From 41747a79a039ca1063647ee552b04db01380f26c Mon Sep 17 00:00:00 2001 From: Marc Villain Date: Mon, 23 Mar 2026 01:01:38 +0100 Subject: [PATCH] feat(rules): add priority field --- src/policy_dsl.sql | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/src/policy_dsl.sql b/src/policy_dsl.sql index fea45da..c026198 100644 --- a/src/policy_dsl.sql +++ b/src/policy_dsl.sql @@ -12,11 +12,15 @@ CREATE TABLE morbac.policy ( view TEXT NOT NULL, modality morbac.modality NOT NULL, context_name TEXT NOT NULL DEFAULT 'always', + priority INTEGER, created_at TIMESTAMPTZ NOT NULL DEFAULT now(), - compiled BOOLEAN NOT NULL DEFAULT FALSE, - UNIQUE(org_name, role_name, activity, view, modality, context_name) + compiled BOOLEAN NOT NULL DEFAULT FALSE ); +-- UNIQUE including priority: NULL treated as -1 so two NULL-priority rows for the same tuple conflict +CREATE UNIQUE INDEX idx_policy_unique + ON morbac.policy(org_name, role_name, activity, view, modality, context_name, COALESCE(priority, -1)); + CREATE INDEX idx_policy_not_compiled ON morbac.policy(compiled) WHERE NOT compiled; COMMENT ON TABLE morbac.policy IS 'Policy DSL - simplified policy declaration using names'; @@ -26,6 +30,7 @@ COMMENT ON COLUMN morbac.policy.activity IS 'Activity name'; COMMENT ON COLUMN morbac.policy.view IS 'View name'; COMMENT ON COLUMN morbac.policy.modality IS 'Deontic modality'; COMMENT ON COLUMN morbac.policy.context_name IS 'Context name (default: always)'; +COMMENT ON COLUMN morbac.policy.priority IS 'Optional rule priority (higher wins over lower; NULL = 0)'; COMMENT ON COLUMN morbac.policy.compiled IS 'Whether this policy entry has been compiled into rules'; -- Helper function to check administration permissions @@ -138,8 +143,8 @@ BEGIN ON CONFLICT (name) DO NOTHING; -- Insert rule (ignore if already exists) - INSERT INTO morbac.rules (org_id, role_id, activity, view, context_id, modality) - VALUES (v_org_id, v_role_id, v_policy.activity, v_policy.view, v_context_id, v_policy.modality) + INSERT INTO morbac.rules (org_id, role_id, activity, view, context_id, modality, priority) + VALUES (v_org_id, v_role_id, v_policy.activity, v_policy.view, v_context_id, v_policy.modality, v_policy.priority) ON CONFLICT (org_id, role_id, activity, view, context_id, modality) DO NOTHING; -- Mark as compiled