nala/SGF
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Preserva base local aceite de identidade e acessos

Browse Source
This commit is contained in:
Codex
2026-10-25 21:29:22 +02:00
commit 26b80df545
112 changed files with 13259 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
database/.gitignore
+1
View File
@@ -0,0 +1 @@
*.sqlite*
database/factories/UserFactory.php
+45
View File
@@ -0,0 +1,45 @@
<?php
namespace Database\Factories;
use App\Models\User;
use Illuminate\Database\Eloquent\Factories\Factory;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Str;
/**
* @extends Factory<User>
*/
class UserFactory extends Factory
{
/**
* The current password being used by the factory.
*/
protected static ?string $password;
/**
* Define the model's default state.
*
* @return array<string, mixed>
*/
public function definition(): array
{
return [
'name' => fake()->name(),
'email' => fake()->unique()->safeEmail(),
'email_verified_at' => now(),
'password' => static::$password ??= Hash::make('password'),
'remember_token' => Str::random(10),
];
}
/**
* Indicate that the model's email address should be unverified.
*/
public function unverified(): static
{
return $this->state(fn (array $attributes) => [
'email_verified_at' => null,
]);
}
}
database/migrations/0001_01_01_000000_create_users_table.php
+49
View File
@@ -0,0 +1,49 @@
<?php
use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;
return new class extends Migration
{
/**
* Run the migrations.
*/
public function up(): void
{
Schema::create('users', function (Blueprint $table) {
$table->id();
$table->string('name');
$table->string('email')->unique();
$table->timestamp('email_verified_at')->nullable();
$table->string('password');
$table->rememberToken();
$table->timestamps();
});
Schema::create('password_reset_tokens', function (Blueprint $table) {
$table->string('email')->primary();
$table->string('token');
$table->timestamp('created_at')->nullable();
});
Schema::create('sessions', function (Blueprint $table) {
$table->string('id')->primary();
$table->foreignId('user_id')->nullable()->index();
$table->string('ip_address', 45)->nullable();
$table->text('user_agent')->nullable();
$table->longText('payload');
$table->integer('last_activity')->index();
});
}
/**
* Reverse the migrations.
*/
public function down(): void
{
Schema::dropIfExists('users');
Schema::dropIfExists('password_reset_tokens');
Schema::dropIfExists('sessions');
}
};
database/migrations/0001_01_01_000001_create_cache_table.php
+35
View File
@@ -0,0 +1,35 @@
<?php
use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;
return new class extends Migration
{
/**
* Run the migrations.
*/
public function up(): void
{
Schema::create('cache', function (Blueprint $table) {
$table->string('key')->primary();
$table->mediumText('value');
$table->bigInteger('expiration')->index();
});
Schema::create('cache_locks', function (Blueprint $table) {
$table->string('key')->primary();
$table->string('owner');
$table->bigInteger('expiration')->index();
});
}
/**
* Reverse the migrations.
*/
public function down(): void
{
Schema::dropIfExists('cache');
Schema::dropIfExists('cache_locks');
}
};
database/migrations/0001_01_01_000002_create_jobs_table.php
+59
View File
@@ -0,0 +1,59 @@
<?php
use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;
return new class extends Migration
{
/**
* Run the migrations.
*/
public function up(): void
{
Schema::create('jobs', function (Blueprint $table) {
$table->id();
$table->string('queue')->index();
$table->longText('payload');
$table->unsignedSmallInteger('attempts');
$table->unsignedInteger('reserved_at')->nullable();
$table->unsignedInteger('available_at');
$table->unsignedInteger('created_at');
});
Schema::create('job_batches', function (Blueprint $table) {
$table->string('id')->primary();
$table->string('name');
$table->integer('total_jobs');
$table->integer('pending_jobs');
$table->integer('failed_jobs');
$table->longText('failed_job_ids');
$table->mediumText('options')->nullable();
$table->integer('cancelled_at')->nullable();
$table->integer('created_at');
$table->integer('finished_at')->nullable();
});
Schema::create('failed_jobs', function (Blueprint $table) {
$table->id();
$table->string('uuid')->unique();
$table->string('connection');
$table->string('queue');
$table->longText('payload');
$table->longText('exception');
$table->timestamp('failed_at')->useCurrent();
$table->index(['connection', 'queue', 'failed_at']);
});
}
/**
* Reverse the migrations.
