feat(billing): multi-user paywall: multi_user capability, 20-day grace, owner-only dormancy (#2099)
* feat(billing): multi-user seat gate: multi_user capability, 20-day grace, owner-only dormancy Multiple people in one company becomes a paid capability (multi_user, the eighth PAID key). Derived at access time from capability_grants, no status column, no enforcement cron: - entitled: active grant (trial/stripe/team/manual/comp), everyone works - grace: newest grant expired < 20 days ago; countdown banner for everyone in companies with > 1 user; invites still allowed - frozen: only role=owner resolves; other memberships go dormant (rows untouched, paying reactivates instantly); invites 403 with paid-plan upsell Enforcement: new resolve_active_company_gated RPC (zero-arg RPC and RLS twin untouched: they also run on self-hosts, where the gate never bites), gated query fallback for service-role/API-key paths, setActiveCompany guard, MCP company-access check, invite route. Middleware routes all-frozen users to a new /paused page; the switcher greys locked companies. Migration 20260901081417 (applied to staging): trial trigger seeds multi_user, backfills for mid-trial companies, active Stripe subs, team agreements, and a grandfather grant (expires now, i.e. grace = deploy + 20 days) for existing unpaid multi-member companies. Daily cron mails owners at grace start and last day. Strings in sv+en; pg-real + unit tests included. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L4tNt8wRG3a5iuU1JE2pnP * fix(billing): multi-user seat gate hardening from skeptic review - Stripe cancel now EXPIRES the multi_user stripe grant instead of deleting it: the 20-day grace window hangs on an expired row, so a deleted one froze churned payers' staff instantly with no banner and no mail. Other stripe grants keep the freeze-and-retain delete. - New SECURITY DEFINER company_multi_user_state() RPC (migration 20260901083726, applied to staging) and RPC-first getMultiUserState: capability_grants RLS hides team-scoped rows from non-team users, so user-client reads misread byra-covered companies as frozen (switch refusal, wrong switcher locks). - Byra-kind teams get a standing team-scoped multi_user grant (backfill + teams trigger): byra client companies have no company-scoped trial by design, so a grantless byra team would freeze every consultant and client user. - Comped/manual companies with active PAID-key grants extend to multi_user (a comped company must not read as paying while locking out user two). - /api/v1 gets the same dormancy gate as MCP (frozen non-owner -> 403). - PGRST202 on resolution fails OPEN (pre-migration DB has zero multi_user rows; the gated fallback would have frozen every non-owner mid-deploy). - Grace cron: covers team-scoped lapses (byra agreement ending) and skips the start mail for the hand-mailed grandfather cohort. - Tests updated/added across all touched surfaces; pg tests for the new RPC and byra trigger; trial-suppression pg test extended to 8 keys. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L4tNt8wRG3a5iuU1JE2pnP * fix(billing): decouple seat-gate env check and fail open on gate read throws CI round 1 on #2099: - isMultiUserEnforced no longer imports has-capability: several route test suites partially mock that module and the vitest mock guard threw from inside the v1 seat gate, turning expected 4xx responses into 500s. multi_user is never a connector capability, so the bypass reduces to the same env reads, now inlined. - getMultiUserState wraps its resolution in a fail-open try/catch: a client without .rpc or a thrown network error must never lock users out. - no-phantom-columns ceiling 391 -> 393 with reasons: the seat gate's .or() scope filter (server-resolved UUIDs) and the Stripe cancel expiry update's timestamp .or(); all columns in both strings are literals. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L4tNt8wRG3a5iuU1JE2pnP * fix(billing): membership-guard the multi-user entitlement RPCs (Superagent P3) company_multi_user_ok and company_multi_user_state are SECURITY DEFINER and were granted to authenticated with a caller-supplied company UUID: any logged-in user could probe an arbitrary company's billing state and grace deadline across tenants. Migration 20260901091752 (applied to staging) requires an auth.uid() membership in the target company when a JWT is present, keeps service-role/definer contexts unrestricted, and clamps the grace window to [0, 20] days. pg tests: stranger gets false/NULL, member reads normally, oversized p_grace_days cannot widen the probe. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L4tNt8wRG3a5iuU1JE2pnP --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Mattsson
co-authored by
Claude Fable 5
Claude Fable 5
parent
ca12b1855e
commit
aabddb592f
@@ -0,0 +1,246 @@
|
||||
-- Multi-user paywall: the `multi_user` capability (founder decision 2026-09-01).
