44 lines
1.9 KiB
SQL
44 lines
1.9 KiB
SQL
-- create table for users
|
|
create table kandimat_data.person
|
|
(
|
|
row_id serial primary key,
|
|
first_name character varying(200) check (first_name <> ''),
|
|
last_name character varying(200) check (last_name <> ''),
|
|
about character varying(2000),
|
|
created_at timestamp default now(),
|
|
role kandimat_data.role not null default 'kandimat_person'
|
|
);
|
|
grant select, update, delete on table kandimat_data.person to kandimat_person;
|
|
-- the following is only necessary as long as anonymous should be able to view candidates and editors
|
|
grant select on table kandimat_data.person to kandimat_anonymous;
|
|
|
|
-- create table for accounts
|
|
create table kandimat_data_privat.person_account
|
|
(
|
|
person_row_id integer primary key references kandimat_data.person (row_id) on delete cascade,
|
|
email character varying(320) not null unique check (email ~* '^.+@.+\..+$'),
|
|
password_hash character varying(256) not null
|
|
);
|
|
|
|
alter table kandimat_data.person
|
|
enable row level security;
|
|
create policy update_person on kandimat_data.person for update to kandimat_person
|
|
with check (row_id = nullif(current_setting('jwt.claims.person_row_id', true), '')::integer);
|
|
create policy delete_person on kandimat_data.person for delete to kandimat_person
|
|
using (row_id = nullif(current_setting('jwt.claims.person_row_id', true), '')::integer);
|
|
|
|
-- The following enables viewing candidates and editors information for every person.
|
|
-- This may be changed to only enable registered (and verified) persons.
|
|
create policy select_person_public
|
|
on kandimat_data.person
|
|
for select
|
|
to kandimat_anonymous, kandimat_person -- maybe change to kandimat_person only in the future
|
|
using (role in ('kandimat_editor', 'kandimat_candidate'));
|
|
|
|
-- Editors can see all registered persons in order to elevate their privileges
|
|
create policy select_person_editor
|
|
on kandimat_data.person
|
|
for select
|
|
to kandimat_editor
|
|
using (true);
|