*/
public function down(): void
{
Schema::dropIfExists('jobs');
Schema::dropIfExists('job_batches');
Schema::dropIfExists('failed_jobs');
}
};
database/migrations/2026_10_25_000000_create_identity_foundation.php
+47
View File
@@ -0,0 +1,47 @@
<?php
use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;
return new class extends Migration
{
public function up(): void
{
Schema::create('tenants', function (Blueprint $table): void {
$table->id();
$table->string('name');
$table->timestamps();
});
Schema::create('companies', function (Blueprint $table): void {
$table->id();
$table->foreignId('tenant_id')->constrained()->restrictOnDelete();
$table->string('name');
$table->timestamps();
$table->unique(['tenant_id', 'id']);
});
Schema::create('company_memberships', function (Blueprint $table): void {
$table->foreignId('user_id')->constrained()->cascadeOnDelete();
$table->unsignedBigInteger('tenant_id');
$table->unsignedBigInteger('company_id');
$table->foreign(['tenant_id', 'company_id'])->references(['tenant_id', 'id'])->on('companies')->restrictOnDelete();
$table->primary(['user_id', 'tenant_id', 'company_id']);
});
Schema::create('units', function (Blueprint $table): void {
$table->id();
$table->unsignedBigInteger('tenant_id');
$table->unsignedBigInteger('company_id');
$table->foreign(['tenant_id', 'company_id'])->references(['tenant_id', 'id'])->on('companies')->restrictOnDelete();
$table->string('name');
$table->timestamps();
});
}
public function down(): void
{
Schema::dropIfExists('units');
Schema::dropIfExists('company_memberships');
Schema::dropIfExists('companies');
Schema::dropIfExists('tenants');
}
};
database/migrations/2026_10_25_010000_add_identity_workflow.php
+77
View File
@@ -0,0 +1,77 @@
<?php
use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Schema;
return new class extends Migration
{
public function up(): void
{
Schema::table('users', fn (Blueprint $table) => $table->unsignedInteger('auth_version')->default(1));
Schema::table('units', fn (Blueprint $table) => $table->unique(['tenant_id', 'company_id', 'id']));
Schema::create('permission_grants', function (Blueprint $table): void {
$table->id();
$table->unsignedBigInteger('user_id');
$table->unsignedBigInteger('tenant_id');
$table->unsignedBigInteger('company_id');
$table->unsignedBigInteger('unit_id')->nullable();
$table->string('permission', 40);
$table->timestamps();
$table->foreign(['user_id', 'tenant_id', 'company_id'])->references(['user_id', 'tenant_id', 'company_id'])->on('company_memberships')->restrictOnDelete();
$table->foreign(['tenant_id', 'company_id', 'unit_id'])->references(['tenant_id', 'company_id', 'id'])->on('units')->restrictOnDelete();
});
DB::statement("CREATE UNIQUE INDEX permission_grants_company_unique ON permission_grants(user_id, company_id, permission) WHERE unit_id IS NULL");
DB::statement("CREATE UNIQUE INDEX permission_grants_unit_unique ON permission_grants(user_id, company_id, unit_id, permission) WHERE unit_id IS NOT NULL");
DB::statement("ALTER TABLE permission_grants ADD CONSTRAINT permission_grants_scope_check CHECK ((permission IN ('company.view','company.edit','unit.create','access.manage') AND unit_id IS NULL) OR (permission IN ('unit.view','unit.edit') AND unit_id IS NOT NULL))");
Schema::create('identity_audit', function (Blueprint $table): void {
$table->id();
$table->unsignedBigInteger('actor_id')->nullable();
$table->unsignedBigInteger('tenant_id')->nullable();
$table->unsignedBigInteger('company_id')->nullable();