|
||||
--
|
||||
-- Multiple people working in one company becomes a PAID capability. The rule
|
||||
-- (lib/entitlements/multi-user-state.ts is the TS twin; keep them aligned):
|
||||
--
|
||||
-- entitled : an active multi_user grant (trial/stripe/team/manual/comp).
|
||||
-- grace : the newest grant expired less than p_grace_days (20) ago.
|
||||
-- Everyone still works; the app shows a countdown banner.
|
||||
-- frozen : lapsed >= 20 days ago (or never granted). Only role = 'owner'
|
||||
-- memberships resolve; every other membership is dormant. Rows
|
||||
-- are NEVER deleted: paying reactivates everyone instantly.
|
||||
--
|
||||
-- Enforcement is derived at resolution time (no status column, no cron):
|
||||
-- resolve_active_company_gated() below is the gated twin of
|
||||
-- resolve_active_company() (20260723161000). The zero-arg function and
|
||||
-- current_active_company_id() are deliberately UNTOUCHED:
|
||||
-- - they also run on self-hosted instances, where the seat gate must never
|
||||
-- bite (multi_user is a local capability there; the app only calls the
|
||||
-- gated function when lib/entitlements isMultiUserEnforced() is true);
|
||||
-- - current_active_company_id() (RLS side) converges via the middleware
|
||||
-- write-back: when the preference points at a frozen company the gated
|
||||
-- function reports used_fallback = true, middleware persists the
|
||||
-- accessible company to user_preferences, and RLS follows. During the
|
||||
-- one-request window before the write-back the app never serves the
|
||||
-- frozen company anyway (resolution is the only source of companyId).
|
||||
--
|
||||
-- Also in this migration:
|
||||
-- - seed_trial_capability_grants() learns the eighth key ('multi_user').
|
||||
-- - Backfills so existing companies land in the right state at deploy:
|
||||
-- mid-trial -> trial grant, active Stripe subs -> stripe grant, teams
|
||||
-- with active agreements -> team grant, and every other non-archived
|
||||
-- company with more than one member -> a 'manual' grant expiring NOW,
|
||||
-- which starts their 20-day grace window at deploy time (the
|
||||
-- grandfather cohort; metadata.reason = 'multi_user_grandfather').
|
||||
|
||||
-- =============================================================================
|
||||
-- 1. company_multi_user_ok(company, grace_days): entitled-or-in-grace check
|
||||
-- =============================================================================
|
||||
-- True while the company may have several active people: an unexpired
|
||||
-- multi_user grant (company- or team-scoped), or one that expired less than
|
||||
-- p_grace_days ago. Never granted => false. company_capability_config is
|
||||
-- deliberately NOT consulted: a config disable has no expiry to hang the
|
||||
-- grace window on, and member access must not freeze through a side channel.
