Rotimi Best
df7a5818bb
* implement RLS * set default course currency to USD * remove unused import * update default currency in course in db
1314 lines
32 KiB
PL/PgSQL
1314 lines
32 KiB
PL/PgSQL
drop policy "Enable insert for authenticated users only" on "public"."course";
|
|
|
|
drop policy "Enable update for authenticated users only" on "public"."course";
|
|
|
|
drop policy "Enable insert for authenticated users only" on "public"."lesson_comment";
|
|
|
|
alter table "public"."apps_poll" enable row level security;
|
|
|
|
alter table "public"."apps_poll_option" enable row level security;
|
|
|
|
alter table "public"."apps_poll_submission" enable row level security;
|
|
|
|
alter table "public"."community_answer" enable row level security;
|
|
|
|
alter table "public"."community_question" enable row level security;
|
|
|
|
alter table "public"."course" enable row level security;
|
|
|
|
alter table "public"."course_newsfeed" enable row level security;
|
|
|
|
alter table "public"."course_newsfeed_comment" enable row level security;
|
|
|
|
alter table "public"."exercise" enable row level security;
|
|
|
|
alter table "public"."group" enable row level security;
|
|
|
|
alter table "public"."group_attendance" enable row level security;
|
|
|
|
alter table "public"."groupmember" enable row level security;
|
|
|
|
alter table "public"."lesson" enable row level security;
|
|
|
|
alter table "public"."lesson_completion" enable row level security;
|
|
|
|
alter table "public"."lesson_language" enable row level security;
|
|
|
|
alter table "public"."lesson_language_history" enable row level security;
|
|
|
|
alter table "public"."option" enable row level security;
|
|
|
|
alter table "public"."organization" enable row level security;
|
|
|
|
alter table "public"."organization_plan" enable row level security;
|
|
|
|
alter table "public"."organizationmember" enable row level security;
|
|
|
|
alter table "public"."question" enable row level security;
|
|
|
|
alter table "public"."question_answer" enable row level security;
|
|
|
|
alter table "public"."question_type" enable row level security;
|
|
|
|
alter table "public"."quiz" enable row level security;
|
|
|
|
alter table "public"."quiz_play" enable row level security;
|
|
|
|
alter table "public"."role" enable row level security;
|
|
|
|
alter table "public"."submission" enable row level security;
|
|
|
|
alter table "public"."submissionstatus" enable row level security;
|
|
|
|
alter table "public"."test_tenant" enable row level security;
|
|
|
|
alter table "public"."waitinglist" enable row level security;
|
|
|
|
set check_function_bodies = off;
|
|
|
|
CREATE OR REPLACE FUNCTION public.is_org_admin()
|
|
RETURNS boolean
|
|
LANGUAGE plpgsql
|
|
SECURITY DEFINER
|
|
AS $function$
|
|
BEGIN
|
|
RETURN EXISTS (
|
|
SELECT 1
|
|
FROM organizationmember
|
|
WHERE organization_id = organization_id
|
|
AND profile_id = (select auth.uid())
|
|
AND role_id = 1
|
|
);
|
|
END;
|
|
$function$
|
|
;
|
|
|
|
CREATE OR REPLACE FUNCTION public.is_org_admin(org_id uuid)
|
|
RETURNS boolean
|
|
LANGUAGE plpgsql
|
|
AS $function$
|
|
BEGIN
|
|
RETURN EXISTS (
|
|
SELECT 1
|
|
FROM organizationmember
|
|
WHERE organization_id = org_id
|
|
AND profile_id = (select auth.uid())
|
|
AND role_id = 1
|
|
);
|
|
END;
|
|
$function$
|
|
;
|
|
|
|
CREATE OR REPLACE FUNCTION public.is_org_member()
|
|
RETURNS boolean
|
|
LANGUAGE plpgsql
|
|
SECURITY DEFINER
|
|
AS $function$
|
|
BEGIN
|
|
RETURN EXISTS (
|
|
SELECT 1
|
|
FROM organizationmember
|
|
WHERE organization_id = organization_id
|
|
AND profile_id = (select auth.uid())
|
|
);
|
|
END;
|
|
$function$
|
|
;
|
|
|
|
CREATE OR REPLACE FUNCTION public.is_user_in_course_group(group_id uuid)
|
|
RETURNS boolean
|
|
LANGUAGE plpgsql
|
|
SECURITY DEFINER
|
|
AS $function$ begin return exists
|
|
(SELECT 1 FROM groupmember member
|
|
JOIN "group" g ON g.id = member.group_id
|
|
WHERE member.role_id IS NOT NULL
|
|
AND member.profile_id = auth.uid()
|
