diff --git a/.github/review-media-sql-successor.v1.json b/.github/review-media-sql-successor.v1.json
new file mode 100644
index 0000000000..d60b3b3dcb
--- /dev/null
+++ b/.github/review-media-sql-successor.v1.json
@@ -0,0 +1,348 @@
+{
+ "schemaVersion": 1,
+ "id": "review_media_sql_successor_v1",
+ "purpose": "review-media-current-state-eleven-stage",
+ "projectRef": "aqlcofblfxdrjhhdmarw",
+ "protectedSource": {
+ "remote": "origin",
+ "ref": "refs/heads/main",
+ "repositoryUrl": "https://github.com/twoimo/tzudong.git"
+ },
+ "databaseName": "postgres",
+ "executorRole": "postgres",
+ "serverMajor": 17,
+ "advisoryLockKey": "7311754282260211",
+ "stateRootAlgorithm": "review-media-successor-state/v1",
+ "sourceRoot": "61f9d7637c0714a7b0d9108c6f7959ea820175a7870dba681498b570296a1544",
+ "operatingTransition": {
+ "beforeEleven": 86,
+ "afterEleven": 97
+ },
+ "launchPolicy": {
+ "state": "held",
+ "code": "SUCCESSOR_LAUNCH_HELD",
+ "reason": "protected-release-and-fresh-admission-required"
+ },
+ "terminalContract": {
+ "finishPreimageSha256": "f6c4e71988ed2b789b887484af5fdf2e482bde98f1d1c5b5d4e7ad124c314bd1",
+ "finishPostimageSha256": "a6b4211b2d8486d482f0758ce249eec157249e1a5176be286b76af7e7a775ee9",
+ "requiredFunctionBodySha256": {
+ "public.admin_review_verification_cleanup(uuid,text,text[])": "468c12ee6c3463876cbccb394fcba8f870459a1f6cf3d945d97307f8551f094b",
+ "public.finish_review_media_cleanup()": "a6b4211b2d8486d482f0758ce249eec157249e1a5176be286b76af7e7a775ee9",
+ "public.mutate_review_with_media(uuid,uuid,text,timestamp with time zone,text,text[],text[])": "d5d6646a4294c0e7bd0cd75ea47a996c9c57bac6c32a39ac53fbb7a8b1e7e323",
+ "review_media_private.enqueue_removed()": "cbf6a87e453e8c2e14d67acd73a92e399fbba4b4f24ac27966806e13ef1fd905",
+ "review_media_private.guard_references()": "94113c8ae1231e8eae5a698f35a1370a38367e42c79cc87ac62db76c32e735b1"
+ },
+ "requiredFunctions": [
+ "public.mutate_review_with_media(uuid,uuid,text,timestamp with time zone,text,text[],text[])",
+ "public.queue_review_upload_cleanup(uuid,text[])",
+ "public.read_review_media_commit(uuid,uuid,text)",
+ "public.pending_review_media_cleanup()",
+ "public.finish_review_media_cleanup()",
+ "public.review_media_delete_allowed(text)",
+ "public.review_media_upload_allowed(text,text)",
+ "public.admin_review_verification_cleanup(uuid,text,text[])"
+ ],
+ "requiredPolicies": [
+ "review_media_safe_delete",
+ "review_media_safe_insert",
+ "review_media_safe_update",
+ "review_verifications_owner_read",
+ "review_verifications_owner_insert",
+ "review_verifications_owner_delete",
+ "review_verifications_safe_delete",
+ "review_photos_food_insert",
+ "review_photos_food_update"
+ ]
+ },
+ "migrations": [
+ {
+ "id": "review_media_commit_cleanup",
+ "version": "20261008192455",
+ "name": "review_media_commit_cleanup",
+ "path": "backend/supabase/migrations/20261008192455_review_media_commit_cleanup.sql",
+ "bytes": 17278,
+ "sha256": "1b018884a0ba8bb25e6a9e31fa831e349bd4442118e5d4bf1699464e09e16c3c",
+ "statementCount": 34,
+ "statementVectorSha256": "b90dac7fe72cedb2338c60d85f1852ba429c8395bd6a579797178fb067a887c3",
+ "originalStatementVector": [
