Isaac_Aracena/glm-hub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

build: actualizar dist con la versión de producción más reciente

Browse Source
This commit is contained in:
Isaac Aracena
2026-08-14 16:34:38 -04:00
parent a5fe1f7b27
commit abfd2c4fae
15 changed files with 1794 additions and 350 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SUPABASE-GLM-HUB-COMPLETO.sql
+170 -56
View File
@@ -546,13 +546,10 @@ create table if not exists public.glm_hub_access_request_approvers (
clicked_at timestamptz,
created_at timestamptz not null default now(),
constraint glm_hub_access_request_approvers_email_check
constraint glm_hub_access_request_approvers_email_normalized_check
check (
approver_email in (
'iaracena@gomezleemarketing.com',
'jgomez@gomezleemarketing.com',
'mgomez@gomezleemarketing.com'
)
approver_email = lower(btrim(approver_email))
and approver_email ~ '^[a-z0-9.!#$%&''*+/=?^_`{|}~-]+@[a-z0-9.-]+\.[a-z]{2,}$'
),
constraint glm_hub_access_request_approvers_unique_request_email
unique (request_id, approver_email)
@@ -696,8 +693,9 @@ revoke all on function public.glm_hub_prepare_access_request(uuid) from public,
grant execute on function public.glm_hub_prepare_access_request(uuid) to authenticated;
grant execute on function public.glm_hub_prepare_access_request(uuid) to service_role;
-- Emite o recupera los tres enlaces de decisión. Solo n8n, usando la clave
-- service_role guardada en su nodo HTTP Request, puede ejecutar esta función.
-- Emite o recupera los enlaces de decisión para los tres aprobadores base y,
-- cuando está disponible, para el jefe inmediato del solicitante. Solo n8n,
-- usando la clave service_role guardada en su nodo HTTP Request, puede ejecutar esta función.
create or replace function public.glm_hub_issue_access_request_tokens(p_request_id uuid)
returns jsonb
language plpgsql
@@ -707,9 +705,6 @@ set search_path = ''
as $$
declare
v_request public.glm_hub_access_requests%rowtype;
v_token_isaac text;
v_token_jose text;
v_token_maximo text;
begin
select request.*
into v_request
@@ -722,45 +717,72 @@ begin
return jsonb_build_object('ok', false, 'error', 'La solicitud no existe o ya fue atendida.');
end if;
if not exists (
select 1
from public.glm_hub_access_request_approvers as approver
where approver.request_id = p_request_id
) then
v_token_isaac := encode(extensions.gen_random_bytes(32), 'hex');
v_token_jose := encode(extensions.gen_random_bytes(32), 'hex');
v_token_maximo := encode(extensions.gen_random_bytes(32), 'hex');
insert into public.glm_hub_access_request_approvers (
request_id,
with supervisor_candidate as (
select
coalesce(
nullif(btrim(employee.supervisor), ''),
nullif(btrim(supervisor_employee.name), ''),
split_part(lower(btrim(employee.supervisor_email)), '@', 1)
) as approver_name,
lower(btrim(employee.supervisor_email)) as approver_email,
40 as priority
from public.empleados_glm as employee
left join public.empleados_glm as supervisor_employee
on lower(btrim(supervisor_employee.work_email)) = lower(btrim(employee.supervisor_email))
where lower(btrim(employee.work_email)) = v_request.requester_email
and nullif(btrim(employee.supervisor_email), '') is not null
order by
case when employee.status::text = 'Active' then 0 else 1 end,
employee.id
limit 1
),
candidate_approvers as (
select 'Isaac Aracena'::text as approver_name,
'iaracena@gomezleemarketing.com'::text as approver_email,
10 as priority
union all
select 'José Leopoldo Gómez', 'jgomez@gomezleemarketing.com', 20
union all
select 'Máximo Gómez', 'mgomez@gomezleemarketing.com', 30
union all
select approver_name, approver_email, priority
from supervisor_candidate
),
deduplicated as (
select distinct on (approver_email)
approver_name,
approver_email,
decision_token,
decision_token_hash
)
values
(
p_request_id,
'Isaac Aracena',
'iaracena@gomezleemarketing.com',
v_token_isaac,
encode(extensions.digest(v_token_isaac, 'sha256'), 'hex')
),
(
p_request_id,
'José Leopoldo Gómez',
'jgomez@gomezleemarketing.com',
v_token_jose,
encode(extensions.digest(v_token_jose, 'sha256'), 'hex')
),
(
p_request_id,
'Máximo Gómez',
'mgomez@gomezleemarketing.com',
v_token_maximo,
encode(extensions.digest(v_token_maximo, 'sha256'), 'hex')
);
end if;
priority
from candidate_approvers
where approver_email is not null
and approver_email <> ''