|
AND g.id = $1
|
|
);
|
|
END;
|
|
$function$
|
|
;
|
|
|
|
CREATE OR REPLACE FUNCTION public.is_user_in_group_with_role(group_id integer)
|
|
RETURNS boolean
|
|
LANGUAGE plpgsql
|
|
SECURITY DEFINER
|
|
AS $function$
|
|
begin
|
|
return exists (
|
|
SELECT 1
|
|
FROM organizationmember m
|
|
JOIN organization o ON o.organization_id = m.organization_id
|
|
WHERE m.role_id IS NOT NULL
|
|
AND m.profile_id = auth.uid ()
|
|
AND EXISTS (
|
|
SELECT 1
|
|
FROM "group" g
|
|
WHERE g.group_id = $1
|
|
AND g.organization_id = o.organization_id
|
|
)
|
|
);
|
|
END;
|
|
$function$
|
|
;
|
|
|
|
CREATE OR REPLACE FUNCTION public.is_user_in_group_with_role(group_id uuid)
|
|
RETURNS boolean
|
|
LANGUAGE plpgsql
|
|
SECURITY DEFINER
|
|
AS $function$
|
|
begin
|
|
return exists (
|
|
SELECT 1
|
|
FROM organizationmember member
|
|
JOIN organization o ON o.id = member.organization_id
|
|
WHERE member.role_id IS NOT NULL
|
|
AND member.profile_id = auth.uid ()
|
|
AND EXISTS (
|
|
SELECT 1
|
|
FROM "group" g
|
|
WHERE g.id = $1
|
|
AND g.organization_id = o.id
|
|
)
|
|
);
|
|
END;
|
|
$function$
|
|
;
|
|
|
|
create policy "Delete only your own poll"
|
|
on "public"."apps_poll"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using ((auth.uid() = ( SELECT groupmember.profile_id
|
|
FROM groupmember
|
|
WHERE (groupmember.id = apps_poll."authorId"))));
|
|
|
|
|
|
create policy "Update only your own"
|
|
on "public"."apps_poll"
|
|
as permissive
|
|
for update
|
|
to public
|
|
using ((auth.uid() = ( SELECT groupmember.profile_id
|
|
FROM groupmember
|
|
WHERE (groupmember.id = apps_poll."authorId"))))
|
|
with check ((auth.uid() = ( SELECT groupmember.profile_id
|
|
FROM groupmember
|
|
WHERE (groupmember.id = apps_poll."authorId"))));
|
|
|
|
|
|
create policy "User must be a course member to INSERT"
|
|
on "public"."apps_poll"
|
|
as permissive
|
|
for insert
|
|
to public
|
|
with check (is_user_in_course_group(( SELECT groupmember.group_id
|
|
FROM groupmember
|
|
WHERE (groupmember.id = apps_poll."authorId")
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be course member to SELECT"
|
|
on "public"."apps_poll"
|
|
as permissive
|
|
for select
|
|
to public
|
|
using (is_user_in_course_group(( SELECT groupmember.group_id
|
|
FROM groupmember
|
|
WHERE (groupmember.id = apps_poll."authorId")
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be a course member to INSERT"
|
|
on "public"."apps_poll_option"
|
|
as permissive
|
|
for insert
|
|
to public
|
|
with check (is_user_in_course_group(( SELECT groupmember.group_id
|
|
FROM groupmember
|
|
WHERE (groupmember.id = ( SELECT apps_poll."authorId"
|
|
FROM apps_poll
|
|
WHERE (apps_poll.id = apps_poll_option.poll_id)
|
|
LIMIT 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be a course member to UPDATE"
|
|
on "public"."apps_poll_option"
|
|
as permissive
|
|
for update
|
|
to public
|
|
using (is_user_in_course_group(( SELECT groupmember.group_id
|
|
FROM groupmember
|
|
WHERE (groupmember.id = ( SELECT apps_poll."authorId"
|
|
FROM apps_poll
|
|
WHERE (apps_poll.id = apps_poll_option.poll_id)
|
|
LIMIT 1))
|
|
LIMIT 1)))
|
|
with check (is_user_in_course_group(( SELECT groupmember.group_id
|
|
FROM groupmember
|
|
WHERE (groupmember.id = ( SELECT apps_poll."authorId"
|
|
FROM apps_poll
|
|
WHERE (apps_poll.id = apps_poll_option.poll_id)
|
|
LIMIT 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be a teacher to DELETE"
|
|
on "public"."apps_poll_option"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using (is_user_in_group_with_role(( SELECT groupmember.group_id
|
|
FROM groupmember
|
|
WHERE (groupmember.id = ( SELECT apps_poll."authorId"
|
|
FROM apps_poll
|
|
WHERE (apps_poll.id = apps_poll_option.poll_id)
|
|
LIMIT 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be course member to SELECT"
|
|
on "public"."apps_poll_option"
|
|
as permissive
|
|
for select
|
|
to public
|
|
using (is_user_in_course_group(( SELECT groupmember.group_id
|
|
FROM groupmember