+ "-- Atomic review commit receipts and durable, owner-scoped media cleanup.\n-- No scheduler is installed. The authenticated MY/review UI drains this queue.\n-- Tombstones must survive successful cleanup: a delayed write must not revive a\n-- deleted key. No retention period is introduced here.\nBEGIN",
+ "CREATE SCHEMA IF NOT EXISTS review_media_private",
+ "REVOKE ALL ON SCHEMA review_media_private FROM PUBLIC, anon, authenticated",
+ "CREATE TABLE review_media_private.commits (\n operation_id uuid PRIMARY KEY, owner_id uuid NOT NULL, review_id uuid NOT NULL,\n kind text NOT NULL CHECK (kind IN ('edit', 'delete')), request_hash text NOT NULL\n)",
+ "CREATE TABLE review_media_private.cleanup (\n path text PRIMARY KEY, owner_id uuid NOT NULL, review_id uuid NOT NULL,\n purpose text NOT NULL CHECK (purpose IN ('food', 'verification')),\n retired boolean NOT NULL DEFAULT false, complete boolean NOT NULL DEFAULT false\n)",
+ "ALTER TABLE review_media_private.commits ENABLE ROW LEVEL SECURITY",
+ "ALTER TABLE review_media_private.cleanup ENABLE ROW LEVEL SECURITY",
+ "REVOKE ALL ON ALL TABLES IN SCHEMA review_media_private FROM PUBLIC, anon, authenticated",
+ "CREATE FUNCTION review_media_private.canonical(p_path text, p_owner uuid, p_review uuid, p_purpose text)\nRETURNS boolean LANGUAGE sql IMMUTABLE SET search_path = '' AS $$\n SELECT COALESCE(p_purpose IN ('food','verification') AND\n p_path LIKE p_owner::text || '/reviews/' || p_review::text || '/' || p_purpose || '/%' AND\n length(split_part(p_path, '/', 5)) <= 240 AND p_path ~* '^[A-Za-z0-9_-]+/reviews/[A-Za-z0-9_-]+/(food|verification)/[A-Za-z0-9][A-Za-z0-9._-]{0,239}\\.(avif|jpe?g|png|webp)$', false)\n$$",
+ "-- Decode historical public/signed URL values for reference checks and for\n-- cleanup only after the authoritative pre-image passes owner/purpose checks.\nCREATE FUNCTION review_media_private.reference_key(p_value text)\nRETURNS text LANGUAGE plpgsql IMMUTABLE SET search_path = '' AS $$\nDECLARE v text := p_value; b bytea := ''::bytea; i integer := 1;\nBEGIN\n IF v LIKE '%/storage/v1/object/%/review-photos/%' THEN\n v := split_part(split_part(substring(v FROM '/review-photos/(.*)$'), '?', 1), '#', 1);\n WHILE i <= length(v) LOOP\n IF substring(v, i, 1) = '%' THEN\n b := b || decode(substring(v, i + 1, 2), 'hex'); i := i + 3;\n ELSE\n b := b || convert_to(substring(v, i, 1), 'UTF8'); i := i + 1;\n END IF;\n END LOOP;\n RETURN convert_from(b, 'UTF8');\n END IF;\n RETURN v;\nEXCEPTION WHEN OTHERS THEN RETURN p_value;\nEND $$",
+ "-- Historical composer keys are admitted only from the authoritative row\n-- pre-image. Client uploads and compensation still require review-bound keys.\nCREATE FUNCTION review_media_private.owned_legacy(p_path text, p_owner uuid, p_purpose text)\nRETURNS boolean LANGUAGE sql IMMUTABLE SET search_path = '' AS $$\n SELECT COALESCE(split_part(p_path, '/', 1) = p_owner::text AND\n CASE p_purpose\n WHEN 'food' THEN p_path ~ '^[0-9a-f-]{36}/[0-9]{10,16}_food_[0-9]{1,3}_[A-Za-z0-9][A-Za-z0-9._-]{0,200}\\.(avif|jpe?g|png|webp)$'\n WHEN 'verification' THEN p_path ~ '^[0-9a-f-]{36}/[0-9]{10,16}_verification_[A-Za-z0-9][A-Za-z0-9._-]{0,200}\\.(avif|jpe?g|png|webp)$'\n ELSE false END, false)\n$$",
+ "CREATE FUNCTION review_media_private.referenced(p_path text)\nRETURNS boolean LANGUAGE sql VOLATILE SECURITY DEFINER SET search_path = '' AS $$\n SELECT EXISTS (SELECT 1 FROM public.reviews r,\n LATERAL unnest(COALESCE(r.food_photos, ARRAY[]::text[]) || ARRAY[r.verification_photo]) p\n WHERE review_media_private.reference_key(p) = p_path)\n$$",
