Fix schema: create teams BEFORE profiles (fixes foreign key error), merge admin schema into main

web/lib/supabase/admin-schema.sql

@@ -1,47 +0,0 @@
--- ClauseGuard — Admin Schema Extension
--- Run AFTER the main schema.sql
-
--- Add role column to profiles
-ALTER TABLE public.profiles ADD COLUMN IF NOT EXISTS role TEXT DEFAULT 'user' CHECK (role IN ('user', 'admin'));
-
--- Add is_banned column
-ALTER TABLE public.profiles ADD COLUMN IF NOT EXISTS is_banned BOOLEAN DEFAULT false;
-
--- Set admin
-UPDATE public.profiles SET role = 'admin' WHERE email = 'ankygaur9972@gmail.com';
-
--- Activity log
-CREATE TABLE IF NOT EXISTS public.admin_logs (
-  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-  admin_id UUID REFERENCES auth.users NOT NULL,
-  action TEXT NOT NULL,
-  target_type TEXT,  -- 'user', 'team', 'scan', 'api_key', 'rule'
-  target_id TEXT,
-  details JSONB,
-  created_at TIMESTAMPTZ DEFAULT NOW()
-);
-
-CREATE INDEX IF NOT EXISTS idx_admin_logs_created ON public.admin_logs(created_at DESC);
-
--- Admin RLS: admins can read all tables
-CREATE POLICY "Admins can read all profiles" ON public.profiles FOR SELECT
-  USING (auth.uid() IN (SELECT id FROM public.profiles WHERE role = 'admin'));
-
-CREATE POLICY "Admins can update all profiles" ON public.profiles FOR UPDATE
-  USING (auth.uid() IN (SELECT id FROM public.profiles WHERE role = 'admin'));
-
-CREATE POLICY "Admins can read all analyses" ON public.analyses FOR SELECT
-  USING (auth.uid() IN (SELECT id FROM public.profiles WHERE role = 'admin'));
-
-CREATE POLICY "Admins can read all teams" ON public.teams FOR SELECT
-  USING (auth.uid() IN (SELECT id FROM public.profiles WHERE role = 'admin'));
-
-CREATE POLICY "Admins can read all api_keys" ON public.api_keys FOR SELECT
-  USING (auth.uid() IN (SELECT id FROM public.profiles WHERE role = 'admin'));
-
-CREATE POLICY "Admins can read all custom_rules" ON public.custom_rules FOR SELECT
-  USING (auth.uid() IN (SELECT id FROM public.profiles WHERE role = 'admin'));
-
-ALTER TABLE public.admin_logs ENABLE ROW LEVEL SECURITY;
-CREATE POLICY "Admins can manage logs" ON public.admin_logs FOR ALL
-  USING (auth.uid() IN (SELECT id FROM public.profiles WHERE role = 'admin'));

web/lib/supabase/schema.sql

@@ -1,6 +1,18 @@
--- ClauseGuard — Full Database Schema (with Teams, API Keys, Custom Rules)
+-- ClauseGuard — Full Database Schema
+-- Tables ordered by dependency (no forward references)
 
--- ─── Profiles ───
+-- ─── 1. Teams (no dependencies) ───
+CREATE TABLE IF NOT EXISTS public.teams (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  name TEXT NOT NULL,
+  owner_id UUID REFERENCES auth.users NOT NULL,
+  plan TEXT DEFAULT 'team',
+  max_seats INT DEFAULT 5,
+  razorpay_subscription_id TEXT,
+  created_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- ─── 2. Profiles (depends on teams) ───
 CREATE TABLE IF NOT EXISTS public.profiles (
   id UUID REFERENCES auth.users ON DELETE CASCADE PRIMARY KEY,
   email TEXT,
@@ -8,6 +20,8 @@ CREATE TABLE IF NOT EXISTS public.profiles (
   avatar_url TEXT,
   razorpay_subscription_id TEXT,
   plan TEXT DEFAULT 'free' CHECK (plan IN ('free', 'pro', 'team')),
+  role TEXT DEFAULT 'user' CHECK (role IN ('user', 'admin')),
+  is_banned BOOLEAN DEFAULT false,
   team_id UUID REFERENCES public.teams(id) ON DELETE SET NULL,
   analyses_this_month INT DEFAULT 0,
   monthly_reset_at TIMESTAMPTZ DEFAULT date_trunc('month', NOW()),
@@ -15,17 +29,7 @@ CREATE TABLE IF NOT EXISTS public.profiles (
   updated_at TIMESTAMPTZ DEFAULT NOW()
 );
 