|
|
WHERE (groupmember.id = ( SELECT apps_poll."authorId"
|
|
FROM apps_poll
|
|
WHERE (apps_poll.id = apps_poll_option.poll_id)
|
|
LIMIT 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "Authenticated users can read"
|
|
on "public"."apps_poll_submission"
|
|
as permissive
|
|
for select
|
|
to public
|
|
using ((auth.uid() IS NOT NULL));
|
|
|
|
|
|
create policy "Delete your own submission"
|
|
on "public"."apps_poll_submission"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using ((auth.uid() = ( SELECT groupmember.profile_id
|
|
FROM groupmember
|
|
WHERE (groupmember.id = apps_poll_submission.selected_by_id))));
|
|
|
|
|
|
create policy "Enable insert for authenticated users only"
|
|
on "public"."apps_poll_submission"
|
|
as permissive
|
|
for insert
|
|
to authenticated
|
|
with check (true);
|
|
|
|
|
|
create policy "Update your own submission"
|
|
on "public"."apps_poll_submission"
|
|
as permissive
|
|
for update
|
|
to public
|
|
using ((auth.uid() = ( SELECT groupmember.profile_id
|
|
FROM groupmember
|
|
WHERE (groupmember.id = apps_poll_submission.selected_by_id))))
|
|
with check ((auth.uid() = ( SELECT groupmember.profile_id
|
|
FROM groupmember
|
|
WHERE (groupmember.id = apps_poll_submission.selected_by_id))));
|
|
|
|
|
|
create policy "Authenticated users can SELECT"
|
|
on "public"."community_answer"
|
|
as permissive
|
|
for select
|
|
to public
|
|
using ((auth.uid() IS NOT NULL));
|
|
|
|
|
|
create policy "Delete your own answer"
|
|
on "public"."community_answer"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using ((auth.uid() = author_profile_id));
|
|
|
|
|
|
create policy "Enable insert for authenticated users only"
|
|
on "public"."community_answer"
|
|
as permissive
|
|
for insert
|
|
to authenticated
|
|
with check (true);
|
|
|
|
|
|
create policy "Update your own answer"
|
|
on "public"."community_answer"
|
|
as permissive
|
|
for update
|
|
to public
|
|
using ((auth.uid() = author_profile_id))
|
|
with check ((auth.uid() = author_profile_id));
|
|
|
|
|
|
create policy "Authenticated users can SELECT"
|
|
on "public"."community_question"
|
|
as permissive
|
|
for select
|
|
to public
|
|
using ((auth.uid() IS NOT NULL));
|
|
|
|
|
|
create policy "Delete your own question"
|
|
on "public"."community_question"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using ((auth.uid() = author_profile_id));
|
|
|
|
|
|
create policy "Update your own question"
|
|
on "public"."community_question"
|
|
as permissive
|
|
for update
|
|
to public
|
|
using ((auth.uid() = author_profile_id))
|
|
with check ((auth.uid() = author_profile_id));
|
|
|
|
|
|
create policy "User must be an org member to DELETE"
|
|
on "public"."course"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using (is_user_in_group_with_role(group_id));
|
|
|
|
|
|
create policy "User must be an org member to INSERT"
|
|
on "public"."course"
|
|
as permissive
|
|
for insert
|
|
to public
|
|
with check (is_user_in_group_with_role(group_id));
|
|
|
|
|
|
create policy "User must be an org member to UPDATE"
|
|
on "public"."course"
|
|
as permissive
|
|
for update
|
|
to public
|
|
using (is_user_in_group_with_role(group_id))
|
|
with check (is_user_in_group_with_role(group_id));
|
|
|
|
|
|
create policy "Delete your own comment"
|
|
on "public"."course_newsfeed"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using ((auth.uid() = ( SELECT groupmember.profile_id
|
|
FROM groupmember
|
|
WHERE (groupmember.id = course_newsfeed.author_id))));
|
|
|
|
|
|
create policy "Update only your own"
|
|
on "public"."course_newsfeed"
|
|
as permissive
|
|
for update
|
|
to public
|
|
using ((auth.uid() = ( SELECT groupmember.profile_id
|
|
FROM groupmember
|
|
WHERE (groupmember.id = course_newsfeed.author_id))))
|
|
with check ((auth.uid() = ( SELECT groupmember.profile_id
|
|
FROM groupmember
|
|
WHERE (groupmember.id = course_newsfeed.author_id))));
|
|
|
|
|
|
create policy "User must be a course member to INSERT"