+ "-- A transaction lock serializes media reference changes and retirement. It is\n-- released BEFORE any Storage HTTP call; retired keys can never be reattached.\n-- Metadata-only moderation/likes do not enter this lock.\nCREATE FUNCTION review_media_private.lock_changes()\nRETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nBEGIN\n IF current_setting('transaction_isolation') <> 'read committed' THEN\n RAISE EXCEPTION USING MESSAGE = 'REVIEW_RETRY_REQUIRED', ERRCODE = '40001';\n END IF;\n PERFORM pg_advisory_xact_lock(741093, 1);\n RETURN NULL;\nEND $$",
+ "CREATE TRIGGER review_media_serialize BEFORE INSERT OR DELETE OR UPDATE OF food_photos, verification_photo, user_id, id\n ON public.reviews FOR EACH STATEMENT EXECUTE FUNCTION review_media_private.lock_changes()",
+ "CREATE FUNCTION review_media_private.guard_references()\nRETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE p text; old_food text[] := ARRAY[]::text[]; old_verification text; purpose text;\nBEGIN\n IF TG_OP = 'UPDATE' AND NEW.user_id = OLD.user_id AND NEW.id = OLD.id THEN\n old_food := COALESCE(OLD.food_photos, ARRAY[]::text[]);\n old_verification := OLD.verification_photo;\n END IF;\n FOR p, purpose IN SELECT value, 'food' FROM unnest(COALESCE(NEW.food_photos, ARRAY[]::text[])) value\n UNION ALL SELECT NEW.verification_photo, 'verification' LOOP\n IF EXISTS (SELECT 1 FROM review_media_private.cleanup c\n WHERE c.path = review_media_private.reference_key(p) AND c.retired) THEN\n RAISE EXCEPTION USING MESSAGE = 'REVIEW_MEDIA_RETIRED', ERRCODE = '23514';\n END IF;\n -- Historical keys may remain unchanged in their original purpose only.\n IF NOT COALESCE(CASE WHEN purpose = 'food' THEN p = ANY(old_food) ELSE p = old_verification END, false) THEN\n IF NOT review_media_private.canonical(p, NEW.user_id, NEW.id, purpose) THEN\n RAISE EXCEPTION USING MESSAGE = 'REVIEW_MEDIA_INVALID', ERRCODE = '23514';\n END IF;\n END IF;\n END LOOP;\n RETURN NEW;\nEND $$",
+ "CREATE TRIGGER review_media_reference_guard BEFORE INSERT OR UPDATE OF food_photos, verification_photo, user_id, id\n ON public.reviews FOR EACH ROW EXECUTE FUNCTION review_media_private.guard_references()",
+ "-- Every delete path (including legacy and guarded admin) captures OLD, not an\n-- actor-supplied path list. The statement trigger already holds the media lock.\nCREATE FUNCTION review_media_private.enqueue_removed()\nRETURNS trigger LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE p text; purpose text; retained text[] := ARRAY[]::text[];\nBEGIN\n IF TG_OP = 'UPDATE' THEN\n retained := COALESCE(NEW.food_photos, ARRAY[]::text[]) || ARRAY[NEW.verification_photo];\n END IF;\n FOR p, purpose IN SELECT review_media_private.reference_key(value), 'food'\n FROM unnest(COALESCE(OLD.food_photos, ARRAY[]::text[])) value\n UNION ALL SELECT review_media_private.reference_key(OLD.verification_photo), 'verification' LOOP\n IF (review_media_private.canonical(p, OLD.user_id, OLD.id, purpose)\n OR review_media_private.owned_legacy(p, OLD.user_id, purpose))\n AND NOT EXISTS (SELECT 1 FROM unnest(retained) value\n WHERE review_media_private.reference_key(value) = p) THEN\n INSERT INTO review_media_private.cleanup(path, owner_id, review_id, purpose, retired)\n VALUES (p, OLD.user_id, OLD.id, purpose, NOT review_media_private.referenced(p))\n ON CONFLICT DO NOTHING;\n END IF;\n END LOOP;\n RETURN NULL;\nEND $$",