|
||||
CREATE OR REPLACE FUNCTION public.company_multi_user_ok(p_company_id uuid, p_grace_days integer)
|
||||
RETURNS boolean
|
||||
LANGUAGE sql
|
||||
STABLE SECURITY DEFINER
|
||||
SET search_path TO 'public'
|
||||
AS $function$
|
||||
SELECT EXISTS (
|
||||
SELECT 1
|
||||
FROM public.capability_grants cg
|
||||
WHERE cg.capability_key = 'multi_user'
|
||||
AND (
|
||||
cg.company_id = p_company_id
|
||||
OR cg.team_id = (SELECT c.team_id FROM public.companies c WHERE c.id = p_company_id)
|
||||
)
|
||||
AND (
|
||||
cg.expires_at IS NULL
|
||||
OR cg.expires_at > now() - make_interval(days => GREATEST(p_grace_days, 0))
|
||||
)
|
||||
);
|
||||
$function$;
|
||||
|
||||
REVOKE ALL ON FUNCTION public.company_multi_user_ok(uuid, integer) FROM PUBLIC, anon;
|
||||
GRANT EXECUTE ON FUNCTION public.company_multi_user_ok(uuid, integer) TO authenticated, service_role;
|
||||
|
||||
-- =============================================================================
|
||||
-- 2. resolve_active_company_gated(grace_days): the seat-gated resolution
|
||||
-- =============================================================================
|
||||
-- Semantics of resolve_active_company() (20260723161000) with one added
|
||||
-- predicate: a membership resolves only when the caller is the company's
|
||||
-- owner or the company passes company_multi_user_ok(). Keep everything else
|
||||
-- IDENTICAL to the zero-arg function (resolution order, NULL auth.uid()
|
||||
-- behavior, no writes); see its header for the invariants.
|
||||
--
|
||||
-- has_locked_membership is computed only when nothing resolved: it tells the
|
||||
-- caller "this user has companies, but every one of them is frozen for them"
|
||||
-- so middleware can route to the paused page instead of onboarding.
|
||||
CREATE OR REPLACE FUNCTION public.resolve_active_company_gated(p_grace_days integer)
|
||||
RETURNS TABLE(company_id uuid, locale text, used_fallback boolean, has_locked_membership boolean)
|
||||
LANGUAGE sql
|
||||
STABLE SECURITY DEFINER
|
||||
SET search_path TO 'public'
|
||||
AS $function$
|
||||
WITH pref AS (
|
||||
SELECT up.active_company_id, up.locale
|
||||
FROM public.user_preferences up
|
||||
WHERE up.user_id = auth.uid()
|
||||
),
|
||||
validated AS (
|
||||
SELECT cm.company_id
|
||||
FROM pref p
|
||||
JOIN public.company_members cm
|
||||
ON cm.user_id = auth.uid() AND cm.company_id = p.active_company_id
|
||||
JOIN public.companies c
|
||||
ON c.id = cm.company_id AND c.archived_at IS NULL
|
||||
WHERE cm.role = 'owner' OR public.company_multi_user_ok(cm.company_id, p_grace_days)
|
||||
LIMIT 1
|
||||
),
|
||||
fallback AS (
|
||||
SELECT cm.company_id
|
||||
FROM public.company_members cm
|
||||
JOIN public.companies c
|
||||
ON c.id = cm.company_id AND c.archived_at IS NULL
|
||||
WHERE cm.user_id = auth.uid()
|
||||
AND (cm.role = 'owner' OR public.company_multi_user_ok(cm.company_id, p_grace_days))
|
||||
ORDER BY cm.created_at ASC
|
||||
LIMIT 1
|
||||
),
|
||||
resolved AS (
|
||||
SELECT COALESCE(
|
||||
(SELECT v.company_id FROM validated v),
|
||||
(SELECT f.company_id FROM fallback f)
|
||||
) AS company_id
|
||||
)
|
||||
SELECT
|
||||
(SELECT r.company_id FROM resolved r) AS company_id,
|
||||
(SELECT p.locale FROM pref p) AS locale,
|
||||
((SELECT v.company_id FROM validated v) IS NULL) AS used_fallback,
|
||||
CASE
|
||||
WHEN (SELECT r.company_id FROM resolved r) IS NOT NULL THEN false
|
||||
ELSE EXISTS (
|
||||
SELECT 1
|
||||
FROM public.company_members cm
|
||||
JOIN public.companies c ON c.id = cm.company_id AND c.archived_at IS NULL
|
||||
WHERE cm.user_id = auth.uid()
|
||||
AND cm.role <> 'owner'
|
||||
AND NOT public.company_multi_user_ok(cm.company_id, p_grace_days)
|
||||
)
|
||||
END AS has_locked_membership
|
||||
WHERE auth.uid() IS NOT NULL;
|
||||
$function$;
|
||||
|
||||
REVOKE ALL ON FUNCTION public.resolve_active_company_gated(integer) FROM PUBLIC, anon;
|
||||
GRANT EXECUTE ON FUNCTION public.resolve_active_company_gated(integer) TO authenticated;
|
||||
|
||||
-- =============================================================================
|
||||
-- 3. Trial seeding: the eighth key
|
||||
-- =============================================================================
|
||||
-- Replaces ONLY the function body (same shape as 20260826130300): the byrå
|
||||
-- suppression stays, the VALUES list grows by 'multi_user'. Keep in step with
|
||||
-- lib/entitlements/keys.ts PAID_CAPABILITIES.
