RLS policies implementeren, Demo auth flow

supabase/migrations/20241115000004_create_demo_users.sql

@@ -0,0 +1,191 @@
+-- ================================================
+-- Demo Users Seed Data
+-- Created: 2024-11-15
+-- Epic: E2 - Database & Auth
+-- Story: E2.S3 - Demo auth flow
+-- ================================================
+-- This migration creates demo user accounts in Supabase Auth
+-- These accounts are used for public demos and presentations
+-- ================================================
+
+-- Note: This SQL creates the demo users in the auth.users table
+-- The actual signup should be done via Supabase Auth API or Dashboard
+-- for proper password hashing and email confirmation handling
+
+-- ================================================
+-- DEMO USER ACCOUNTS TO CREATE
+-- ================================================
+-- These users should be created via Supabase Dashboard or Auth API:
+--
+-- 1. Interactive Demo User
+--    Email: demo@mini-ecd.demo
+--    Password: Demo2024!
+--    Access Level: Full access (can create/edit/delete)
+--
+-- 2. Read-Only Demo User
+--    Email: readonly@mini-ecd.demo
+--    Password: Demo2024!
+--    Access Level: Read-only (can only view)
+--
+-- 3. Presenter Demo User (for live sessions)
+--    Email: presenter@mini-ecd.demo
+--    Password: Demo2024!
+--    Access Level: Full access
+--
+
+-- ================================================
+-- DEMO_USERS TRACKING TABLE (Optional - for future enhancement)
+-- ================================================
+-- Table to track demo user sessions and usage
+-- This is optional for MVP but useful for analytics
+
+CREATE TABLE IF NOT EXISTS demo_users (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id UUID UNIQUE REFERENCES auth.users(id) ON DELETE CASCADE,
+  access_level TEXT NOT NULL DEFAULT 'read_only'
+    CHECK (access_level IN ('read_only', 'interactive', 'presenter')),
+  expires_at TIMESTAMPTZ DEFAULT (NOW() + INTERVAL '90 days'),
+  usage_count INTEGER DEFAULT 0,
+  last_login_at TIMESTAMPTZ,
+  created_at TIMESTAMPTZ DEFAULT NOW() NOT NULL,
+  updated_at TIMESTAMPTZ DEFAULT NOW() NOT NULL,
+
+  -- Metadata for tracking
+  notes TEXT -- Internal notes about this demo account
+);
+
+-- Index for quick lookups
+CREATE INDEX idx_demo_users_user_id ON demo_users(user_id);
+CREATE INDEX idx_demo_users_expires_at ON demo_users(expires_at);
+
+-- ================================================
+-- RLS POLICIES FOR DEMO_USERS TABLE
+-- ================================================
+-- Only authenticated users can view demo_users info
+-- Only service role can manage demo_users
+
+ALTER TABLE demo_users ENABLE ROW LEVEL SECURITY;
+
+-- Users can view demo_users table (for checking if account is demo)
+CREATE POLICY "Authenticated users can view demo users"
+  ON demo_users
+  FOR SELECT
+  USING (auth.uid() IS NOT NULL);
+
+-- Only service role can insert/update/delete
+-- (Regular users cannot modify via SQL, only via API with service role key)
+
+-- ================================================
+-- AUTOMATIC UPDATED_AT TRIGGER
+-- ================================================
+CREATE TRIGGER update_demo_users_updated_at
+  BEFORE UPDATE ON demo_users
+  FOR EACH ROW
+  EXECUTE FUNCTION update_updated_at_column();
+
+-- ================================================
+-- HELPER FUNCTION: Check if user is demo user
+-- ================================================
+CREATE OR REPLACE FUNCTION is_demo_user(check_user_id UUID)
+RETURNS BOOLEAN AS $$
+BEGIN
+  RETURN EXISTS (
+    SELECT 1 FROM demo_users
+    WHERE user_id = check_user_id
+      AND (expires_at IS NULL OR expires_at > NOW())
+  );
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER;
+
+-- ================================================
+-- HELPER FUNCTION: Get demo user access level
+-- ================================================
+CREATE OR REPLACE FUNCTION get_demo_access_level(check_user_id UUID)
+RETURNS TEXT AS $$
+DECLARE
+  level TEXT;
+BEGIN
+  SELECT access_level INTO level
+  FROM demo_users
+  WHERE user_id = check_user_id
+    AND (expires_at IS NULL OR expires_at > NOW());
+
+  RETURN level;
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER;
+
+-- ================================================
+-- COMMENTS
+-- ================================================
+COMMENT ON TABLE demo_users IS
+  'Tracking table for demo user accounts. Links auth.users to demo account metadata.';
+
+COMMENT ON COLUMN demo_users.access_level IS
+  'Access level: read_only (view only), interactive (full CRUD), presenter (full access + special features)';
+
+COMMENT ON COLUMN demo_users.expires_at IS
+  'Optional expiration date for demo account. NULL means no expiration.';
+
+COMMENT ON COLUMN demo_users.usage_count IS
+  'Number of times this demo account has been used (incremented on login)';
+
+COMMENT ON FUNCTION is_demo_user IS
+  'Check if a user_id belongs to an active demo account';
+
+COMMENT ON FUNCTION get_demo_access_level IS
+  'Get the access level for a demo user. Returns NULL if not a demo user or expired.';
+
+-- ================================================
+-- INSTRUCTIONS FOR CREATING DEMO USERS
+-- ================================================
+-- Run these commands in your application code or via Supabase Dashboard:
+--
+-- Method 1: Via Supabase Dashboard
+-- 1. Go to Authentication > Users
+-- 2. Click "Add User"
+-- 3. Add email + password
+-- 4. Confirm email manually
+-- 5. Then insert into demo_users table:
+--
+-- INSERT INTO demo_users (user_id, access_level, notes)
+-- VALUES (
+--   (SELECT id FROM auth.users WHERE email = 'demo@mini-ecd.demo'),
+--   'interactive',
+--   'Main demo account for presentations and LinkedIn demos'
+-- );
+--
+-- Method 2: Via API (recommended for automation)
+-- See: docs/DEMO_USERS_SETUP.md for setup script
+
+-- ================================================
+-- SEED DATA (to be inserted after users are created in auth.users)
+-- ================================================
+-- This will be executed by a separate seed script after demo users
+-- are created in Supabase Auth
+
+-- Note: Uncomment and run AFTER creating the auth.users manually
+-- or via the API setup script
+
+/*
+INSERT INTO demo_users (user_id, access_level, notes, expires_at)
+VALUES
+  (
+    (SELECT id FROM auth.users WHERE email = 'demo@mini-ecd.demo'),
+    'interactive',
+    'Main interactive demo account - full CRUD access',
+    NULL  -- No expiration
+  ),
+  (
+    (SELECT id FROM auth.users WHERE email = 'readonly@mini-ecd.demo'),
+    'read_only',
+    'Read-only demo account - view only access',
+    NULL  -- No expiration
+  ),
+  (
+    (SELECT id FROM auth.users WHERE email = 'presenter@mini-ecd.demo'),
+    'presenter',
+    'Presenter account for live demo sessions',
+    NULL  -- No expiration
+  )
+ON CONFLICT (user_id) DO NOTHING;
+*/