
|