|
|
on "public"."course_newsfeed"
|
|
as permissive
|
|
for insert
|
|
to public
|
|
with check (is_user_in_course_group(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = course_newsfeed.course_id)
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be a course member to SELECT"
|
|
on "public"."course_newsfeed"
|
|
as permissive
|
|
for select
|
|
to public
|
|
using (is_user_in_course_group(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = course_newsfeed.course_id)
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "Delete your own"
|
|
on "public"."course_newsfeed_comment"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using ((auth.uid() = ( SELECT groupmember.profile_id
|
|
FROM groupmember
|
|
WHERE (groupmember.id = course_newsfeed_comment.author_id))));
|
|
|
|
|
|
create policy "Update only your own"
|
|
on "public"."course_newsfeed_comment"
|
|
as permissive
|
|
for update
|
|
to public
|
|
using ((auth.uid() = ( SELECT groupmember.profile_id
|
|
FROM groupmember
|
|
WHERE (groupmember.id = course_newsfeed_comment.author_id))))
|
|
with check ((auth.uid() = ( SELECT groupmember.profile_id
|
|
FROM groupmember
|
|
WHERE (groupmember.id = course_newsfeed_comment.author_id))));
|
|
|
|
|
|
create policy "User must be a course member to INSERT"
|
|
on "public"."course_newsfeed_comment"
|
|
as permissive
|
|
for insert
|
|
to public
|
|
with check (is_user_in_course_group(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT course_newsfeed.course_id
|
|
FROM course_newsfeed
|
|
WHERE (course_newsfeed.id = course_newsfeed_comment.course_newsfeed_id)))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be a course member to SELECT"
|
|
on "public"."course_newsfeed_comment"
|
|
as permissive
|
|
for select
|
|
to public
|
|
using (is_user_in_course_group(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT course_newsfeed.course_id
|
|
FROM course_newsfeed
|
|
WHERE (course_newsfeed.id = course_newsfeed_comment.course_newsfeed_id)))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "Enable read access for all users"
|
|
on "public"."exercise"
|
|
as permissive
|
|
for select
|
|
to public
|
|
using (true);
|
|
|
|
|
|
create policy "User must be an org member to DELETE"
|
|
on "public"."exercise"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = exercise.lesson_id)
|
|
LIMIT 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be an org member to INSERT"
|
|
on "public"."exercise"
|
|
as permissive
|
|
for insert
|
|
to public
|
|
with check (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = exercise.lesson_id)
|
|
LIMIT 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be an org member to UPDATE"
|
|
on "public"."exercise"
|
|
as permissive
|
|
for update
|
|
to public
|
|
using (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = exercise.lesson_id)
|
|
LIMIT 1))
|
|
LIMIT 1)))
|
|
with check (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = exercise.lesson_id)
|
|
LIMIT 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "Enable insert for authenticated users only"
|
|
on "public"."group"
|
|
as permissive
|
|
for insert
|
|
to authenticated
|
|
with check (true);
|
|
|
|
|
|
create policy "Enable read access for all users"
|
|
on "public"."group"
|
|
as permissive
|
|
for select
|
|
to public
|
|
using (true);
|
|
|
|
|
|
create policy "Only org admins can delete"
|
|
on "public"."group"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using (is_org_admin());
|
|
|
|
|
|
create policy "Only org admins can update"
|
|
on "public"."group"
|
|
as permissive
|
|
for update
|
|
to public
|
|
using (is_org_admin())
|
|
with check (is_org_admin());
|
|
|
|
|
|
create policy "User must be a course member to INSERT"
|
|
on "public"."group_attendance"
|
|
as permissive
|
|
for insert
|
|
to public
|
|
with check (is_user_in_course_group(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = group_attendance.course_id)
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be a course member to SELECT"
