redz1029
3cb980b629
Security — enforce write authorization server-side (was UI/RPC-only): - it_service_requests RLS: block cross-office read/edit + self-approve (QA-015) - pass_slips RLS: owner can complete but not self-approve (QA-046) - swap_requests RLS: scope select/update to participants + admin (QA-047) - storage: tighten it_service_attachments + task_attachments write/delete (QA-027) - admin_user_management edge function: allow programmers to manage users (QA-016) Fixes: - workforce generator "uncovered shifts" false alarms (QA-043/044) - network-map VLAN + New-location dialog validation, disabled-until-valid (QA-048) - de-flake time-of-day-dependent dashboard metrics test (QA-045) Toolchain: - upgrade to Flutter 3.47.5 / Dart 3.13.4; font_awesome_flutter 11.0.0, flutter_quill 11.6.0, pdfrx 2.6.5; clear resulting deprecations (QA-002) analyze clean; 139 tests pass; web build succeeds. Report + evidence in docs/qa/. Note: also carries the in-progress Brick model cleanup already present in the working tree. QA-001 (AI keys public in the build) is deferred by owner decision. Co-Authored-By: claude-flow <ruv@ruv.net>
48 lines
1.9 KiB
SQL
48 lines
1.9 KiB
SQL
-- QA-027 follow-up: task_attachments storage writes were open to the `public`
|
|
-- role, i.e. UNAUTHENTICATED users could upload, overwrite, and delete task
|
|
-- attachments (worse than the it_service_attachments delete hole). The bucket
|
|
-- stays public for reads (bucket.public = true, unchanged); lock down writes:
|
|
-- * INSERT: any authenticated user (uploads happen while signed in)
|
|
-- * UPDATE/DELETE: the uploader (objects.owner) or a task-privileged role
|
|
-- The read policy ("task attachments policy 6srt2u_0") is left untouched.
|
|
|
|
DROP POLICY IF EXISTS "task attachments policy 6srt2u_1" ON storage.objects; -- was INSERT/public
|
|
CREATE POLICY "task_attachments_insert" ON storage.objects
|
|
FOR INSERT TO authenticated
|
|
WITH CHECK (bucket_id = 'task_attachments');
|
|
|
|
DROP POLICY IF EXISTS "task attachments policy 6srt2u_2" ON storage.objects; -- was UPDATE/public
|
|
CREATE POLICY "task_attachments_update" ON storage.objects
|
|
FOR UPDATE TO authenticated
|
|
USING (
|
|
bucket_id = 'task_attachments'
|
|
AND (
|
|
owner = auth.uid()
|
|
OR EXISTS (SELECT 1 FROM public.profiles p
|
|
WHERE p.id = auth.uid()
|
|
AND p.role IN ('admin', 'programmer', 'dispatcher', 'it_staff'))
|
|
)
|
|
)
|
|
WITH CHECK (
|
|
bucket_id = 'task_attachments'
|
|
AND (
|
|
owner = auth.uid()
|
|
OR EXISTS (SELECT 1 FROM public.profiles p
|
|
WHERE p.id = auth.uid()
|
|
AND p.role IN ('admin', 'programmer', 'dispatcher', 'it_staff'))
|
|
)
|
|
);
|
|
|
|
DROP POLICY IF EXISTS "task attachments policy 6srt2u_3" ON storage.objects; -- was DELETE/public
|
|
CREATE POLICY "task_attachments_delete" ON storage.objects
|
|
FOR DELETE TO authenticated
|
|
USING (
|
|
bucket_id = 'task_attachments'
|
|
AND (
|
|
owner = auth.uid()
|
|
OR EXISTS (SELECT 1 FROM public.profiles p
|
|
WHERE p.id = auth.uid()
|
|
AND p.role IN ('admin', 'programmer', 'dispatcher', 'it_staff'))
|
|
)
|
|
);
|