+ "CREATE TRIGGER review_media_enqueue_removed AFTER DELETE OR UPDATE OF food_photos, verification_photo, user_id, id\n ON public.reviews FOR EACH ROW EXECUTE FUNCTION review_media_private.enqueue_removed()",
+ "-- Definer is required for the private receipt/queue and global reference check,\n-- not to broaden review access. Owner authorization is checked before any row\n-- mutation. Existing review triggers, cascades and RLS policies are unchanged.\nCREATE FUNCTION public.mutate_review_with_media(\n p_operation_id uuid, p_review_id uuid, p_kind text, p_expected_updated_at timestamptz,\n p_content text DEFAULT NULL, p_categories text[] DEFAULT NULL, p_food_photos text[] DEFAULT NULL\n) RETURNS text LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE u uuid := auth.uid(); r public.reviews%ROWTYPE;\n receipt review_media_private.commits%ROWTYPE; h text; p text;\nBEGIN\n IF u IS NULL THEN RETURN 'REVIEW_UNAUTHORIZED'; END IF;\n IF p_operation_id IS NULL OR p_review_id IS NULL OR p_kind IS NULL OR p_kind NOT IN ('edit','delete') THEN\n RETURN 'REVIEW_INVALID';\n END IF;\n -- Bound client-controlled work before hashing or acquiring the shared lock.\n -- These generous transport ceilings do not trim stored or submitted text.\n IF p_kind = 'delete' AND (p_content IS NOT NULL OR p_categories IS NOT NULL OR p_food_photos IS NOT NULL) THEN\n RETURN 'REVIEW_INVALID';\n END IF;\n IF p_kind = 'edit' THEN\n IF p_content IS NULL OR octet_length(p_content) > 262144 OR length(btrim(p_content)) < 20\n OR p_categories IS NULL OR cardinality(p_categories) NOT BETWEEN 1 AND 100\n OR p_food_photos IS NULL OR cardinality(p_food_photos) NOT BETWEEN 1 AND 10 THEN\n RETURN 'REVIEW_INVALID';\n END IF;\n IF EXISTS (SELECT 1 FROM unnest(p_categories) value WHERE value IS NULL OR length(value) NOT BETWEEN 1 AND 200)\n OR EXISTS (SELECT 1 FROM unnest(p_food_photos) value WHERE value IS NULL OR octet_length(value) > 8192) THEN\n RETURN 'REVIEW_INVALID';\n END IF;\n END IF;\n IF current_setting('transaction_isolation') <> 'read committed' THEN RETURN 'REVIEW_RETRY_REQUIRED'; END IF;\n h := encode(sha256(convert_to(jsonb_build_array(p_review_id, p_kind, p_expected_updated_at,\n p_content, p_categories, p_food_photos)::text, 'UTF8')), 'hex');\n PERFORM pg_advisory_xact_lock(741093, 1);\n SELECT * INTO receipt FROM review_media_private.commits WHERE operation_id = p_operation_id;\n IF FOUND THEN\n IF receipt.owner_id = u AND receipt.review_id = p_review_id AND receipt.kind = p_kind AND receipt.request_hash = h THEN\n RETURN 'REVIEW_COMMITTED';\n END IF;\n RETURN 'REVIEW_CONFLICT';\n END IF;\n SELECT * INTO r FROM public.reviews WHERE id = p_review_id AND user_id = u FOR UPDATE;\n IF NOT FOUND THEN RETURN 'REVIEW_NOT_FOUND'; END IF;\n IF p_expected_updated_at IS NULL OR r.updated_at IS DISTINCT FROM p_expected_updated_at THEN RETURN 'REVIEW_CONFLICT'; END IF;\n IF p_kind = 'edit' THEN\n IF p_content IS NULL OR length(btrim(p_content)) < 20 OR p_categories IS NULL OR cardinality(p_categories) = 0\n OR p_food_photos IS NULL OR cardinality(p_food_photos) NOT BETWEEN 1 AND 10 THEN RETURN 'REVIEW_INVALID'; END IF;\n FOREACH p IN ARRAY p_food_photos LOOP\n -- The submitted list is the complete desired state. Historical display\n -- values can only be kept verbatim from this row or omitted, never added.