Jakob Wennberg
64 lines
2.9 KiB
SQL
64 lines
2.9 KiB
SQL
-- Migration 13: Document Archive
|
|
-- WORM-style document storage with hash integrity and version chain
|
|
|
|
-- =============================================================================
|
|
-- 1. document_attachments table
|
|
-- =============================================================================
|
|
CREATE TABLE public.document_attachments (
|
|
id uuid PRIMARY KEY DEFAULT uuid_generate_v4(),
|
|
user_id uuid REFERENCES auth.users ON DELETE CASCADE NOT NULL,
|
|
|
|
-- Storage
|
|
storage_path text NOT NULL,
|
|
file_name text NOT NULL,
|
|
file_size_bytes bigint,
|
|
mime_type text,
|
|
|
|
-- Integrity
|
|
sha256_hash text NOT NULL,
|
|
|
|
-- Version chain (WORM: Write Once, Read Many)
|
|
version integer NOT NULL DEFAULT 1,
|
|
original_id uuid REFERENCES public.document_attachments(id) ON DELETE SET NULL,
|
|
superseded_by_id uuid REFERENCES public.document_attachments(id) ON DELETE SET NULL,
|
|
is_current_version boolean NOT NULL DEFAULT true,
|
|
|
|
-- Digitization metadata
|
|
uploaded_by uuid REFERENCES auth.users ON DELETE SET NULL,
|
|
upload_source text CHECK (upload_source IN (
|
|
'camera', 'file_upload', 'email', 'e_invoice', 'scan', 'api', 'system'
|
|
)),
|
|
digitization_date timestamptz DEFAULT now(),
|
|
|
|
-- Linkage to journal entries (ON DELETE RESTRICT prevents deletion of linked entries)
|
|
journal_entry_id uuid REFERENCES public.journal_entries(id) ON DELETE RESTRICT,
|
|
journal_entry_line_id uuid REFERENCES public.journal_entry_lines(id) ON DELETE RESTRICT,
|
|
|
|
created_at timestamptz NOT NULL DEFAULT now(),
|
|
updated_at timestamptz NOT NULL DEFAULT now()
|
|
);
|
|
|
|
ALTER TABLE public.document_attachments ENABLE ROW LEVEL SECURITY;
|
|
|
|
-- RLS: select, insert, update for owner. NO DELETE policy (handled by trigger).
|
|
CREATE POLICY "document_attachments_select" ON public.document_attachments
|
|
FOR SELECT USING (auth.uid() = user_id);
|
|
|
|
CREATE POLICY "document_attachments_insert" ON public.document_attachments
|
|
FOR INSERT WITH CHECK (auth.uid() = user_id);
|
|
|
|
CREATE POLICY "document_attachments_update" ON public.document_attachments
|
|
FOR UPDATE USING (auth.uid() = user_id);
|
|
|
|
-- Intentionally NO DELETE policy -- deletion is blocked by trigger
|
|
|
|
CREATE INDEX idx_document_attachments_user_id ON public.document_attachments (user_id);
|
|
CREATE INDEX idx_document_attachments_journal_entry_id ON public.document_attachments (journal_entry_id);
|
|
CREATE INDEX idx_document_attachments_journal_entry_line_id ON public.document_attachments (journal_entry_line_id);
|
|
CREATE INDEX idx_document_attachments_sha256_hash ON public.document_attachments (sha256_hash);
|
|
CREATE INDEX idx_document_attachments_original_id ON public.document_attachments (original_id);
|
|
|
|
CREATE TRIGGER document_attachments_updated_at
|
|
BEFORE UPDATE ON public.document_attachments
|
|
FOR EACH ROW EXECUTE FUNCTION public.update_updated_at_column();
|