readonly role

2025-11-05 14:10:57 +01:00
parent 480bc20ae7
commit a75281aa13
8 changed files with 91 additions and 11 deletions
@@ -55,6 +55,12 @@ user_sets AS (
    FROM shared.tenants
    RETURNING id, tenant_id
 ),
+readonly_sets AS (
+    INSERT INTO tenant.capability_sets (tenant_id, slug, is_system)
+    SELECT id, 'readonly', TRUE
+    FROM shared.tenants
+    RETURNING id, tenant_id
+),
 webdav_sets AS (
    INSERT INTO tenant.capability_sets (tenant_id, slug, is_system)
    SELECT id, 'webdav', TRUE
@@ -109,6 +115,16 @@ FROM (
           ]) AS capability
    FROM user_sets us
    UNION ALL
+    SELECT rs.id,
+           UNNEST(ARRAY[
+               'documents:read'::api_capability,
+               'folders:read'::api_capability,
+               'tags:read'::api_capability,
+               'correspondents:read'::api_capability,
+               'webdav:read'::api_capability
+           ]) AS capability
+    FROM readonly_sets rs
+    UNION ALL
    SELECT ws.id,
           UNNEST(ARRAY['webdav:read'::api_capability]) AS capability
    FROM webdav_sets ws