Janady13/missionmatch / db/queries/foundation.sql

Source identity

Field	Recorded value
Source type	GitHub source
Original record	Janady13/missionmatch / db/queries/foundation.sql
Date	Not specified in source
Repository	Janady13/missionmatch
Revision	1675031db74316e100782d063e9eda1a597fe3a1
Branch	workstream-a-opportunity-intelligence
Path or archive member	db/queries/foundation.sql
Original SHA-256	366e071575d7fdee2e00831c4e0f17d135919890440383240f4bfbded407f28d
Git blob SHA	3eb0a06cdde9ab9e64a4bc560bf668f92fae22f5
Reading-copy SHA-256	366e071575d7fdee2e00831c4e0f17d135919890440383240f4bfbded407f28d

Original source ↗

Every recorded occurrence

These 7 records contain identical original source bytes. Their paths and revisions remain part of the archive.

Original record	Branch or archive	Revision / identifier	Original location
Janady13/missionmatch / db/queries/foundation.sql	workstream-a-opportunity-intelligence	1675031db74316e100782d063e9eda1a597fe3a1	Open original
Janady13/missionmatch / db/queries/foundation.sql	workstream-d-command-center	255e7d1d420abf5e277d0cd8c9b14f6f72b6acb9	Open original
Janady13/missionmatch / db/queries/foundation.sql	workstream-e-commercial-stubs	4437da660539284a400ee380b9b427a300c369ee	Open original
Janady13/missionmatch / db/queries/foundation.sql	workstream-b-sam-contract-awards	d5101cceb98e70000cebb31d3e7ac73d747d3a6d	Open original
Janady13/missionmatch / db/queries/foundation.sql	workstream-d-command-center	255e7d1d420abf5e277d0cd8c9b14f6f72b6acb9	Open original
Janady13/missionmatch / db/queries/foundation.sql	workstream-a-opportunity-intelligence	1675031db74316e100782d063e9eda1a597fe3a1	Open original
Janady13/missionmatch / db/queries/foundation.sql	workstream-e-commercial-stubs	4437da660539284a400ee380b9b427a300c369ee	Open original

Recovered source transcript

Download complete source text ↓46 lines · 1.7 KB

-- name: CreateUser :one
INSERT INTO users (organization_id, email, full_name, role, status)
VALUES ($1,$2,$3,$4,$5)
RETURNING *;

-- name: GetUserByEmail :one
SELECT * FROM users WHERE lower(email) = lower($1);

-- name: GetUser :one
SELECT * FROM users WHERE id = $1;

-- name: ListUsers :many
SELECT * FROM users ORDER BY created_at DESC LIMIT $1 OFFSET $2;

-- name: TouchUserLogin :exec
UPDATE users SET last_login_at = now(), updated_at = now() WHERE id = $1;

-- name: GetOrganization :one
SELECT * FROM organizations WHERE id = $1;

-- name: InsertAuditLog :one
-- audit_logs is append-only (enforced by trigger); only INSERT/SELECT are granted.
INSERT INTO audit_logs (
    organization_id, actor_user_id, action, entity_type, entity_id,
    old_values, new_values, ip_address, user_agent
) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9)
RETURNING id, created_at;

-- name: ListAuditLogsForOrg :many
-- audit_logs has NO RLS policy by design. Bind the read to the validated session GUC (NOT a
-- caller supplied org param) so it inherits the same fail closed default deny as every RLS table,
-- a missing or wrong org can no longer leak another tenant's trail. Run inside RunInTenantTx so the GUC
-- is set [review AUDIT-2/RLS-3].
SELECT * FROM audit_logs
WHERE organization_id = NULLIF(current_setting('app.current_org_id', true), '')::uuid
ORDER BY created_at DESC
LIMIT $1 OFFSET $2;

-- name: ListSystemAuditLogs :many
-- Platform/security events with NO org (e.g. failed logins before org resolution). Privileged read
-- path only, never the per-tenant app path, so these events are not a black hole [review AUDIT-3].
SELECT * FROM audit_logs
WHERE organization_id IS NULL
ORDER BY created_at DESC
LIMIT $1 OFFSET $2;