feat(admin): multi-brand admin support
Implements the design at
docs/superpowers/specs/2026-06-04-multi-brand-admin-design.md.
Adds:
- admin_user_brands junction table (m:n admin<->brand) via migration 207
- New role 'multi_brand_admin' (auto-set when an admin has 2+ brands)
- 'active_brand_id' cookie that persists the admin's currently-selected
brand across navigations; switchable via the new BrandSelector dropdown
in the sidebar
- Centralised brand resolution in src/lib/brand-scope.ts:
- getActiveBrandId (URL > cookie > legacy brand_id > first of brand_ids)
- assertBrandAccess (defence-in-depth for cases where the brandId
comes from a URL form or RPC return)
- ~30 server actions and ~10 page server components migrated to use
getActiveBrandId instead of the silent brandId ?? adminUser.brand_id
pattern that allowed cross-brand access bugs
- BrandSelector client component with proper a11y (aria-haspopup,
aria-expanded, role=listbox, outside-click and escape-to-close)
Migration 207 also adds RLS so admins can read their own junction rows
(needed for the dropdown to populate) and SECURITY DEFINER RPCs
add/remove_admin_user_brand that auto-promote/demote between
brand_admin and multi_brand_admin.
Notes:
- Migration number is 207 not 204 — 204-206 were taken in this worktree
by the concurrent locations work.
- The legacy admin_users.brand_id column is preserved for backwards
compat; a follow-up migration 220_* will drop it.
- Dev sessions (dev_session cookie, NEXT_PUBLIC_USE_MOCK_DATA) get
brand_ids: []; the documented limitation is that dev store_employee
will see <AdminAccessDenied /> if no real brands exist.
- Pages that hardcode a Tuxedo brand UUID as a fallback
(adminUser.brand_id ?? '64294306-...') are NOT migrated in this PR —
they still work for single-brand admins and are out of scope.
Co-authored-by: implementer subagent (cancelled mid-run), Grok orchestrator
This commit is contained in:
@@ -0,0 +1,185 @@
|
||||
-- Migration 207: Multi-Brand Admin Support
|
||||
--
|
||||
-- Adds:
|
||||
-- 1. New role: 'multi_brand_admin' (functionally equivalent to brand_admin,
|
||||
-- but disambiguates intent: "manages 2+ brands" vs "manages 1 brand").
|
||||
-- 2. Junction table: admin_user_brands — replaces the single brand_id
|
||||
-- implicit invariant. The legacy admin_users.brand_id column is kept
|
||||
-- for backwards compatibility (see migration 220_*.sql to drop it later).
|
||||
-- 3. RPCs: add_admin_user_brand / remove_admin_user_brand (manages the
|
||||
-- junction and auto-promotes/demotes the role based on brand count).
|
||||
--
|
||||
-- Design:
|
||||
-- - Composite PK (admin_user_id, brand_id) enforces uniqueness.
|
||||
-- - Index on brand_id makes "which admins are in Brand X?" queries fast.
|
||||
-- - ON DELETE CASCADE for both FKs — deleting an admin or brand cleans up.
|
||||
-- - added_by is nullable so first-insert rows (admin with no other admin)
|
||||
-- can still insert their own membership.
|
||||
|
||||
-- ═══════════════════════════════════════════════════════════════════════════
|
||||
-- 1. Update role CHECK constraint to include multi_brand_admin
|
||||
-- ═══════════════════════════════════════════════════════════════════════════
|
||||
-- The constraint name in Supabase's auto-generated schema is conventionally
|
||||
-- "admin_users_role_check" (the default Postgres naming), but we drop both
|
||||
-- the canonical and a common alternative to be safe across schema generations.
