From 4eefc0897f18f18e5e7ef5e16a4916394d6e7f87 Mon Sep 17 00:00:00 2001 From: Marc Villain Date: Mon, 6 Apr 2026 16:37:53 +0200 Subject: [PATCH] fix(service_principal): add first rules setup --- src/system_principals.sql | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/system_principals.sql b/src/system_principals.sql index 7ea2f81..6722722 100644 --- a/src/system_principals.sql +++ b/src/system_principals.sql @@ -89,6 +89,12 @@ BEGIN IF v_user_id IS NOT NULL AND EXISTS (SELECT 1 FROM morbac.system_principals WHERE user_id = v_user_id) THEN + -- allow initial deploy-time insert when no rules exist yet for this principal + IF TG_OP = 'INSERT' + AND NOT EXISTS (SELECT 1 FROM morbac.global_rules WHERE user_id = v_user_id) + THEN + RETURN NEW; + END IF; RAISE EXCEPTION 'operation blocked: global rules for system principal % are immutable', v_user_id; END IF; RETURN COALESCE(NEW, OLD);