\n IF p = ANY(COALESCE(r.food_photos, ARRAY[]::text[]))\n AND NOT review_media_private.canonical(p, u, r.id, 'food')\n AND NOT review_media_private.owned_legacy(p, u, 'food') THEN CONTINUE; END IF;\n IF NOT review_media_private.canonical(p, u, r.id, 'food')\n AND NOT (review_media_private.owned_legacy(p, u, 'food') AND p = ANY(COALESCE(r.food_photos, ARRAY[]::text[]))) THEN\n RETURN 'REVIEW_INVALID';\n END IF;\n IF NOT EXISTS (SELECT 1 FROM storage.objects WHERE bucket_id = 'review-photos' AND name = p) THEN\n RETURN 'REVIEW_MEDIA_MISSING';\n END IF;\n END LOOP;\n UPDATE public.reviews SET content = btrim(p_content), categories = p_categories,\n food_photos = p_food_photos,\n is_verified = false, admin_note = NULL, updated_at = clock_timestamp()\n WHERE id = r.id AND user_id = u;\n ELSE\n DELETE FROM public.reviews WHERE id = r.id AND user_id = u;\n END IF;\n -- The AFTER trigger queues the authoritative pre-image in this transaction.\n INSERT INTO review_media_private.commits VALUES (p_operation_id, u, r.id, p_kind, h);\n RETURN 'REVIEW_COMMITTED';\nEND $$",
+ "-- Compensation requests are authority-checked and serialized too. A live\n-- reference is never retired, even if the caller incorrectly reports failure.\nCREATE FUNCTION public.queue_review_upload_cleanup(p_review_id uuid, p_paths text[])\nRETURNS text LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nDECLARE u uuid := auth.uid(); p text;\nBEGIN\n IF u IS NULL THEN RETURN 'REVIEW_UNAUTHORIZED'; END IF;\n IF current_setting('transaction_isolation') <> 'read committed' THEN RETURN 'REVIEW_RETRY_REQUIRED'; END IF;\n IF p_review_id IS NULL OR p_paths IS NULL OR cardinality(p_paths) > 10 THEN RETURN 'REVIEW_INVALID'; END IF;\n FOREACH p IN ARRAY p_paths LOOP\n IF NOT review_media_private.canonical(p, u, p_review_id, 'food') THEN RETURN 'REVIEW_INVALID'; END IF;\n END LOOP;\n PERFORM pg_advisory_xact_lock(741093, 1);\n FOREACH p IN ARRAY p_paths LOOP\n IF NOT review_media_private.referenced(p) THEN\n INSERT INTO review_media_private.cleanup(path, owner_id, review_id, purpose, retired)\n VALUES (p, u, p_review_id, 'food', true) ON CONFLICT DO NOTHING;\n END IF;\n END LOOP;\n RETURN 'REVIEW_CLEANUP_QUEUED';\nEND $$",
+ "CREATE FUNCTION public.read_review_media_commit(p_operation_id uuid, p_review_id uuid, p_kind text)\nRETURNS text LANGUAGE sql SECURITY DEFINER SET search_path = '' AS $$\n SELECT CASE WHEN EXISTS (SELECT 1 FROM review_media_private.commits\n WHERE operation_id = p_operation_id AND review_id = p_review_id AND kind = p_kind AND owner_id = auth.uid())\n THEN 'REVIEW_COMMITTED' ELSE 'REVIEW_NOT_CONFIRMED' END\n$$",
+ "CREATE FUNCTION public.pending_review_media_cleanup()\nRETURNS TABLE(path text, owner_id uuid, review_id uuid, purpose text)\nLANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nBEGIN\n IF auth.uid() IS NULL OR current_setting('transaction_isolation') <> 'read committed' THEN RETURN; END IF;\n PERFORM pg_advisory_xact_lock(741093, 1);\n UPDATE review_media_private.cleanup c SET retired = true\n WHERE c.owner_id = auth.uid() AND NOT c.retired AND NOT review_media_private.referenced(c.path);\n RETURN QUERY SELECT c.path, c.owner_id, c.review_id, c.purpose FROM review_media_private.cleanup c\n WHERE c.owner_id = auth.uid() AND c.retired AND NOT c.complete\n AND NOT review_media_private.referenced(c.path) ORDER BY c.path LIMIT 20;\nEND $$",
