Chore: define policies in table definition files

For tables `vibetype.notification` and `vibetype.notification_invitation` the policies were moved to the table files, making the policy files obsolete.

Author: sthelemann

src/deploy/table_notification.sql

@@ -19,4 +19,13 @@ COMMENT ON COLUMN vibetype.notification.payload IS 'The notification''s payload.
 COMMENT ON COLUMN vibetype.notification.created_by IS E'@omit create\nReference to the account that created the notification.';
 COMMENT ON COLUMN vibetype.notification.created_at IS 'The timestamp of the notification''s creation.';
 
+GRANT SELECT, INSERT ON vibetype.notification TO vibetype_account;
+
+ALTER TABLE vibetype.notification ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY notification_all ON vibetype.notification FOR ALL
+USING (
+  created_by = vibetype.invoker_account_id()
+);
+
 COMMIT;

src/deploy/table_notification_invitation.sql

@@ -10,4 +10,23 @@ COMMENT ON COLUMN vibetype.notification_invitation.guest_id IS 'The ID of the gu
 
 CREATE INDEX idx_invitation_guest_id ON vibetype.notification_invitation USING btree (guest_id);
 
+GRANT SELECT, INSERT ON vibetype.notification_invitation TO vibetype_account;
+
+ALTER TABLE vibetype.notification_invitation ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY notification_invitation_all ON vibetype.notification_invitation FOR ALL
+USING (
+  created_by = vibetype.invoker_account_id()
+);
+
+CREATE POLICY notification_invitation_insert ON vibetype.notification_invitation FOR INSERT
+WITH CHECK (
+  vibetype.invoker_account_id() = (
+    SELECT e.created_by
+    FROM vibetype.guest g
+      JOIN vibetype.event e ON g.event_id = e.id
+    WHERE g.id = guest_id
+  )
+);
+
 COMMIT;

src/deploy/table_notification_invitation_policy.sql

@@ -1,5 +1,7 @@
 BEGIN;
 
+DROP POLICY notification_all ON vibetype.notification;
+
 DROP TABLE vibetype.notification;
 
 COMMIT;

src/deploy/table_notification_policy.sql

@@ -1,5 +1,8 @@
 BEGIN;
 
+DROP POLICY notification_invitation_all ON vibetype.notification_invitation;
+DROP POLICY notification_invitation_insert ON vibetype.notification_invitation;
+
 DROP TABLE vibetype.notification_invitation;
 
 COMMIT;

src/revert/table_notification.sql

@@ -8,4 +8,16 @@ SELECT id,
        created_at
 FROM vibetype.notification WHERE FALSE;
 
+DO $$
+BEGIN
+  ASSERT (SELECT pg_catalog.has_table_privilege('vibetype_account', 'vibetype.notification', 'SELECT'));
+  ASSERT (SELECT pg_catalog.has_table_privilege('vibetype_account', 'vibetype.notification', 'INSERT'));
+  ASSERT NOT (SELECT pg_catalog.has_table_privilege('vibetype_account', 'vibetype.notification', 'UPDATE'));
+  ASSERT NOT (SELECT pg_catalog.has_table_privilege('vibetype_account', 'vibetype.notification', 'DELETE'));
+  ASSERT NOT (SELECT pg_catalog.has_table_privilege('vibetype_anonymous', 'vibetype.notification', 'SELECT'));
+  ASSERT NOT (SELECT pg_catalog.has_table_privilege('vibetype_anonymous', 'vibetype.notification', 'INSERT'));
+  ASSERT NOT (SELECT pg_catalog.has_table_privilege('vibetype_anonymous', 'vibetype.notification', 'UPDATE'));
+  ASSERT NOT (SELECT pg_catalog.has_table_privilege('vibetype_anonymous', 'vibetype.notification', 'DELETE'));
+END $$;
+
 ROLLBACK;

src/revert/table_notification_invitation.sql

@@ -13,4 +13,16 @@ SELECT
 FROM vibetype.notification_invitation
 WHERE FALSE;
 
+DO $$
+BEGIN
+  ASSERT (SELECT pg_catalog.has_table_privilege('vibetype_account', 'vibetype.notification_invitation', 'SELECT'));
+  ASSERT (SELECT pg_catalog.has_table_privilege('vibetype_account', 'vibetype.notification_invitation', 'INSERT'));
+  ASSERT NOT (SELECT pg_catalog.has_table_privilege('vibetype_account', 'vibetype.notification_invitation', 'UPDATE'));
+  ASSERT NOT (SELECT pg_catalog.has_table_privilege('vibetype_account', 'vibetype.notification_invitation', 'DELETE'));
+  ASSERT NOT (SELECT pg_catalog.has_table_privilege('vibetype_anonymous', 'vibetype.notification_invitation', 'SELECT'));
+  ASSERT NOT (SELECT pg_catalog.has_table_privilege('vibetype_anonymous', 'vibetype.notification_invitation', 'INSERT'));
+  ASSERT NOT (SELECT pg_catalog.has_table_privilege('vibetype_anonymous', 'vibetype.notification_invitation', 'UPDATE'));
+  ASSERT NOT (SELECT pg_catalog.has_table_privilege('vibetype_anonymous', 'vibetype.notification_invitation', 'DELETE'));
+END $$;
+
 ROLLBACK;