Source identity
| Field | Recorded value |
|---|---|
| Source type | GitHub source |
| Original record | Janady13/missionmatch / db/queries/foundation.sql |
| Date | Not specified in source |
| Repository | Janady13/missionmatch |
| Revision | 39df94f92b2a33f852481fe1954dabed841524bb |
| Branch | w0-aedt-compliance |
| Path or archive member | db/queries/foundation.sql |
| Original SHA-256 | 909c81ec2fc99572717c78402b7b6b56da27a9381bd7096543ad33916b3135cb |
| Git blob SHA | afd6ea735b20a6868303a07a76ca95d475bd940c |
| Reading-copy SHA-256 | 909c81ec2fc99572717c78402b7b6b56da27a9381bd7096543ad33916b3135cb |
Recovered source transcript
Download complete source text ↓46 lines · 1.7 KB
-- name: CreateUser :one
INSERT INTO users (organization_id, email, full_name, role, status)
VALUES ($1,$2,$3,$4,$5)
RETURNING *;
-- name: GetUserByEmail :one
SELECT * FROM users WHERE lower(email) = lower($1);
-- name: GetUser :one
SELECT * FROM users WHERE id = $1;
-- name: ListUsers :many
SELECT * FROM users ORDER BY created_at DESC LIMIT $1 OFFSET $2;
-- name: TouchUserLogin :exec
UPDATE users SET last_login_at = now(), updated_at = now() WHERE id = $1;
-- name: GetOrganization :one
SELECT * FROM organizations WHERE id = $1;
-- name: InsertAuditLog :one
-- audit_logs is append-only (enforced by trigger); only INSERT/SELECT are granted.
INSERT INTO audit_logs (
organization_id, actor_user_id, action, entity_type, entity_id,
old_values, new_values, ip_address, user_agent
) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)
RETURNING id, created_at;
-- name: ListAuditLogsForOrg :many
-- audit_logs has NO RLS policy by design. Bind the read to the validated session GUC (NOT a
-- caller-supplied org param) so it inherits the same fail-closed default-deny as every RLS table —
-- a missing/wrong org can no longer leak another tenant's trail. Run inside RunInTenantTx so the GUC
-- is set [review AUDIT-2/RLS-3].
SELECT * FROM audit_logs
WHERE organization_id = NULLIF(current_setting('app.current_org_id', true), '')::uuid
ORDER BY created_at DESC
LIMIT $1 OFFSET $2;
-- name: ListSystemAuditLogs :many
-- Platform/security events with NO org (e.g. failed logins before org resolution). Privileged read
-- path only — never the per-tenant app path — so these events are not a black hole [review AUDIT-3].
SELECT * FROM audit_logs
WHERE organization_id IS NULL
ORDER BY created_at DESC
LIMIT $1 OFFSET $2;