|
|
on "public"."group_attendance"
|
|
as permissive
|
|
for select
|
|
to public
|
|
using (is_user_in_course_group(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = group_attendance.course_id)
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be a course member to UPDATE"
|
|
on "public"."group_attendance"
|
|
as permissive
|
|
for update
|
|
to public
|
|
using (is_user_in_course_group(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = group_attendance.course_id)
|
|
LIMIT 1)))
|
|
with check (is_user_in_course_group(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = group_attendance.course_id)
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be an org member to DELETE"
|
|
on "public"."group_attendance"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = group_attendance.course_id)
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "Enable insert for authenticated users only"
|
|
on "public"."groupmember"
|
|
as permissive
|
|
for insert
|
|
to authenticated
|
|
with check (true);
|
|
|
|
|
|
create policy "Enable read access for all users"
|
|
on "public"."groupmember"
|
|
as permissive
|
|
for select
|
|
to public
|
|
using (true);
|
|
|
|
|
|
create policy "User must be an org member to DELETE"
|
|
on "public"."groupmember"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using (is_user_in_group_with_role(group_id));
|
|
|
|
|
|
create policy "User must be an org member to UPDATE"
|
|
on "public"."groupmember"
|
|
as permissive
|
|
for update
|
|
to public
|
|
using (is_user_in_group_with_role(group_id))
|
|
with check (is_user_in_group_with_role(group_id));
|
|
|
|
|
|
create policy "Enable read access for all users"
|
|
on "public"."lesson"
|
|
as permissive
|
|
for select
|
|
to public
|
|
using (true);
|
|
|
|
|
|
create policy "User must be an org member to DELETE"
|
|
on "public"."lesson"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = lesson.course_id)
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be an org member to INSERT"
|
|
on "public"."lesson"
|
|
as permissive
|
|
for insert
|
|
to public
|
|
with check (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = lesson.course_id)
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be an org member to UPDATE"
|
|
on "public"."lesson"
|
|
as permissive
|
|
for update
|
|
to public
|
|
using (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = lesson.course_id)
|
|
LIMIT 1)))
|
|
with check (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = lesson.course_id)
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "Delete only your own comment"
|
|
on "public"."lesson_comment"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using ((auth.uid() = ( SELECT groupmember.profile_id
|
|
FROM groupmember
|
|
WHERE (groupmember.id = lesson_comment.groupmember_id))));
|
|
|
|
|
|
create policy "Update only your own"
|
|
on "public"."lesson_comment"
|
|
as permissive
|
|
for update
|
|
to public
|
|
using ((auth.uid() = ( SELECT groupmember.profile_id
|
|
FROM groupmember
|
|
WHERE (groupmember.id = lesson_comment.groupmember_id))))
|
|
with check ((auth.uid() = ( SELECT groupmember.profile_id
|
|
FROM groupmember
|
|
WHERE (groupmember.id = lesson_comment.groupmember_id))));
|
|
|
|
|
|
create policy "User must be in course group to INSERT"
|
|
on "public"."lesson_comment"
|
|
as permissive
|
|
for insert
|
|
to public
|
|
with check (is_user_in_course_group(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = lesson_comment.lesson_id)
|
|
LIMIT 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "Enable read access for all users"
|
|
on "public"."lesson_completion"
|
|
as permissive
|
|
for select
|
|
to public
|
|
using (true);
|
|
|
|
|
|
create policy "User must be an course member to INSERT"
|
|
on "public"."lesson_completion"
|
|
as permissive
|
|
for all
|
|
to public
|
|
with check (is_user_in_course_group(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = lesson_completion.lesson_id)