|
||||
|
||||
ALTER TABLE public.admin_users DROP CONSTRAINT IF EXISTS admin_users_role_check;
|
||||
ALTER TABLE public.admin_users DROP CONSTRAINT IF EXISTS admin_users_role_chk;
|
||||
|
||||
ALTER TABLE public.admin_users
|
||||
ADD CONSTRAINT admin_users_role_check
|
||||
CHECK (role IN ('platform_admin', 'brand_admin', 'multi_brand_admin', 'store_employee', 'staff'));
|
||||
|
||||
-- ═══════════════════════════════════════════════════════════════════════════
|
||||
-- 2. Create admin_user_brands junction table
|
||||
-- ═══════════════════════════════════════════════════════════════════════════
|
||||
|
||||
CREATE TABLE IF NOT EXISTS public.admin_user_brands (
|
||||
admin_user_id UUID NOT NULL REFERENCES public.admin_users(id) ON DELETE CASCADE,
|
||||
brand_id UUID NOT NULL REFERENCES public.brands(id) ON DELETE CASCADE,
|
||||
added_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
|
||||
added_by UUID REFERENCES public.admin_users(id),
|
||||
PRIMARY KEY (admin_user_id, brand_id)
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS admin_user_brands_brand_id_idx
|
||||
ON public.admin_user_brands(brand_id);
|
||||
|
||||
-- ═══════════════════════════════════════════════════════════════════════════
|
||||
-- 3. Backfill: copy legacy single-brand admins into the junction
|
||||
-- ═══════════════════════════════════════════════════════════════════════════
|
||||
|
||||
INSERT INTO public.admin_user_brands (admin_user_id, brand_id)
|
||||
SELECT id, brand_id FROM public.admin_users
|
||||
WHERE brand_id IS NOT NULL
|
||||
ON CONFLICT (admin_user_id, brand_id) DO NOTHING;
|
||||
|
||||
-- ═══════════════════════════════════════════════════════════════════════════
|
||||
-- 4. Promote anyone with > 1 brand in the junction to multi_brand_admin
|
||||
-- ═══════════════════════════════════════════════════════════════════════════
|
||||
|
||||
UPDATE public.admin_users
|
||||
SET role = 'multi_brand_admin'
|
||||
WHERE role = 'brand_admin'
|
||||
AND id IN (
|
||||
SELECT admin_user_id FROM public.admin_user_brands
|
||||
GROUP BY admin_user_id HAVING COUNT(*) > 1
|
||||
);
|
||||
|
||||
-- ═══════════════════════════════════════════════════════════════════════════
|
||||
-- 5. RLS: enable on the junction (no public read; only platform_admin all)
|
||||
-- ═══════════════════════════════════════════════════════════════════════════
|
||||
|
||||
ALTER TABLE public.admin_user_brands ENABLE ROW LEVEL SECURITY;
|
||||
|
||||
DROP POLICY IF EXISTS "admin_user_brands_platform_admin_all" ON public.admin_user_brands;
|
||||
CREATE POLICY "admin_user_brands_platform_admin_all" ON public.admin_user_brands
|
||||
FOR ALL TO authenticated
|
||||
USING (
|
||||
EXISTS (
|
||||
SELECT 1 FROM public.admin_users au
|
||||
WHERE au.user_id = auth.uid()
|
||||
AND au.role = 'platform_admin'
|
||||
AND au.active = true
|
||||
)
|
||||
)
|
||||
WITH CHECK (
|
||||
EXISTS (
|
||||
SELECT 1 FROM public.admin_users au
|
||||
WHERE au.user_id = auth.uid()
|
||||
AND au.role = 'platform_admin'
|
||||
AND au.active = true
|
||||
)
|
||||
);
|
||||
|
||||
-- Brand admins can read their own membership rows (so the BrandSelector
|
||||
-- dropdown works without exposing other admins' memberships)
|
||||
DROP POLICY IF EXISTS "admin_user_brands_self_read" ON public.admin_user_brands;
|
||||
CREATE POLICY "admin_user_brands_self_read" ON public.admin_user_brands
|
||||
FOR SELECT TO authenticated
|
||||
USING (
|
||||
admin_user_id IN (
|
||||
SELECT id FROM public.admin_users
|
||||
WHERE user_id = auth.uid() AND active = true
|
||||
)
|
||||
);
|
||||
|
||||
-- ═══════════════════════════════════════════════════════════════════════════
|
||||
-- 6. RPC: add_admin_user_brand
|
||||
-- Adds an admin to a brand. Auto-promotes to multi_brand_admin if they
|
||||
-- end up with 2+ brands.