|
||||
CREATE OR REPLACE FUNCTION public.seed_trial_capability_grants()
|
||||
RETURNS trigger
|
||||
LANGUAGE plpgsql
|
||||
SECURITY DEFINER
|
||||
SET search_path = public
|
||||
AS $$
|
||||
BEGIN
|
||||
-- Byrå-team companies are covered by the team's agreement (WL-10):
|
||||
-- no company-scoped trial, so no trial-expiry noise toward byrå clients.
|
||||
IF NEW.team_id IS NOT NULL AND EXISTS (
|
||||
SELECT 1 FROM public.teams t
|
||||
WHERE t.id = NEW.team_id
|
||||
AND t.kind = 'byra'
|
||||
) THEN
|
||||
RETURN NEW;
|
||||
END IF;
|
||||
|
||||
-- Full PAID set as of 20260901081417; keep this VALUES list in step with
|
||||
-- lib/entitlements/keys.ts PAID_CAPABILITIES whenever a key is added.
|
||||
INSERT INTO public.capability_grants (company_id, capability_key, source, expires_at)
|
||||
SELECT NEW.id, k.key, 'trial', NEW.created_at + interval '30 days'
|
||||
FROM (VALUES
|
||||
('ai'),
|
||||
('bank_sync'),
|
||||
('skatteverket'),
|
||||
('email_send'),
|
||||
('stripe_payments'),
|
||||
('woocommerce_sync'),
|
||||
('shopify_sync'),
|
||||
('multi_user')
|
||||
) AS k(key)
|
||||
ON CONFLICT (company_id, team_id, capability_key, source) DO NOTHING;
|
||||
RETURN NEW;
|
||||
END;
|
||||
$$;
|
||||
|
||||
-- =============================================================================
|
||||
-- 4. Backfills (idempotent: ON CONFLICT DO NOTHING against the scope index)
|
||||
-- =============================================================================
|
||||
|
||||
-- 4a. Every trial-seeded company gets a multi_user trial row matching its
|
||||
-- trial expiry, expired trials included: "the trial always covered
|
||||
-- multi_user". Mid-trial companies stay fully entitled; long-expired ones
|
||||
-- read as frozen exactly like a never-granted company, and the recently
|
||||
-- expired land in whatever grace their trial end implies (4d then guarantees
|
||||
-- multi-member companies a full window from deploy).
|
||||
INSERT INTO public.capability_grants (company_id, capability_key, source, expires_at)
|
||||
SELECT cg.company_id, 'multi_user', 'trial', max(cg.expires_at)
|
||||
FROM public.capability_grants cg
|
||||
WHERE cg.source = 'trial'
|
||||
AND cg.company_id IS NOT NULL
|
||||
AND cg.expires_at IS NOT NULL
|
||||
GROUP BY cg.company_id
|
||||
ON CONFLICT (company_id, team_id, capability_key, source) DO NOTHING;
|
||||
|
||||
-- 4b. Companies with a live Stripe subscription: same shape the webhook sync
|
||||
-- writes (source = 'stripe', period end + 3 days slack; see
|
||||
-- lib/stripe/subscription-sync.ts). The next webhook upserts over this.
