SimoandCursor
ba82789166
Move CMS SQL to drizzle/migrations, drop prisma packages/schema, wire drizzle-kit scripts, and regenerate schema names from src/db/schema.ts. Co-authored-by: Cursor <[email protected]>
70 lines
2.2 KiB
SQL
70 lines
2.2 KiB
SQL
-- Repair admin ACL so ranks that can open the panel also see/use admin sections.
|
|
-- Root cause: sidebar filters by ACL; seed only granted some admin.*.view rows,
|
|
-- and later sync from housekeeping could leave mid/high ranks incomplete.
|
|
|
|
-- 1) Every rank that already has admin.dashboard gets ALL admin.* permissions.
|
|
INSERT INTO `acl_model_permissions` (`model_type`, `model_id`, `permission_id`)
|
|
SELECT 'Role', ar.id, ap.id
|
|
FROM `acl_roles` ar
|
|
JOIN `acl_permissions` ap ON ap.slug LIKE 'admin.%'
|
|
WHERE EXISTS (
|
|
SELECT 1
|
|
FROM `acl_model_permissions` amp
|
|
JOIN `acl_permissions` apdash ON apdash.id = amp.permission_id
|
|
WHERE amp.model_type = 'Role'
|
|
AND amp.model_id = ar.id
|
|
AND apdash.slug = 'admin.dashboard'
|
|
)
|
|
AND NOT EXISTS (
|
|
SELECT 1
|
|
FROM `acl_model_permissions` amp2
|
|
WHERE amp2.model_type = 'Role'
|
|
AND amp2.model_id = ar.id
|
|
AND amp2.permission_id = ap.id
|
|
);
|
|
|
|
-- 2) Safety net matching original seed: ranks >= 6 get all admin.*.view + dashboard.
|
|
INSERT INTO `acl_model_permissions` (`model_type`, `model_id`, `permission_id`)
|
|
SELECT 'Role', ar.id, ap.id
|
|
FROM `permission_ranks` pr
|
|
JOIN `acl_roles` ar ON ar.slug = CONCAT('rank_', pr.id)
|
|
JOIN `acl_permissions` ap ON (
|
|
ap.slug = 'admin.dashboard'
|
|
OR (ap.slug LIKE 'admin.%' AND ap.slug LIKE '%.view')
|
|
)
|
|
WHERE pr.id >= 6
|
|
AND NOT EXISTS (
|
|
SELECT 1
|
|
FROM `acl_model_permissions` amp
|
|
WHERE amp.model_type = 'Role'
|
|
AND amp.model_id = ar.id
|
|
AND amp.permission_id = ap.id
|
|
);
|
|
|
|
-- 3) Ranks >= 7 also get edit/manage/execute tools used by the sidebar.
|
|
INSERT INTO `acl_model_permissions` (`model_type`, `model_id`, `permission_id`)
|
|
SELECT 'Role', ar.id, ap.id
|
|
FROM `permission_ranks` pr
|
|
JOIN `acl_roles` ar ON ar.slug = CONCAT('rank_', pr.id)
|
|
JOIN `acl_permissions` ap ON (
|
|
(ap.slug LIKE 'admin.%' AND ap.slug LIKE '%.edit')
|
|
OR ap.slug IN (
|
|
'admin.permissions.manage',
|
|
'admin.rcon.execute',
|
|
'admin.assets.import',
|
|
'admin.export',
|
|
'admin.analytics.export',
|
|
'admin.users.ban',
|
|
'admin.users.reset_password',
|
|
'admin.room.delete'
|
|
)
|
|
)
|
|
WHERE pr.id >= 7
|
|
AND NOT EXISTS (
|
|
SELECT 1
|
|
FROM `acl_model_permissions` amp
|
|
WHERE amp.model_type = 'Role'
|
|
AND amp.model_id = ar.id
|
|
AND amp.permission_id = ap.id
|
|
);
|