and approver_email <> v_request.requester_email
and approver_email ~ '^[a-z0-9.!#$%&''*+/=?^_`{|}~-]+@[a-z0-9.-]+\.[a-z]{2,}$'
order by approver_email, priority
),
tokenized as (
select
approver_name,
approver_email,
priority,
encode(extensions.gen_random_bytes(32), 'hex') as decision_token
from deduplicated
)
insert into public.glm_hub_access_request_approvers (
request_id,
approver_name,
approver_email,
decision_token,
decision_token_hash
)
select
p_request_id,
tokenized.approver_name,
tokenized.approver_email,
tokenized.decision_token,
encode(extensions.digest(tokenized.decision_token, 'sha256'), 'hex')
from tokenized
on conflict (request_id, approver_email) do nothing;
return jsonb_build_object(
'ok', true,
@@ -770,13 +792,23 @@ begin
'appName', v_request.app_name,
'appCategory', v_request.app_category,
'approvers', (
select jsonb_agg(
jsonb_build_object(
'name', approver.approver_name,
'email', approver.approver_email,
'token', approver.decision_token
)
order by approver.approver_email
select coalesce(
jsonb_agg(
jsonb_build_object(
'name', approver.approver_name,
'email', approver.approver_email,
'token', approver.decision_token
)
order by
case approver.approver_email
when 'iaracena@gomezleemarketing.com' then 1
when 'jgomez@gomezleemarketing.com' then 2
when 'mgomez@gomezleemarketing.com' then 3
else 4
end,
approver.approver_email
),
'[]'::jsonb
)
from public.glm_hub_access_request_approvers as approver
where approver.request_id = p_request_id
@@ -886,7 +918,89 @@ grant execute on function public.glm_hub_decide_access_request(text, text) to au
grant execute on function public.glm_hub_decide_access_request(text, text) to service_role;
-- --------------------------------------------------------------------------
-- 7. REALTIME DEL CATÁLOGO
-- 7. ESTADO DE ACCESO POR APLICACIÓN
-- --------------------------------------------------------------------------
create or replace function public.glm_hub_get_my_app_access()
returns table (
app_id uuid,
app_name text,
has_access boolean
)
language plpgsql
stable
security definer
set search_path = ''
as $$
declare
v_email text;
begin
v_email := lower(btrim(coalesce(auth.jwt() ->> 'email', '')));
if auth.uid() is null or v_email = '' then
return;
end if;
if v_email !~ '^[a-z0-9.!#$%&''*+/=?^_`{|}~-]+@gomezleemarketing\.com$' then
return;
end if;
return query
select
app.id,
app.name,
case
-- Aplicaciones restringidas: consultar su fuente real de autorización.
when lower(btrim(app.name)) = 'cdc project management' then exists (
select 1
from public.tablero_cdc_allowed_users as allowed_user
where lower(btrim(allowed_user.email)) = v_email
and coalesce(allowed_user.is_active, false) = true
)
when lower(btrim(app.name)) = 'portal de verificación de nóminas' then exists (
select 1
from public.cruce_cuentas_usuarios_autorizados as allowed_user
where lower(btrim(allowed_user.email)) = v_email
)
when lower(btrim(app.name)) = 'seguimiento de impuestos glm' then exists (
select 1
from public.tax_calendar_access as allowed_user
where lower(btrim(allowed_user.email)) = v_email
and coalesce(allowed_user.active, false) = true
)
-- Aplicaciones disponibles para cualquier usuario GLM autenticado.
when lower(btrim(app.name)) in (
'bamboohr',
'cdc brief',
'cruce de seguridad social - honduras',
'cruce de seguridad social - guatemala',
'cruce de seguridad social - costa rica',
'cruce de seguridad social - república dominicana',
'cruce de seguridad social - el salvador',
'validación de ir - nicaragua',
'glm id card generator'
) then true
-- Seguridad por defecto: una aplicación nueva/no clasificada nunca se
-- muestra como autorizada hasta definir su fuente de permisos.
else false
end as has_access
from public.glm_hub_apps as app
where app.visibility = 'published'
order by app.name;
end;
$$;
alter function public.glm_hub_get_my_app_access() owner to postgres;
revoke all on function public.glm_hub_get_my_app_access() from public, anon;
grant execute on function public.glm_hub_get_my_app_access() to authenticated;
grant execute on function public.glm_hub_get_my_app_access() to service_role;
-- --------------------------------------------------------------------------
-- 8. REALTIME DEL CATÁLOGO
-- --------------------------------------------------------------------------
-- Hace que una aplicación creada/editada/eliminada por un administrador