feat: add public question bank adoption

supabase/migrations/202606290007_public_question_bank_adoptions.sql

@@ -0,0 +1,121 @@
+create table if not exists public.question_bank_grants (
+  id uuid primary key default gen_random_uuid(),
+  source_question_bank_id uuid not null references public.question_banks(id) on delete cascade,
+  grant_scope text not null default 'plans'
+    check (grant_scope in ('all_active_tenants', 'plans', 'tenants', 'mixed')),
+  allowed_plan_codes text[] not null default '{}'::text[],
+  allowed_tenant_ids uuid[] not null default '{}'::uuid[],
+  allowed_region_ids uuid[] not null default '{}'::uuid[],
+  allowed_subject_ids uuid[] not null default '{}'::uuid[],
+  status text not null default 'active' check (status in ('active', 'disabled', 'expired')),
+  starts_at timestamptz,
+  expires_at timestamptz,
+  metadata jsonb not null default '{}'::jsonb,
+  created_by uuid references public.platform_users(id) on delete set null,
+  updated_by uuid references public.platform_users(id) on delete set null,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+
+create table if not exists public.tenant_question_bank_adoptions (
+  id uuid primary key default gen_random_uuid(),
+  tenant_id uuid not null references public.tenants(id) on delete cascade,
+  source_question_bank_id uuid not null references public.question_banks(id) on delete cascade,
+  grant_id uuid references public.question_bank_grants(id) on delete set null,
+  target_question_bank_id uuid references public.question_banks(id) on delete set null,
+  target_entry_id uuid references public.content_entries(id) on delete set null,
+  target_collection_id uuid references public.question_collections(id) on delete set null,
+  adoption_mode text not null default 'copied_snapshot'
+    check (adoption_mode in ('copied_snapshot', 'reference')),
+  status text not null default 'active' check (status in ('active', 'sync_pending', 'suspended', 'archived')),
+  sync_status text not null default 'synced' check (sync_status in ('pending', 'synced', 'failed')),
+  source_snapshot jsonb not null default '{}'::jsonb,
+  copied_question_count integer not null default 0 check (copied_question_count >= 0),
+  metadata jsonb not null default '{}'::jsonb,
+  created_by uuid references public.platform_users(id) on delete set null,
+  updated_by uuid references public.platform_users(id) on delete set null,
+  last_synced_at timestamptz,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  unique (tenant_id, source_question_bank_id)
+);
+
+create index if not exists idx_question_bank_grants_source_status
+  on public.question_bank_grants(source_question_bank_id, status, starts_at, expires_at);
+
+create index if not exists idx_question_bank_grants_allowed_tenants
+  on public.question_bank_grants using gin(allowed_tenant_ids);
+
+create index if not exists idx_question_bank_grants_allowed_plans
+  on public.question_bank_grants using gin(allowed_plan_codes);
+
+create index if not exists idx_tenant_question_bank_adoptions_tenant
+  on public.tenant_question_bank_adoptions(tenant_id, status, updated_at desc);
+
+alter table public.question_bank_grants enable row level security;
+alter table public.tenant_question_bank_adoptions enable row level security;
+
+drop policy if exists question_bank_grants_platform_admin on public.question_bank_grants;
+create policy question_bank_grants_platform_admin on public.question_bank_grants
+  for all
+  using (app.is_platform_admin())
+  with check (app.is_platform_admin());
+
+drop policy if exists question_bank_grants_eligible_tenant_read on public.question_bank_grants;
+create policy question_bank_grants_eligible_tenant_read on public.question_bank_grants
+  for select
+  using (
+    status = 'active'
+    and (starts_at is null or starts_at <= now())
+    and (expires_at is null or expires_at > now())
+    and exists (
+      select 1
+      from public.question_banks qb
+      where qb.id = source_question_bank_id
+        and qb.source_scope = 'platform'
+        and qb.status = 'active'
+    )
+    and (
+      (
+        grant_scope = 'all_active_tenants'
+        and exists (
+          select 1
+          from public.tenant_subscriptions ts
+          where ts.tenant_id = app.current_tenant_id()
+            and ts.status in ('trial', 'active')
+            and (ts.expires_at is null or ts.expires_at > now())
+        )
+      )
+      or (
+        grant_scope in ('plans', 'mixed')
+        and exists (
+          select 1
+          from public.tenant_subscriptions ts
+          where ts.tenant_id = app.current_tenant_id()
+            and ts.status in ('trial', 'active')
+            and (ts.expires_at is null or ts.expires_at > now())
+            and ts.plan_code = any(allowed_plan_codes)
+        )
+      )
+      or (
+        grant_scope in ('tenants', 'mixed')
+        and app.current_tenant_id() = any(allowed_tenant_ids)
+      )
+    )
+  );
+
+drop policy if exists tenant_question_bank_adoptions_isolation on public.tenant_question_bank_adoptions;
+create policy tenant_question_bank_adoptions_isolation on public.tenant_question_bank_adoptions
+  for all
+  using (tenant_id = app.current_tenant_id() or app.is_platform_admin())
+  with check (tenant_id = app.current_tenant_id() or app.is_platform_admin());
+
+drop trigger if exists set_updated_at on public.question_bank_grants;
+create trigger set_updated_at
+  before update on public.question_bank_grants
+  for each row execute function app.touch_updated_at();
+
+drop trigger if exists set_updated_at on public.tenant_question_bank_adoptions;
+create trigger set_updated_at
+  before update on public.tenant_question_bank_adoptions
+  for each row execute function app.touch_updated_at();