|
||||
INSERT INTO public.capability_grants (company_id, capability_key, source, expires_at, metadata)
|
||||
SELECT cs.company_id, 'multi_user', 'stripe',
|
||||
cs.current_period_end + interval '3 days',
|
||||
jsonb_build_object('backfill', 'multi_user_launch')
|
||||
FROM public.company_subscriptions cs
|
||||
WHERE cs.status IN ('active', 'trialing', 'past_due')
|
||||
AND cs.current_period_end IS NOT NULL
|
||||
ON CONFLICT (company_id, team_id, capability_key, source) DO NOTHING;
|
||||
|
||||
-- 4c. Teams holding any active grant (byrå partner agreements) extend to
|
||||
-- multi_user at team scope, so one paying byrå keeps covering all its client
|
||||
-- companies. NULL expiry wins when any of the team's active grants never
|
||||
-- expires.
|
||||
INSERT INTO public.capability_grants (team_id, capability_key, source, expires_at, metadata)
|
||||
SELECT cg.team_id, 'multi_user', 'manual',
|
||||
CASE WHEN bool_or(cg.expires_at IS NULL) THEN NULL ELSE max(cg.expires_at) END,
|
||||
jsonb_build_object('backfill', 'multi_user_launch')
|
||||
FROM public.capability_grants cg
|
||||
WHERE cg.team_id IS NOT NULL
|
||||
GROUP BY cg.team_id
|
||||
HAVING bool_or(cg.expires_at IS NULL OR cg.expires_at > now())
|
||||
ON CONFLICT (company_id, team_id, capability_key, source) DO NOTHING;
|
||||
|
||||
-- 4d. Grandfather cohort: every remaining non-archived company with more
|
||||
-- than one member gets a grant expiring NOW, which puts it in grace until
|
||||
-- deploy + 20 days. Owners are mailed the freeze date out-of-band; the app
|
||||
-- shows the countdown banner from the first render after deploy.
|
||||
INSERT INTO public.capability_grants (company_id, capability_key, source, expires_at, metadata)
|
||||
SELECT c.id, 'multi_user', 'manual', now(),
|
||||
jsonb_build_object('reason', 'multi_user_grandfather')
|
||||
FROM public.companies c
|
||||
WHERE c.archived_at IS NULL
|
||||
AND (SELECT count(*) FROM public.company_members cm WHERE cm.company_id = c.id) > 1
|
||||
AND NOT EXISTS (
|
||||
SELECT 1 FROM public.capability_grants g
|
||||
WHERE g.capability_key = 'multi_user'
|
||||
AND (
|
||||
g.company_id = c.id
|
||||
OR (c.team_id IS NOT NULL AND g.team_id = c.team_id)
|
||||
)
|
||||
AND (g.expires_at IS NULL OR g.expires_at > now())
|
||||
)
|
||||
ON CONFLICT (company_id, team_id, capability_key, source) DO NOTHING;
|
||||
|
||||
NOTIFY pgrst, 'reload schema';
|
||||
@@ -0,0 +1,119 @@
|
||||
-- Multi-user paywall hardening (skeptic findings on 20260901081417):
|
||||
--
|
||||
-- 1. company_multi_user_state(): state-returning SECURITY DEFINER twin of
|
||||
-- company_multi_user_ok. The capability_grants SELECT policy hides
|
||||
-- team-scoped rows from users who are not on the team (byrå clients by
|
||||
-- design, WL-08), so any app-side read through a user-scoped client
|
||||
-- misreads a team-covered company as frozen. All app-side state checks go
|
||||
-- through this function first; the raw grants read stays only as the
|
||||
-- fallback for not-yet-migrated databases.