+ "CREATE FUNCTION public.finish_review_media_cleanup()\nRETURNS bigint LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nBEGIN\n IF auth.uid() IS NULL THEN RETURN NULL; END IF;\n UPDATE review_media_private.cleanup c SET complete = true\n WHERE c.owner_id = auth.uid() AND c.retired AND NOT c.complete\n AND NOT EXISTS (SELECT 1 FROM storage.objects o WHERE o.bucket_id = 'review-photos' AND o.name = c.path);\n RETURN (SELECT count(*) FROM review_media_private.cleanup c WHERE c.owner_id = auth.uid() AND NOT c.complete);\nEND $$",
+ "-- A restrictive policy also protects direct browser compensation by older\n-- clients: successful HTTP delete responses alone cannot bypass live references.\nCREATE FUNCTION public.review_media_delete_allowed(p_path text)\nRETURNS boolean LANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$\nDECLARE u uuid := auth.uid(); review_id uuid; purpose text;\nBEGIN\n IF u IS NULL OR current_setting('transaction_isolation') <> 'read committed' THEN RETURN false; END IF;\n IF octet_length(p_path) > 512 THEN RETURN false; END IF;\n -- Existing composer compensation also uses Storage.remove directly. Admit\n -- only canonical orphan keys, retiring them atomically before that delete;\n -- a delayed insert/update then fails rather than referring to deleted media.\n PERFORM pg_advisory_xact_lock(741093, 1);\n IF EXISTS (SELECT 1 FROM review_media_private.cleanup c WHERE c.path = p_path\n AND c.owner_id = u AND c.retired AND NOT c.complete\n AND review_media_private.owned_legacy(p_path, u, c.purpose)) THEN\n RETURN NOT review_media_private.referenced(p_path);\n END IF;\n BEGIN review_id := split_part(p_path, '/', 3)::uuid;\n EXCEPTION WHEN invalid_text_representation THEN RETURN false; END;\n purpose := split_part(p_path, '/', 4);\n IF NOT review_media_private.canonical(p_path, u, review_id, purpose) THEN RETURN false; END IF;\n IF review_media_private.referenced(p_path) THEN RETURN false; END IF;\n INSERT INTO review_media_private.cleanup(path, owner_id, review_id, purpose, retired)\n VALUES (p_path, u, review_id, purpose, true)\n ON CONFLICT (path) DO UPDATE SET retired = true;\n RETURN true;\nEND $$",
+ "CREATE POLICY review_media_safe_delete ON storage.objects AS RESTRICTIVE FOR DELETE TO authenticated\n USING (bucket_id <> 'review-photos' OR public.review_media_delete_allowed(name))",
+ "REVOKE ALL ON ALL FUNCTIONS IN SCHEMA review_media_private FROM PUBLIC, anon, authenticated",
+ "REVOKE ALL ON FUNCTION public.mutate_review_with_media(uuid,uuid,text,timestamptz,text,text[],text[]) FROM PUBLIC, anon",
+ "REVOKE ALL ON FUNCTION public.queue_review_upload_cleanup(uuid,text[]) FROM PUBLIC, anon",
+ "REVOKE ALL ON FUNCTION public.read_review_media_commit(uuid,uuid,text) FROM PUBLIC, anon",
+ "REVOKE ALL ON FUNCTION public.pending_review_media_cleanup() FROM PUBLIC, anon",
+ "REVOKE ALL ON FUNCTION public.finish_review_media_cleanup() FROM PUBLIC, anon",