|
|
LIMIT 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be an org member to DELETE"
|
|
on "public"."lesson_completion"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = lesson_completion.lesson_id)
|
|
LIMIT 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be an org member to UPDATE"
|
|
on "public"."lesson_completion"
|
|
as permissive
|
|
for update
|
|
to public
|
|
using (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = lesson_completion.lesson_id)
|
|
LIMIT 1))
|
|
LIMIT 1)))
|
|
with check (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = lesson_completion.lesson_id)
|
|
LIMIT 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "Enable read access for all users"
|
|
on "public"."lesson_language"
|
|
as permissive
|
|
for select
|
|
to public
|
|
using (true);
|
|
|
|
|
|
create policy "User must be an org member to DELETE"
|
|
on "public"."lesson_language"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = lesson_language.lesson_id)
|
|
LIMIT 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be an org member to INSERT"
|
|
on "public"."lesson_language"
|
|
as permissive
|
|
for insert
|
|
to public
|
|
with check (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = lesson_language.lesson_id)
|
|
LIMIT 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be an org member to UPDATE"
|
|
on "public"."lesson_language"
|
|
as permissive
|
|
for update
|
|
to public
|
|
using (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = lesson_language.lesson_id)
|
|
LIMIT 1))
|
|
LIMIT 1)))
|
|
with check (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = lesson_language.lesson_id)
|
|
LIMIT 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "Authenticated users can SELECT"
|
|
on "public"."lesson_language_history"
|
|
as permissive
|
|
for select
|
|
to public
|
|
using ((auth.uid() IS NOT NULL));
|
|
|
|
|
|
create policy "Allow authenticated users to SELECT"
|
|
on "public"."option"
|
|
as permissive
|
|
for select
|
|
to public
|
|
using ((auth.uid() IS NOT NULL));
|
|
|
|
|
|
create policy "User must be an org member to DELETE"
|
|
on "public"."option"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = ( SELECT exercise.lesson_id
|
|
FROM exercise
|
|
WHERE (exercise.id = ( SELECT question.exercise_id
|
|
FROM question
|
|
WHERE (question.id = option.question_id)
|
|
LIMIT 1))
|
|
LIMIT 1))
|
|
LIMIT 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be an org member to INSERT"
|
|
on "public"."option"
|
|
as permissive
|
|
for insert
|
|
to public
|
|
with check (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = ( SELECT exercise.lesson_id
|
|
FROM exercise
|
|
WHERE (exercise.id = ( SELECT question.exercise_id
|
|
FROM question
|
|
WHERE (question.id = option.question_id)
|
|
LIMIT 1))
|
|
LIMIT 1))
|
|
LIMIT 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be an org member to UPDATE"
|
|
on "public"."option"
|
|
as permissive
|
|
for update
|
|
to public
|
|
using (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = ( SELECT exercise.lesson_id
|
|
FROM exercise
|
|
WHERE (exercise.id = ( SELECT question.exercise_id
|
|
FROM question
|
|
WHERE (question.id = option.question_id)
|
|
LIMIT 1))
|
|
LIMIT 1))
|
|
LIMIT 1))
|
|
LIMIT 1)))
|
|
with check (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = ( SELECT exercise.lesson_id
|
|
FROM exercise
|
|
WHERE (exercise.id = ( SELECT question.exercise_id
|
|
FROM question
|
|
WHERE (question.id = option.question_id)
|
|
LIMIT 1))
|
|
LIMIT 1))
|
|
LIMIT 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "Authenticated users can delete"
|
|
on "public"."organization"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using ((auth.uid() IS NOT NULL));
|
|
|
|
|
|
create policy "Enable read access for all users"
|
|
on "public"."organization"
|
|
as permissive
|
|
for select
|
|
to public
|
|
using (true);
|
|
|
|
|
|
create policy "User must be an admin to INSERT"
|
|
on "public"."organization"
|
|
as permissive