|
||||
-- 2. Byrå teams get a standing team-scoped multi_user grant (backfill +
|
||||
-- trigger): the codebase's WL-10 assumption is that byrå client companies
|
||||
-- are entitled via the team agreement (their company-scoped trial is
|
||||
-- deliberately suppressed), so a byrå team without grant rows would
|
||||
-- freeze every consultant and client user. Billing for byrå partners is
|
||||
-- out-of-band (partner agreement), matching seed_trial_capability_grants'
|
||||
-- suppression rationale.
|
||||
-- 3. Comped/manual companies (active company-scoped comp/manual grants on
|
||||
-- the pre-existing PAID keys) extend to multi_user: a hand-comped
|
||||
-- multi-member company must not read as paying while locking out its
|
||||
-- second user.
|
||||
|
||||
-- ============================================================================
|
||||
-- 1. company_multi_user_state(company, grace_days)
|
||||
-- ============================================================================
|
||||
CREATE OR REPLACE FUNCTION public.company_multi_user_state(p_company_id uuid, p_grace_days integer)
|
||||
RETURNS TABLE(state text, grace_ends_at timestamptz)
|
||||
LANGUAGE sql
|
||||
STABLE SECURITY DEFINER
|
||||
SET search_path TO 'public'
|
||||
AS $function$
|
||||
WITH grant_rows AS (
|
||||
SELECT cg.expires_at
|
||||
FROM public.capability_grants cg
|
||||
WHERE cg.capability_key = 'multi_user'
|
||||
AND (
|
||||
cg.company_id = p_company_id
|
||||
OR cg.team_id = (SELECT c.team_id FROM public.companies c WHERE c.id = p_company_id)
|
||||
)
|
||||
),
|
||||
agg AS (
|
||||
SELECT
|
||||
COALESCE(bool_or(gr.expires_at IS NULL OR gr.expires_at > now()), false) AS entitled,
|
||||
max(gr.expires_at) AS newest_expiry
|
||||
FROM grant_rows gr
|
||||
)
|
||||
SELECT
|
||||
CASE
|
||||
WHEN a.entitled THEN 'entitled'
|
||||
WHEN a.newest_expiry IS NOT NULL
|
||||
AND a.newest_expiry + make_interval(days => GREATEST(p_grace_days, 0)) > now() THEN 'grace'
|
||||
ELSE 'frozen'
|
||||
END AS state,
|
||||
CASE
|
||||
WHEN NOT a.entitled
|
||||
AND a.newest_expiry IS NOT NULL
|
||||
AND a.newest_expiry + make_interval(days => GREATEST(p_grace_days, 0)) > now()
|
||||
THEN a.newest_expiry + make_interval(days => GREATEST(p_grace_days, 0))
|
||||
ELSE NULL
|
||||
END AS grace_ends_at
|
||||
FROM agg a;
|
||||
$function$;
|
||||
|
||||
REVOKE ALL ON FUNCTION public.company_multi_user_state(uuid, integer) FROM PUBLIC, anon;
|
||||
GRANT EXECUTE ON FUNCTION public.company_multi_user_state(uuid, integer) TO authenticated, service_role;
|
||||
|
||||
-- ============================================================================
|
||||
-- 2. Byrå team standing grant: backfill + trigger for future teams
|
||||
-- ============================================================================
|
||||
INSERT INTO public.capability_grants (team_id, capability_key, source, expires_at, metadata)
|
||||
SELECT t.id, 'multi_user', 'manual', NULL,
|
||||
jsonb_build_object('reason', 'byra_team_default')
|
||||
FROM public.teams t
|
||||
WHERE t.kind = 'byra'
|
||||
AND NOT EXISTS (
|
||||
SELECT 1 FROM public.capability_grants g
|
||||
WHERE g.team_id = t.id
