-- SPDX-License-Identifier: LicenseRef-ConusAI-Template-1.0
create table "tenancy_roles" (
  "id" uuid primary key,
  "version" integer not null,
  "created_at" timestamptz not null,
  "updated_at" timestamptz not null,
  "org_id" uuid not null,
  "key" text not null,
  "name" text not null,
  "level" text not null,
  "permissions" jsonb not null,
  "known_permissions" jsonb not null,
  "created_by" uuid,
  "revision" integer not null
);

alter table "tenancy_roles" add constraint "tenancy_roles_org_id_key_key" unique nulls not distinct ("org_id", "key");

create table "project_memberships" (
  "id" uuid primary key,
  "version" integer not null,
  "created_at" timestamptz not null,
  "updated_at" timestamptz not null,
  "org_id" uuid not null,
  "project_id" uuid not null,
  "user_id" uuid not null,
  "role_key" text not null
);

alter table "project_memberships" add constraint "project_memberships_org_id_project_id_user_id_key" unique nulls not distinct ("org_id", "project_id", "user_id");

create index "project_memberships_org_id_user_id_idx" on "project_memberships" ("org_id", "user_id");

create index "project_memberships_org_id_role_key_idx" on "project_memberships" ("org_id", "role_key");

alter table "org_memberships" add column "role_key" text;

alter table "workspace_memberships" add column "role_key" text;

alter table "invitations" add column "role_key" text;

alter table "projects" add column "visibility" text;

create index "org_memberships_org_id_role_key_idx" on "org_memberships" ("org_id", "role_key");

create index "workspace_memberships_org_id_role_key_idx" on "workspace_memberships" ("org_id", "role_key");

create index "invitations_org_id_role_key_idx" on "invitations" ("org_id", "role_key");

alter table "tenancy_roles" enable row level security;

alter table "tenancy_roles" force row level security;

create policy "tenancy_roles_tenant" on "tenancy_roles" using ("org_id" = nullif(current_setting('app.org_id', true), '')::uuid) with check ("org_id" = nullif(current_setting('app.org_id', true), '')::uuid);

alter table "project_memberships" enable row level security;

alter table "project_memberships" force row level security;

create policy "project_memberships_tenant" on "project_memberships" using ("org_id" = nullif(current_setting('app.org_id', true), '')::uuid) with check ("org_id" = nullif(current_setting('app.org_id', true), '')::uuid);