New Base func

supabase/migrations/20240101000013_document_archive.sql

@@ -0,0 +1,63 @@
+-- Migration 13: Document Archive
+-- WORM-style document storage with hash integrity and version chain
+
+-- =============================================================================
+-- 1. document_attachments table
+-- =============================================================================
+CREATE TABLE public.document_attachments (
+  id                    uuid PRIMARY KEY DEFAULT uuid_generate_v4(),
+  user_id               uuid REFERENCES auth.users ON DELETE CASCADE NOT NULL,
+
+  -- Storage
+  storage_path          text NOT NULL,
+  file_name             text NOT NULL,
+  file_size_bytes       bigint,
+  mime_type             text,
+
+  -- Integrity
+  sha256_hash           text NOT NULL,
+
+  -- Version chain (WORM: Write Once, Read Many)
+  version               integer NOT NULL DEFAULT 1,
+  original_id           uuid REFERENCES public.document_attachments(id) ON DELETE SET NULL,
+  superseded_by_id      uuid REFERENCES public.document_attachments(id) ON DELETE SET NULL,
+  is_current_version    boolean NOT NULL DEFAULT true,
+
+  -- Digitization metadata
+  uploaded_by           uuid REFERENCES auth.users ON DELETE SET NULL,
+  upload_source         text CHECK (upload_source IN (
+    'camera', 'file_upload', 'email', 'e_invoice', 'scan', 'api', 'system'
+  )),
+  digitization_date     timestamptz DEFAULT now(),
+
+  -- Linkage to journal entries (ON DELETE RESTRICT prevents deletion of linked entries)
+  journal_entry_id      uuid REFERENCES public.journal_entries(id) ON DELETE RESTRICT,
+  journal_entry_line_id uuid REFERENCES public.journal_entry_lines(id) ON DELETE RESTRICT,
+
+  created_at            timestamptz NOT NULL DEFAULT now(),
+  updated_at            timestamptz NOT NULL DEFAULT now()
+);
+
+ALTER TABLE public.document_attachments ENABLE ROW LEVEL SECURITY;
+
+-- RLS: select, insert, update for owner. NO DELETE policy (handled by trigger).
+CREATE POLICY "document_attachments_select" ON public.document_attachments
+  FOR SELECT USING (auth.uid() = user_id);
+
+CREATE POLICY "document_attachments_insert" ON public.document_attachments
+  FOR INSERT WITH CHECK (auth.uid() = user_id);
+
+CREATE POLICY "document_attachments_update" ON public.document_attachments
+  FOR UPDATE USING (auth.uid() = user_id);
+
+-- Intentionally NO DELETE policy -- deletion is blocked by trigger
+
+CREATE INDEX idx_document_attachments_user_id ON public.document_attachments (user_id);
+CREATE INDEX idx_document_attachments_journal_entry_id ON public.document_attachments (journal_entry_id);
+CREATE INDEX idx_document_attachments_journal_entry_line_id ON public.document_attachments (journal_entry_line_id);
+CREATE INDEX idx_document_attachments_sha256_hash ON public.document_attachments (sha256_hash);
+CREATE INDEX idx_document_attachments_original_id ON public.document_attachments (original_id);
+
+CREATE TRIGGER document_attachments_updated_at
+  BEFORE UPDATE ON public.document_attachments
+  FOR EACH ROW EXECUTE FUNCTION public.update_updated_at_column();