|
|
for insert
|
|
to public
|
|
with check ((id = ( SELECT organizationmember.organization_id
|
|
FROM organizationmember
|
|
WHERE ((organizationmember.profile_id = ( SELECT auth.uid() AS uid)) AND (organizationmember.role_id = 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be an admin to UPDATE"
|
|
on "public"."organization"
|
|
as permissive
|
|
for update
|
|
to public
|
|
using ((id = ( SELECT organizationmember.organization_id
|
|
FROM organizationmember
|
|
WHERE ((organizationmember.profile_id = ( SELECT auth.uid() AS uid)) AND (organizationmember.role_id = 1))
|
|
LIMIT 1)))
|
|
with check ((id = ( SELECT organizationmember.organization_id
|
|
FROM organizationmember
|
|
WHERE ((organizationmember.profile_id = ( SELECT auth.uid() AS uid)) AND (organizationmember.role_id = 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be an org member to DELETE"
|
|
on "public"."organization_plan"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using (is_org_member());
|
|
|
|
|
|
create policy "User must be an org member to INSERT"
|
|
on "public"."organization_plan"
|
|
as permissive
|
|
for insert
|
|
to public
|
|
with check (is_org_member());
|
|
|
|
|
|
create policy "User must be an org member to SELECT"
|
|
on "public"."organization_plan"
|
|
as permissive
|
|
for select
|
|
to public
|
|
using (is_org_member());
|
|
|
|
|
|
create policy "User must be an org member to UPDATE"
|
|
on "public"."organization_plan"
|
|
as permissive
|
|
for update
|
|
to public
|
|
using (is_org_member())
|
|
with check (is_org_member());
|
|
|
|
|
|
create policy "Allow authenticated users to read."
|
|
on "public"."organizationmember"
|
|
as permissive
|
|
for select
|
|
to public
|
|
using ((auth.uid() = profile_id));
|
|
|
|
|
|
create policy "Enable insert for authenticated users only"
|
|
on "public"."organizationmember"
|
|
as permissive
|
|
for insert
|
|
to authenticated
|
|
with check (true);
|
|
|
|
|
|
create policy "Only admin can delete"
|
|
on "public"."organizationmember"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using (is_org_admin());
|
|
|
|
|
|
create policy "Only admin can update"
|
|
on "public"."organizationmember"
|
|
as permissive
|
|
for update
|
|
to public
|
|
using (is_org_admin())
|
|
with check (is_org_admin());
|
|
|
|
|
|
create policy "Only auth users can read profile"
|
|
on "public"."profile"
|
|
as permissive
|
|
for select
|
|
to authenticated, anon
|
|
using (true);
|
|
|
|
|
|
create policy "User can only delete their profiles"
|
|
on "public"."profile"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using ((auth.uid() = id));
|
|
|
|
|
|
create policy "Allow authenticated users to SELECT"
|
|
on "public"."question"
|
|
as permissive
|
|
for select
|
|
to public
|
|
using ((auth.uid() IS NOT NULL));
|
|
|
|
|
|
create policy "User must be an org member to DELETE"
|
|
on "public"."question"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = ( SELECT exercise.lesson_id
|
|
FROM exercise
|
|
WHERE (exercise.id = question.exercise_id)))
|
|
LIMIT 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be an org member to INSERT"
|
|
on "public"."question"
|
|
as permissive
|
|
for insert
|
|
to public
|
|
with check (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = ( SELECT exercise.lesson_id
|
|
FROM exercise
|
|
WHERE (exercise.id = question.exercise_id)))
|
|
LIMIT 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be an org member to UPDATE"
|
|
on "public"."question"
|
|
as permissive
|
|
for update
|
|
to public
|
|
using (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = ( SELECT exercise.lesson_id
|
|
FROM exercise
|
|
WHERE (exercise.id = question.exercise_id)))
|
|
LIMIT 1))
|
|
LIMIT 1)))
|
|
with check (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = ( SELECT exercise.lesson_id
|
|
FROM exercise
|
|
WHERE (exercise.id = question.exercise_id)))
|
|
LIMIT 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "Only authenticated users can select."