--- ─── Teams ───
-CREATE TABLE IF NOT EXISTS public.teams (
-  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-  name TEXT NOT NULL,
-  owner_id UUID REFERENCES auth.users NOT NULL,
-  plan TEXT DEFAULT 'team',
-  max_seats INT DEFAULT 5,
-  razorpay_subscription_id TEXT,
-  created_at TIMESTAMPTZ DEFAULT NOW()
-);
-
+-- ─── 3. Team Invites (depends on teams) ───
 CREATE TABLE IF NOT EXISTS public.team_invites (
   id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
   team_id UUID REFERENCES public.teams ON DELETE CASCADE NOT NULL,
@@ -38,7 +42,7 @@ CREATE TABLE IF NOT EXISTS public.team_invites (
   UNIQUE(team_id, email)
 );
 
--- ─── Analyses ───
+-- ─── 4. Analyses (depends on profiles, teams) ───
 CREATE TABLE IF NOT EXISTS public.analyses (
   id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
   user_id UUID REFERENCES public.profiles ON DELETE CASCADE NOT NULL,
@@ -53,36 +57,47 @@ CREATE TABLE IF NOT EXISTS public.analyses (
   created_at TIMESTAMPTZ DEFAULT NOW()
 );
 
--- ─── API Keys ───
+-- ─── 5. API Keys (depends on profiles, teams) ───
 CREATE TABLE IF NOT EXISTS public.api_keys (
   id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
   user_id UUID REFERENCES public.profiles ON DELETE CASCADE NOT NULL,
   team_id UUID REFERENCES public.teams ON DELETE CASCADE,
   name TEXT NOT NULL,
   key_hash TEXT NOT NULL UNIQUE,
-  key_prefix TEXT NOT NULL,  -- first 8 chars for display: "cg_live_a1b2..."
+  key_prefix TEXT NOT NULL,
   calls_this_month INT DEFAULT 0,
-  calls_limit INT DEFAULT 1000,  -- Pro: 1000, Team: 10000
+  calls_limit INT DEFAULT 1000,
   last_used_at TIMESTAMPTZ,
   is_active BOOLEAN DEFAULT true,
   created_at TIMESTAMPTZ DEFAULT NOW()
 );
 
--- ─── Custom Clause Rules ───
+-- ─── 6. Custom Clause Rules (depends on profiles, teams) ───
 CREATE TABLE IF NOT EXISTS public.custom_rules (
   id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
   user_id UUID REFERENCES public.profiles ON DELETE CASCADE,
   team_id UUID REFERENCES public.teams ON DELETE CASCADE,
   name TEXT NOT NULL,
   description TEXT,
-  pattern TEXT NOT NULL,          -- regex pattern to match
+  pattern TEXT NOT NULL,
   severity TEXT DEFAULT 'MEDIUM' CHECK (severity IN ('HIGH', 'MEDIUM', 'LOW')),
-  category TEXT NOT NULL,         -- custom category name
+  category TEXT NOT NULL,
   is_active BOOLEAN DEFAULT true,
   created_at TIMESTAMPTZ DEFAULT NOW(),
   updated_at TIMESTAMPTZ DEFAULT NOW()
 );
 
+-- ─── 7. Admin Logs ───
+CREATE TABLE IF NOT EXISTS public.admin_logs (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  admin_id UUID REFERENCES auth.users NOT NULL,
+  action TEXT NOT NULL,
+  target_type TEXT,
+  target_id TEXT,
+  details JSONB,
+  created_at TIMESTAMPTZ DEFAULT NOW()
+);
+
 -- ─── Indexes ───
 CREATE INDEX IF NOT EXISTS idx_analyses_user_id ON public.analyses(user_id);
 CREATE INDEX IF NOT EXISTS idx_analyses_team_id ON public.analyses(team_id);
@@ -92,6 +107,7 @@ CREATE INDEX IF NOT EXISTS idx_api_keys_user_id ON public.api_keys(user_id);
 CREATE INDEX IF NOT EXISTS idx_team_invites_email ON public.team_invites(email);
 CREATE INDEX IF NOT EXISTS idx_custom_rules_user_id ON public.custom_rules(user_id);
 CREATE INDEX IF NOT EXISTS idx_custom_rules_team_id ON public.custom_rules(team_id);
+CREATE INDEX IF NOT EXISTS idx_admin_logs_created ON public.admin_logs(created_at DESC);
 
 -- ─── Row Level Security ───
 ALTER TABLE public.profiles ENABLE ROW LEVEL SECURITY;
@@ -100,37 +116,47 @@ ALTER TABLE public.teams ENABLE ROW LEVEL SECURITY;
 ALTER TABLE public.team_invites ENABLE ROW LEVEL SECURITY;
 ALTER TABLE public.api_keys ENABLE ROW LEVEL SECURITY;
 ALTER TABLE public.custom_rules ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.admin_logs ENABLE ROW LEVEL SECURITY;
 