|
||||
AND g.capability_key = 'multi_user'
|
||||
AND (g.expires_at IS NULL OR g.expires_at > now())
|
||||
)
|
||||
ON CONFLICT (company_id, team_id, capability_key, source) DO NOTHING;
|
||||
|
||||
CREATE OR REPLACE FUNCTION public.seed_byra_team_multi_user()
|
||||
RETURNS trigger
|
||||
LANGUAGE plpgsql
|
||||
SECURITY DEFINER
|
||||
SET search_path = public
|
||||
AS $$
|
||||
BEGIN
|
||||
IF NEW.kind = 'byra' THEN
|
||||
INSERT INTO public.capability_grants (team_id, capability_key, source, expires_at, metadata)
|
||||
VALUES (NEW.id, 'multi_user', 'manual', NULL, jsonb_build_object('reason', 'byra_team_default'))
|
||||
ON CONFLICT (company_id, team_id, capability_key, source) DO NOTHING;
|
||||
END IF;
|
||||
RETURN NEW;
|
||||
END;
|
||||
$$;
|
||||
|
||||
DROP TRIGGER IF EXISTS trg_seed_byra_team_multi_user ON public.teams;
|
||||
CREATE TRIGGER trg_seed_byra_team_multi_user
|
||||
AFTER INSERT OR UPDATE OF kind ON public.teams
|
||||
FOR EACH ROW EXECUTE FUNCTION public.seed_byra_team_multi_user();
|
||||
|
||||
-- ============================================================================
|
||||
-- 3. Comped/manual companies extend to multi_user
|
||||
-- ============================================================================
|
||||
INSERT INTO public.capability_grants (company_id, capability_key, source, expires_at, metadata)
|
||||
SELECT cg.company_id, 'multi_user', 'comp',
|
||||
CASE WHEN bool_or(cg.expires_at IS NULL) THEN NULL ELSE max(cg.expires_at) END,
|
||||
jsonb_build_object('backfill', 'multi_user_launch_comp')
|
||||
FROM public.capability_grants cg
|
||||
WHERE cg.company_id IS NOT NULL
|
||||
AND cg.source IN ('comp', 'manual')
|
||||
AND cg.capability_key IN
|
||||
('ai', 'bank_sync', 'skatteverket', 'email_send', 'stripe_payments', 'woocommerce_sync', 'shopify_sync')
|
||||
GROUP BY cg.company_id
|
||||
HAVING bool_or(cg.expires_at IS NULL OR cg.expires_at > now())
|
||||
ON CONFLICT (company_id, team_id, capability_key, source) DO NOTHING;
|
||||
|
||||
NOTIFY pgrst, 'reload schema';
|
||||
@@ -0,0 +1,94 @@
|
||||
-- Membership guard on the multi-user entitlement helpers (Superagent P3 on
|
||||
-- PR #2099): both SECURITY DEFINER functions took a caller-supplied company
|
||||
-- UUID and were granted to `authenticated`, so any logged-in user could probe
|
||||
-- an arbitrary company's billing state (entitled/grace/frozen + deadline)
|
||||
-- across tenants. Both now require the caller to be a member of the company
|
||||
-- when a JWT is present; service-role/definer contexts (auth.uid() IS NULL)
|
||||
-- keep unrestricted behavior for trusted server callers. The grace window is
|
||||
-- also clamped to [0, 20] days so the parameter cannot widen the probe.
|
||||
--
|
||||
-- Non-member outcomes: company_multi_user_ok returns false;
|
||||
-- company_multi_user_state returns its row with a NULL state (callers treat
|
||||
-- only 'entitled'/'grace'/'frozen' as answers). Every legitimate caller
|
||||
-- passes: the app only ever asks about companies the user is a member of,
|
||||
-- and resolve_active_company_gated only evaluates the caller's own
|
||||
-- membership rows.
