nexarch/migrations/0011_dms_policy_rules.down.sql

-- Nimmt nur die von dieser Migration gewaehrten dms.*-Regeln zurueck; vom
-- Betrieb spaeter selbst gewaehrte oder geaenderte Regeln bleiben unberuehrt.
WITH del AS (
    DELETE FROM policy_rules
    WHERE granted_by = 'migration:0011_dms_policy_rules' AND permission LIKE 'dms.%'
    RETURNING role, permission
)
INSERT INTO policy_rule_changes (role, permission, action, actor, version)
SELECT d.role, d.permission, 'revoke', 'migration:0011_dms_policy_rules:down',
       COALESCE((SELECT MAX(c.version) FROM policy_rule_changes c WHERE c.role = d.role AND c.permission = d.permission), 0) + 1
FROM del d;