 -- Profiles
 CREATE POLICY "Users see own profile" ON public.profiles FOR SELECT USING (auth.uid() = id);
 CREATE POLICY "Users update own profile" ON public.profiles FOR UPDATE USING (auth.uid() = id);
+CREATE POLICY "Admins read all profiles" ON public.profiles FOR SELECT USING (auth.uid() IN (SELECT id FROM public.profiles WHERE role = 'admin'));
+CREATE POLICY "Admins update all profiles" ON public.profiles FOR UPDATE USING (auth.uid() IN (SELECT id FROM public.profiles WHERE role = 'admin'));
 
--- Analyses: own + team
+-- Analyses
 CREATE POLICY "Users see own analyses" ON public.analyses FOR SELECT
   USING (auth.uid() = user_id OR team_id IN (SELECT team_id FROM public.profiles WHERE id = auth.uid()));
 CREATE POLICY "Users insert analyses" ON public.analyses FOR INSERT WITH CHECK (auth.uid() = user_id);
 CREATE POLICY "Users delete own analyses" ON public.analyses FOR DELETE USING (auth.uid() = user_id);
+CREATE POLICY "Admins read all analyses" ON public.analyses FOR SELECT USING (auth.uid() IN (SELECT id FROM public.profiles WHERE role = 'admin'));
 
--- Teams: members can view, owner can update
+-- Teams
 CREATE POLICY "Team members can view" ON public.teams FOR SELECT
   USING (id IN (SELECT team_id FROM public.profiles WHERE id = auth.uid()) OR owner_id = auth.uid());
 CREATE POLICY "Owner can update team" ON public.teams FOR UPDATE USING (owner_id = auth.uid());
+CREATE POLICY "Admins read all teams" ON public.teams FOR SELECT USING (auth.uid() IN (SELECT id FROM public.profiles WHERE role = 'admin'));
 
--- Team invites: team members can view, admins can insert
+-- Team invites
 CREATE POLICY "Members see team invites" ON public.team_invites FOR SELECT
   USING (team_id IN (SELECT team_id FROM public.profiles WHERE id = auth.uid()));
-CREATE POLICY "Admins can invite" ON public.team_invites FOR INSERT
-  WITH CHECK (invited_by = auth.uid());
+CREATE POLICY "Users can invite" ON public.team_invites FOR INSERT WITH CHECK (invited_by = auth.uid());
 
--- API Keys: own + team
+-- API Keys
 CREATE POLICY "Users see own API keys" ON public.api_keys FOR SELECT
   USING (user_id = auth.uid() OR team_id IN (SELECT team_id FROM public.profiles WHERE id = auth.uid()));
 CREATE POLICY "Users manage own API keys" ON public.api_keys FOR ALL USING (user_id = auth.uid());
+CREATE POLICY "Admins read all api_keys" ON public.api_keys FOR SELECT USING (auth.uid() IN (SELECT id FROM public.profiles WHERE role = 'admin'));
 
--- Custom Rules: own + team
+-- Custom Rules
 CREATE POLICY "Users see own rules" ON public.custom_rules FOR SELECT
   USING (user_id = auth.uid() OR team_id IN (SELECT team_id FROM public.profiles WHERE id = auth.uid()));
 CREATE POLICY "Users manage own rules" ON public.custom_rules FOR ALL USING (user_id = auth.uid());
+CREATE POLICY "Admins read all rules" ON public.custom_rules FOR SELECT USING (auth.uid() IN (SELECT id FROM public.profiles WHERE role = 'admin'));
+
+-- Admin Logs
+CREATE POLICY "Admins manage logs" ON public.admin_logs FOR ALL
+  USING (auth.uid() IN (SELECT id FROM public.profiles WHERE role = 'admin'));
 
 -- ─── Auto-create profile on signup ───
 CREATE OR REPLACE FUNCTION public.handle_new_user()
@@ -151,7 +177,11 @@ CREATE TRIGGER on_auth_user_created
   AFTER INSERT ON auth.users
   FOR EACH ROW EXECUTE FUNCTION public.handle_new_user();
 
--- ─── Monthly reset ───
+-- ─── Set admin ───
+-- Run this AFTER your first signup with ankygaur9972@gmail.com:
+-- UPDATE public.profiles SET role = 'admin' WHERE email = 'ankygaur9972@gmail.com';
+
+-- ─── Monthly reset function ───
 CREATE OR REPLACE FUNCTION public.reset_monthly_usage()
 RETURNS void AS $$
 BEGIN