|
||||
|
||||
CREATE OR REPLACE FUNCTION public.company_multi_user_ok(p_company_id uuid, p_grace_days integer)
|
||||
RETURNS boolean
|
||||
LANGUAGE sql
|
||||
STABLE SECURITY DEFINER
|
||||
SET search_path TO 'public'
|
||||
AS $function$
|
||||
SELECT
|
||||
(
|
||||
auth.uid() IS NULL
|
||||
OR EXISTS (
|
||||
SELECT 1 FROM public.company_members cm
|
||||
WHERE cm.company_id = p_company_id AND cm.user_id = auth.uid()
|
||||
)
|
||||
)
|
||||
AND EXISTS (
|
||||
SELECT 1
|
||||
FROM public.capability_grants cg
|
||||
WHERE cg.capability_key = 'multi_user'
|
||||
AND (
|
||||
cg.company_id = p_company_id
|
||||
OR cg.team_id = (SELECT c.team_id FROM public.companies c WHERE c.id = p_company_id)
|
||||
)
|
||||
AND (
|
||||
cg.expires_at IS NULL
|
||||
OR cg.expires_at > now() - make_interval(days => LEAST(GREATEST(p_grace_days, 0), 20))
|
||||
)
|
||||
);
|
||||
$function$;
|
||||
|
||||
CREATE OR REPLACE FUNCTION public.company_multi_user_state(p_company_id uuid, p_grace_days integer)
|
||||
RETURNS TABLE(state text, grace_ends_at timestamptz)
|
||||
LANGUAGE sql
|
||||
STABLE SECURITY DEFINER
|
||||
SET search_path TO 'public'
|
||||
AS $function$
|
||||
WITH allowed AS (
|
||||
SELECT
|
||||
auth.uid() IS NULL
|
||||
OR EXISTS (
|
||||
SELECT 1 FROM public.company_members cm
|
||||
WHERE cm.company_id = p_company_id AND cm.user_id = auth.uid()
|
||||
) AS ok
|
||||
),
|
||||
grant_rows AS (
|
||||
SELECT cg.expires_at
|
||||
FROM public.capability_grants cg
|
||||
WHERE cg.capability_key = 'multi_user'
|
||||
AND (
|
||||
cg.company_id = p_company_id
|
||||
OR cg.team_id = (SELECT c.team_id FROM public.companies c WHERE c.id = p_company_id)
|
||||
)
|
||||
),
|
||||
agg AS (
|
||||
SELECT
|
||||
COALESCE(bool_or(gr.expires_at IS NULL OR gr.expires_at > now()), false) AS entitled,
|
||||
max(gr.expires_at) AS newest_expiry
|
||||
FROM grant_rows gr
|
||||
)
|
||||
SELECT
|
||||
CASE
|
||||
WHEN NOT al.ok THEN NULL
|
||||
WHEN a.entitled THEN 'entitled'
|
||||
WHEN a.newest_expiry IS NOT NULL
|
||||
AND a.newest_expiry + make_interval(days => LEAST(GREATEST(p_grace_days, 0), 20)) > now() THEN 'grace'
|
||||
ELSE 'frozen'
|
||||
END AS state,
|
||||
CASE
|
||||
WHEN al.ok
|
||||
AND NOT a.entitled
|
||||
AND a.newest_expiry IS NOT NULL
|
||||
AND a.newest_expiry + make_interval(days => LEAST(GREATEST(p_grace_days, 0), 20)) > now()
|
||||
THEN a.newest_expiry + make_interval(days => LEAST(GREATEST(p_grace_days, 0), 20))
|
||||
ELSE NULL
|
||||
END AS grace_ends_at
|
||||
FROM agg a, allowed al;
|
||||
$function$;
|
||||
|
||||
NOTIFY pgrst, 'reload schema';
|
||||
Reference in New Issue
Block a user