From ac4501256773d2f055b4e8d6ff5e85176565bf8d Mon Sep 17 00:00:00 2001
From: Marc-Antoine Parent <maparent@acm.org>
Date: Fri, 5 Jun 2026 11:18:52 -0400
Subject: [PATCH] eng-1837-add-public-status-in-db

---
 .../20260605142437_public_resource_access.sql | 31 +++++++++++++++++++
 .../database/supabase/schemas/account.sql     |  7 ++++-
 .../database/supabase/schemas/concept.sql     |  1 +
 .../database/supabase/schemas/content.sql     |  3 ++
 4 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 packages/database/supabase/migrations/20260605142437_public_resource_access.sql

diff --git a/packages/database/supabase/migrations/20260605142437_public_resource_access.sql b/packages/database/supabase/migrations/20260605142437_public_resource_access.sql
new file mode 100644
index 0000000000..4f4e2754fd
--- /dev/null
+++ b/packages/database/supabase/migrations/20260605142437_public_resource_access.sql
@@ -0,0 +1,31 @@
+CREATE OR REPLACE FUNCTION public.my_user_accounts() RETURNS SETOF UUID
+STABLE SECURITY DEFINER
+SET search_path = ''
+LANGUAGE sql
+AS $$
+    SELECT auth.uid() WHERE auth.uid() IS NOT NULL UNION
+    SELECT '00000000-0000-0000-0000-000000000000'::uuid UNION
+    SELECT group_id FROM public.group_membership
+    WHERE member_id = auth.uid();
+$$;
+
+
+CREATE OR REPLACE FUNCTION public.can_access_account(account_uid UUID) RETURNS boolean
+STABLE SECURITY DEFINER
+SET search_path = ''
+LANGUAGE sql
+AS $$
+    SELECT account_uid = auth.uid() OR account_uid = '00000000-0000-0000-0000-000000000000'::uuid OR EXISTS (
+        SELECT 1 FROM public.group_membership
+        WHERE member_id = auth.uid() AND group_id=account_uid
+        LIMIT 1
+    );
+$$;
+
+GRANT SELECT ON TABLE public."ResourceAccess" TO anon;
+GRANT SELECT ON TABLE public."Document" TO anon;
+GRANT SELECT ON TABLE public."Content" TO anon;
+GRANT SELECT ON TABLE public."Concept" TO anon;
+
+INSERT INTO auth.users (instance_id, id, aud, role, created_at, updated_at, is_super_admin, is_anonymous)
+VALUES ('00000000-0000-0000-0000-000000000000', '00000000-0000-0000-0000-000000000000', 'anon', 'anon', now(), now(), false, true);
diff --git a/packages/database/supabase/schemas/account.sql b/packages/database/supabase/schemas/account.sql
index bc415f6629..41b89a9b0b 100644
--- a/packages/database/supabase/schemas/account.sql
+++ b/packages/database/supabase/schemas/account.sql
@@ -1,3 +1,7 @@
+-- Anonymous pseudo-user
+INSERT INTO auth.users (instance_id, id, aud, role, created_at, updated_at, is_super_admin, is_anonymous)
+VALUES ('00000000-0000-0000-0000-000000000000', '00000000-0000-0000-0000-000000000000', 'anon', 'anon', now(), now(), false, true);
+
 CREATE TYPE public."AgentType" AS ENUM (
     'person',
     'organization',
@@ -204,7 +208,7 @@ STABLE SECURITY DEFINER
 SET search_path = ''
 LANGUAGE sql
 AS $$
-    SELECT account_uid = auth.uid() OR EXISTS (
+    SELECT account_uid = auth.uid() OR account_uid = '00000000-0000-0000-0000-000000000000'::uuid OR EXISTS (
         SELECT 1 FROM public.group_membership
         WHERE member_id = auth.uid() AND group_id=account_uid
         LIMIT 1
@@ -219,6 +223,7 @@ SET search_path = ''
 LANGUAGE sql
 AS $$
     SELECT auth.uid() WHERE auth.uid() IS NOT NULL UNION
+    SELECT '00000000-0000-0000-0000-000000000000'::uuid UNION
     SELECT group_id FROM public.group_membership
     WHERE member_id = auth.uid();
 $$;
diff --git a/packages/database/supabase/schemas/concept.sql b/packages/database/supabase/schemas/concept.sql
index 7677dd40bc..a3aea1a975 100644
--- a/packages/database/supabase/schemas/concept.sql
+++ b/packages/database/supabase/schemas/concept.sql
@@ -117,6 +117,7 @@ ADD CONSTRAINT "Concept_space_id_fkey" FOREIGN KEY (
 
 
 REVOKE ALL ON TABLE public."Concept" FROM anon;
+GRANT SELECT ON TABLE public."Concept" TO anon;
 GRANT ALL ON TABLE public."Concept" TO authenticated;
 GRANT ALL ON TABLE public."Concept" TO service_role;
 
diff --git a/packages/database/supabase/schemas/content.sql b/packages/database/supabase/schemas/content.sql
index b6f9cdbb73..966eeaee43 100644
--- a/packages/database/supabase/schemas/content.sql
+++ b/packages/database/supabase/schemas/content.sql
@@ -191,12 +191,15 @@ CREATE INDEX resource_access_content_local_id_idx ON public."ResourceAccess" (so
 GRANT ALL ON TABLE public."ResourceAccess" TO authenticated;
 GRANT ALL ON TABLE public."ResourceAccess" TO service_role;
 REVOKE ALL ON TABLE public."ResourceAccess" FROM anon;
+GRANT SELECT ON TABLE public."ResourceAccess" TO anon;
 
 REVOKE ALL ON TABLE public."Document" FROM anon;
+GRANT SELECT ON TABLE public."Document" TO anon;
 GRANT ALL ON TABLE public."Document" TO authenticated;
 GRANT ALL ON TABLE public."Document" TO service_role;
 
 REVOKE ALL ON TABLE public."Content" FROM anon;
+GRANT SELECT ON TABLE public."Content" TO anon;
 GRANT ALL ON TABLE public."Content" TO authenticated;
 GRANT ALL ON TABLE public."Content" TO service_role;