nexarch/migrations/0029_task_setup_policy_rules.up.sql

-- Issue #369: workflow/internal/taskapi und connect/internal/connectorsetupapi
-- hatten keine Rechte-Schluessel; Muster wie 0018_module_policy_rules.
-- connect.setup.write (Zugangsdaten, Mapping) nur fuer tenant_admin; die Rolle
-- kommt aus dem Token (X-User-Role), ohne Rolle gilt 'user'.
WITH grants(role, permission) AS (
    VALUES
        ('user', 'workflow.task.read'),
        ('user', 'workflow.task.write'),
        ('tenant_admin', 'workflow.task.read'),
        ('tenant_admin', 'workflow.task.write'),

        ('user', 'connect.setup.read'),
        ('tenant_admin', 'connect.setup.read'),
        ('tenant_admin', 'connect.setup.write')
),
ins AS (
    INSERT INTO policy_rules (role, permission, granted_by)
    SELECT role, permission, 'migration:0029_task_setup_policy_rules' FROM grants
    ON CONFLICT (role, permission) DO NOTHING
    RETURNING role, permission
)
INSERT INTO policy_rule_changes (role, permission, action, actor, version)
SELECT i.role, i.permission, 'grant', 'migration:0029_task_setup_policy_rules',
       COALESCE((SELECT MAX(c.version) FROM policy_rule_changes c WHERE c.role = i.role AND c.permission = i.permission), 0) + 1
FROM ins i;