Agent Zero
102 lines
4.9 KiB
Python
102 lines
4.9 KiB
Python
"""Create entity_attachments table — references DMS files.
|
|
|
|
Instead of storing files in a separate attachment storage path,
|
|
all files go through the DMS (files table) and entity_attachments
|
|
just references the DMS file with entity_type/entity_id.
|
|
|
|
This unifies the storage layer: one upload path, one download path,
|
|
one permission model, one deduplication (content_hash).
|
|
|
|
Revision ID: 0071
|
|
Revises: 0070
|
|
"""
|
|
|
|
from alembic import op
|
|
import sqlalchemy as sa
|
|
from sqlalchemy.dialects.postgresql import UUID as PGUUID
|
|
|
|
revision = "0071"
|
|
down_revision = "0070"
|
|
branch_labels = None
|
|
depends_on = None
|
|
|
|
|
|
def upgrade() -> None:
|
|
# Create folders table if it doesn't exist (DMS plugin table normally created via create_all)
|
|
op.execute("""
|
|
CREATE TABLE IF NOT EXISTS folders (
|
|
id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
|
|
tenant_id UUID NOT NULL,
|
|
name VARCHAR(255) NOT NULL,
|
|
parent_id UUID REFERENCES folders(id) ON DELETE CASCADE,
|
|
owner_id UUID REFERENCES users(id) ON DELETE SET NULL,
|
|
created_by UUID NOT NULL,
|
|
created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
|
|
updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
|
|
deleted_at TIMESTAMP WITH TIME ZONE
|
|
)
|
|
""")
|
|
op.execute('CREATE INDEX IF NOT EXISTS ix_folders_parent ON folders (parent_id)')
|
|
op.execute('CREATE INDEX IF NOT EXISTS ix_folders_tenant ON folders (tenant_id)')
|
|
|
|
# Create files table if it doesn't exist (DMS plugin table normally created via create_all)
|
|
op.execute("""
|
|
CREATE TABLE IF NOT EXISTS files (
|
|
id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
|
|
tenant_id UUID NOT NULL,
|
|
name VARCHAR(255) NOT NULL,
|
|
folder_id UUID REFERENCES folders(id) ON DELETE SET NULL,
|
|
owner_id UUID REFERENCES users(id) ON DELETE SET NULL,
|
|
uploaded_by UUID NOT NULL,
|
|
mime_type VARCHAR(255) NOT NULL,
|
|
size_bytes INTEGER NOT NULL,
|
|
storage_path VARCHAR(1024) NOT NULL,
|
|
content_hash VARCHAR(64),
|
|
created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
|
|
updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
|
|
deleted_at TIMESTAMP WITH TIME ZONE
|
|
)
|
|
""")
|
|
op.execute('CREATE INDEX IF NOT EXISTS ix_files_folder ON files (folder_id)')
|
|
op.execute('CREATE INDEX IF NOT EXISTS ix_files_tenant ON files (tenant_id)')
|
|
op.execute('CREATE INDEX IF NOT EXISTS ix_files_name ON files (name)')
|
|
|
|
op.create_table(
|
|
"entity_attachments",
|
|
sa.Column("id", PGUUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
|
|
sa.Column("tenant_id", PGUUID(as_uuid=True), sa.ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False),
|
|
sa.Column("entity_type", sa.String(50), nullable=False),
|
|
sa.Column("entity_id", PGUUID(as_uuid=True), nullable=False),
|
|
sa.Column("dms_file_id", PGUUID(as_uuid=True), sa.ForeignKey("files.id", ondelete="RESTRICT"), nullable=False),
|
|
sa.Column("category", sa.String(50), nullable=True),
|
|
sa.Column("display_name", sa.String(255), nullable=True),
|
|
sa.Column("owner_id", PGUUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
|
|
sa.Column("created_by", PGUUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
|
|
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
|
|
sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.text("NOW()"), nullable=False),
|
|
sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
|
|
)
|
|
|
|
op.execute('CREATE INDEX IF NOT EXISTS ix_entity_attachments_entity ON entity_attachments (entity_type, entity_id, tenant_id)')
|
|
op.execute('CREATE INDEX IF NOT EXISTS ix_entity_attachments_tenant ON entity_attachments (tenant_id)')
|
|
op.execute('CREATE INDEX IF NOT EXISTS ix_entity_attachments_dms_file ON entity_attachments (dms_file_id)')
|
|
op.execute('CREATE INDEX IF NOT EXISTS ix_entity_attachments_owner ON entity_attachments (owner_id)')
|
|
|
|
# Enable RLS on entity_attachments (tenant isolation)
|
|
op.execute("ALTER TABLE entity_attachments ENABLE ROW LEVEL SECURITY")
|
|
op.execute(
|
|
"CREATE POLICY entity_attachments_tenant_isolation ON entity_attachments "
|
|
"FOR ALL "
|
|
"USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid) "
|
|
"WITH CHECK (tenant_id = current_setting('app.current_tenant_id', true)::uuid)"
|
|
)
|
|
|
|
# Grant to crm_api and crm_worker
|
|
op.execute("GRANT SELECT, INSERT, UPDATE, DELETE ON entity_attachments TO crm_api, crm_worker")
|
|
op.execute("GRANT USAGE ON SCHEMA public TO crm_api, crm_worker")
|
|
|
|
|
|
def downgrade() -> None:
|
|
op.execute("DROP POLICY IF EXISTS entity_attachments_tenant_isolation ON entity_attachments")
|
|
op.drop_table("entity_attachments")
|