|
|
on "public"."question_answer"
|
|
as permissive
|
|
for select
|
|
to public
|
|
using ((auth.uid() IS NOT NULL));
|
|
|
|
|
|
create policy "User must be an org member to DELETE"
|
|
on "public"."question_answer"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = ( SELECT exercise.lesson_id
|
|
FROM exercise
|
|
WHERE (exercise.id = ( SELECT question.exercise_id
|
|
FROM question
|
|
WHERE (question.id = question_answer.question_id)
|
|
LIMIT 1))
|
|
LIMIT 1))
|
|
LIMIT 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be an org member to INSERT"
|
|
on "public"."question_answer"
|
|
as permissive
|
|
for insert
|
|
to public
|
|
with check (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = ( SELECT exercise.lesson_id
|
|
FROM exercise
|
|
WHERE (exercise.id = ( SELECT question.exercise_id
|
|
FROM question
|
|
WHERE (question.id = question_answer.question_id)
|
|
LIMIT 1))
|
|
LIMIT 1))
|
|
LIMIT 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be an org member to UPDATE"
|
|
on "public"."question_answer"
|
|
as permissive
|
|
for update
|
|
to public
|
|
using (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = ( SELECT exercise.lesson_id
|
|
FROM exercise
|
|
WHERE (exercise.id = ( SELECT question.exercise_id
|
|
FROM question
|
|
WHERE (question.id = question_answer.question_id)
|
|
LIMIT 1))
|
|
LIMIT 1))
|
|
LIMIT 1))
|
|
LIMIT 1)))
|
|
with check (is_user_in_group_with_role(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = ( SELECT lesson.course_id
|
|
FROM lesson
|
|
WHERE (lesson.id = ( SELECT exercise.lesson_id
|
|
FROM exercise
|
|
WHERE (exercise.id = ( SELECT question.exercise_id
|
|
FROM question
|
|
WHERE (question.id = question_answer.question_id)
|
|
LIMIT 1))
|
|
LIMIT 1))
|
|
LIMIT 1))
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "Enable read access for all users"
|
|
on "public"."question_type"
|
|
as permissive
|
|
for select
|
|
to public
|
|
using (true);
|
|
|
|
|
|
create policy "Authenticated users can SELECT"
|
|
on "public"."quiz"
|
|
as permissive
|
|
for select
|
|
to authenticated
|
|
using (true);
|
|
|
|
|
|
create policy "Authenticated users can SELECT"
|
|
on "public"."quiz_play"
|
|
as permissive
|
|
for select
|
|
to authenticated
|
|
using (true);
|
|
|
|
|
|
create policy "Enable read access for all users"
|
|
on "public"."role"
|
|
as permissive
|
|
for select
|
|
to public
|
|
using (true);
|
|
|
|
|
|
create policy "Only authenticated users can SELECT"
|
|
on "public"."submission"
|
|
as permissive
|
|
for select
|
|
to authenticated
|
|
using (true);
|
|
|
|
|
|
create policy "User must be a course member to DELETE"
|
|
on "public"."submission"
|
|
as permissive
|
|
for delete
|
|
to public
|
|
using (is_user_in_course_group(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = submission.course_id)
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be a course member to INSERT"
|
|
on "public"."submission"
|
|
as permissive
|
|
for insert
|
|
to public
|
|
with check (is_user_in_course_group(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = submission.course_id)
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "User must be a course member to UPDATE"
|
|
on "public"."submission"
|
|
as permissive
|
|
for update
|
|
to public
|
|
using (is_user_in_course_group(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = submission.course_id)
|
|
LIMIT 1)))
|
|
with check (is_user_in_course_group(( SELECT course.group_id
|
|
FROM course
|
|
WHERE (course.id = submission.course_id)
|
|
LIMIT 1)));
|
|
|
|
|
|
create policy "Authenticated users can SELECT"
|
|
on "public"."submissionstatus"
|
|
as permissive
|
|
for select
|
|
to authenticated
|
|
using (true);
|
|
|
|
alter table "public"."course" alter column "currency" set default 'USD'::character varying;
|