$table->unsignedBigInteger('unit_id')->nullable();
$table->unsignedBigInteger('subject_id')->nullable();
$table->string('action', 80);
$table->jsonb('details');
$table->timestampTz('created_at')->useCurrent();
});
DB::unprepared(<<<'SQL'
CREATE OR REPLACE FUNCTION sgf_immutable_ownership() RETURNS trigger LANGUAGE plpgsql AS $$
BEGIN
IF NEW.id IS DISTINCT FROM OLD.id OR NEW.tenant_id IS DISTINCT FROM OLD.tenant_id THEN
RAISE EXCEPTION 'SGF_IMMUTABLE_OWNERSHIP';
END IF;
IF TG_TABLE_NAME IN ('units', 'permission_grants') THEN
IF NEW.company_id IS DISTINCT FROM OLD.company_id THEN
RAISE EXCEPTION 'SGF_IMMUTABLE_OWNERSHIP';
END IF;
END IF;
IF TG_TABLE_NAME = 'permission_grants' THEN
IF NEW.user_id IS DISTINCT FROM OLD.user_id OR NEW.unit_id IS DISTINCT FROM OLD.unit_id OR NEW.permission IS DISTINCT FROM OLD.permission THEN
RAISE EXCEPTION 'SGF_IMMUTABLE_OWNERSHIP';
END IF;
END IF;
RETURN NEW;
END; $$;
CREATE TRIGGER companies_immutable BEFORE UPDATE ON companies FOR EACH ROW EXECUTE FUNCTION sgf_immutable_ownership();
CREATE TRIGGER units_immutable BEFORE UPDATE ON units FOR EACH ROW EXECUTE FUNCTION sgf_immutable_ownership();
CREATE TRIGGER grants_immutable BEFORE UPDATE ON permission_grants FOR EACH ROW EXECUTE FUNCTION sgf_immutable_ownership();
CREATE OR REPLACE FUNCTION sgf_append_only_audit() RETURNS trigger LANGUAGE plpgsql AS $$
BEGIN RAISE EXCEPTION 'SGF_APPEND_ONLY_AUDIT'; END; $$;
CREATE TRIGGER audit_append_only BEFORE UPDATE OR DELETE ON identity_audit FOR EACH ROW EXECUTE FUNCTION sgf_append_only_audit();
SQL);
}
public function down(): void
{
Schema::dropIfExists('identity_audit');
Schema::dropIfExists('permission_grants');
DB::statement('DROP TRIGGER IF EXISTS units_immutable ON units');
DB::statement('DROP TRIGGER IF EXISTS companies_immutable ON companies');
DB::statement('DROP FUNCTION IF EXISTS sgf_immutable_ownership()');
DB::statement('DROP FUNCTION IF EXISTS sgf_append_only_audit()');
Schema::table('units', fn (Blueprint $table) => $table->dropUnique(['tenant_id', 'company_id', 'id']));
Schema::table('users', fn (Blueprint $table) => $table->dropColumn('auth_version'));
}
};
database/migrations/2026_10_25_020000_lock_membership_identifiers.php
+27
View File
@@ -0,0 +1,27 @@
<?php
use Illuminate\Database\Migrations\Migration;
use Illuminate\Support\Facades\DB;
return new class extends Migration
{
public function up(): void
{
DB::unprepared(<<<'SQL'
CREATE OR REPLACE FUNCTION sgf_immutable_membership() RETURNS trigger LANGUAGE plpgsql AS $$
BEGIN
IF NEW.user_id IS DISTINCT FROM OLD.user_id OR NEW.tenant_id IS DISTINCT FROM OLD.tenant_id OR NEW.company_id IS DISTINCT FROM OLD.company_id THEN
RAISE EXCEPTION 'SGF_IMMUTABLE_OWNERSHIP';
END IF;
RETURN NEW;
END; $$;
CREATE TRIGGER membership_immutable BEFORE UPDATE ON company_memberships FOR EACH ROW EXECUTE FUNCTION sgf_immutable_membership();
SQL);
}
public function down(): void
{
DB::statement('DROP TRIGGER IF EXISTS membership_immutable ON company_memberships');
DB::statement('DROP FUNCTION IF EXISTS sgf_immutable_membership()');
}
};
database/seeders/DatabaseSeeder.php
+20
View File
@@ -0,0 +1,20 @@
<?php
namespace Database\Seeders;
use App\Models\User;
use Illuminate\Database\Console\Seeds\WithoutModelEvents;
use Illuminate\Database\Seeder;
class DatabaseSeeder extends Seeder
{
use WithoutModelEvents;
/**
* Seed the application's database.
*/
public function run(): void
{
// No default accounts, passwords or scopes. Use confirmed local provisioning.
}
}