|
||||
-- ═══════════════════════════════════════════════════════════════════════════
|
||||
|
||||
CREATE OR REPLACE FUNCTION public.add_admin_user_brand(
|
||||
p_admin_user_id UUID,
|
||||
p_brand_id UUID,
|
||||
p_added_by UUID DEFAULT NULL
|
||||
)
|
||||
RETURNS VOID
|
||||
LANGUAGE plpgsql
|
||||
SECURITY DEFINER
|
||||
SET search_path = public
|
||||
AS $$
|
||||
BEGIN
|
||||
INSERT INTO public.admin_user_brands (admin_user_id, brand_id, added_by)
|
||||
VALUES (p_admin_user_id, p_brand_id, p_added_by)
|
||||
ON CONFLICT (admin_user_id, brand_id) DO NOTHING;
|
||||
|
||||
-- Promote to multi_brand_admin if they now have 2+ brands
|
||||
UPDATE public.admin_users
|
||||
SET role = 'multi_brand_admin'
|
||||
WHERE id = p_admin_user_id
|
||||
AND role = 'brand_admin'
|
||||
AND (
|
||||
SELECT COUNT(*) FROM public.admin_user_brands
|
||||
WHERE admin_user_id = p_admin_user_id
|
||||
) > 1;
|
||||
END;
|
||||
$$;
|
||||
|
||||
-- ═══════════════════════════════════════════════════════════════════════════
|
||||
-- 7. RPC: remove_admin_user_brand
|
||||
-- Removes an admin from a brand. Auto-demotes to brand_admin if they
|
||||
-- drop to 1 brand. Does NOT demote to anything else (e.g. staff) — only
|
||||
-- brand_admin <-> multi_brand_admin transitions.
|
||||
-- ═══════════════════════════════════════════════════════════════════════════
|
||||
|
||||
CREATE OR REPLACE FUNCTION public.remove_admin_user_brand(
|
||||
p_admin_user_id UUID,
|
||||
p_brand_id UUID
|
||||
)
|
||||
RETURNS VOID
|
||||
LANGUAGE plpgsql
|
||||
SECURITY DEFINER
|
||||
SET search_path = public
|
||||
AS $$
|
||||
DECLARE
|
||||
v_remaining_count INT;
|
||||
BEGIN
|
||||
DELETE FROM public.admin_user_brands
|
||||
WHERE admin_user_id = p_admin_user_id
|
||||
AND brand_id = p_brand_id;
|
||||
|
||||
GET DIAGNOSTICS v_remaining_count = ROW_COUNT;
|
||||
|
||||
-- If we just removed a row and the user is now down to 1 brand, demote
|
||||
IF v_remaining_count > 0 THEN
|
||||
SELECT COUNT(*) INTO v_remaining_count
|
||||
FROM public.admin_user_brands
|
||||
WHERE admin_user_id = p_admin_user_id;
|
||||
|
||||
IF v_remaining_count = 1 THEN
|
||||
UPDATE public.admin_users
|
||||
SET role = 'brand_admin'
|
||||
WHERE id = p_admin_user_id
|
||||
AND role = 'multi_brand_admin';
|
||||
END IF;
|
||||
END IF;
|
||||
END;
|
||||
$$;
|
||||
|
||||
-- ═══════════════════════════════════════════════════════════════════════════
|
||||
-- 8. Refresh PostgREST schema cache
|
||||
-- ═══════════════════════════════════════════════════════════════════════════
|
||||
|
||||
NOTIFY pgrst, 'reload schema';
|
||||
Reference in New Issue
Block a user