Nora
0ac4beaaa8
- Add requireAuth() to admin-permissions.ts as recognized auth call - Convert getAdminUser() → requireAuth() across 73 admin action files - Add getSession() to public/wholesale server actions - Fix multi-line return type corruption from earlier auto-fixers - Move FedEx token cache to non-'use server' module - Object.freeze module-level constants: PRICE_KEYS, EMPTY_MOBILE_DASHBOARD, EMPTY_PAY_PERIOD, LOCALE_CART_SUBJECT, WELCOME_EMAILS - Update Stripe API version 2026-05-27 → 2026-06-24 - Fix wholesale employee portal: getEmployeeSessionAction + EmployeePortalClient - Fix 51 TypeScript errors (return type corruption, missing imports)
20 lines
920 B
SQL
20 lines
920 B
SQL
-- Migration 204: Add permissive read policy for locations
|
|
--
|
|
-- Why: The admin Stops & Routes page reads stops via the Supabase JS client
|
|
-- (anon key + RLS). The `stops` table has a `Public read stops` policy with
|
|
-- qual=true, which lets the anon role see all non-deleted stops — that's how
|
|
-- the page works in dev mode (no Supabase auth). The admin_locations tab needs
|
|
-- the same behavior so the server component can use the same pattern:
|
|
-- supabase.from("locations").select(...)
|
|
--
|
|
-- Brand scoping is enforced at the application layer in the server component
|
|
-- (eq("brand_id", adminUser.brand_id)), matching how stops are scoped.
|
|
--
|
|
-- Brand-scoped public reads (storefront pages) go through get_locations_for_brand
|
|
-- RPC, which filters active=true.
|
|
|
|
DROP POLICY IF EXISTS "Public read locations" ON public.locations;
|
|
CREATE POLICY "Public read locations" ON public.locations
|
|
FOR SELECT
|
|
USING (true);
|