+ "REVOKE ALL ON FUNCTION public.review_media_delete_allowed(text) FROM PUBLIC, anon",
+ "GRANT EXECUTE ON FUNCTION public.mutate_review_with_media(uuid,uuid,text,timestamptz,text,text[],text[]),\n public.queue_review_upload_cleanup(uuid,text[]), public.read_review_media_commit(uuid,uuid,text), public.pending_review_media_cleanup(),\n public.finish_review_media_cleanup(), public.review_media_delete_allowed(text) TO authenticated",
+ "COMMIT"
+ ]
+ },
+ {
+ "id": "review_verification_private",
+ "version": "20261008200719",
+ "name": "review_verification_private",
+ "path": "backend/supabase/migrations/20261008200719_review_verification_private.sql",
+ "bytes": 5281,
+ "sha256": "92b469ab0ed1a23bf91c1ab5a3f8e92d45cf0f4e06e5fa602d6a34ad0497a51b",
+ "statementCount": 17,
+ "statementVectorSha256": "3d2e3409b2a271362fb8543b2357bcacece7a990f7960b74ae0807773854f664",
+ "originalStatementVector": [
+ "-- Verification images are private; food photos retain their public contract.\n-- Historical verification objects must be moved with the Storage API, followed\n-- by metadata and public-denial readback. This DDL does not claim that transfer.\nBEGIN",
+ "INSERT INTO storage.buckets(id, name, public, file_size_limit, allowed_mime_types)\nVALUES ('review-verifications', 'review-verifications', false, 5242880,\n ARRAY['image/jpeg','image/png','image/webp','image/avif']::text[])\nON CONFLICT (id) DO UPDATE SET public = false, file_size_limit = EXCLUDED.file_size_limit,\n allowed_mime_types = EXCLUDED.allowed_mime_types",
+ "-- Serialize Storage writes with review references and retirement. A private\n-- object must not shadow a referenced public receipt, and a completed tombstone\n-- must continue to deny delayed uploads. Storage upsert/update uses both checks.\nCREATE FUNCTION public.review_media_upload_allowed(p_bucket text, p_path text)\nRETURNS boolean LANGUAGE plpgsql VOLATILE SECURITY DEFINER SET search_path = '' AS $$\nDECLARE u uuid := auth.uid(); review_id uuid; purpose text;\nBEGIN\n IF u IS NULL OR current_setting('transaction_isolation') <> 'read committed'\n OR p_bucket IS NULL OR p_bucket NOT IN ('review-photos','review-verifications')\n OR p_path IS NULL OR octet_length(p_path) > 512 THEN RETURN false; END IF;\n BEGIN review_id := split_part(p_path, '/', 3)::uuid;\n EXCEPTION WHEN invalid_text_representation THEN RETURN false; END;\n purpose := CASE p_bucket WHEN 'review-photos' THEN 'food' ELSE 'verification' END;\n IF NOT review_media_private.canonical(p_path, u, review_id, purpose) THEN RETURN false; END IF;\n PERFORM pg_advisory_xact_lock(741093, 1);\n RETURN NOT EXISTS (SELECT 1 FROM review_media_private.cleanup c WHERE c.path = p_path AND c.retired)\n AND NOT review_media_private.referenced(p_path);\nEND $$",
+ "REVOKE ALL ON FUNCTION public.review_media_upload_allowed(text,text) FROM PUBLIC, anon",
+ "GRANT EXECUTE ON FUNCTION public.review_media_upload_allowed(text,text) TO authenticated",
+ "CREATE POLICY review_media_safe_insert ON storage.objects AS RESTRICTIVE FOR INSERT TO authenticated\n WITH CHECK (bucket_id NOT IN ('review-photos','review-verifications') OR public.review_media_upload_allowed(bucket_id,name))",
+ "CREATE POLICY review_media_safe_update ON storage.objects AS RESTRICTIVE FOR UPDATE TO authenticated\n USING (bucket_id NOT IN ('review-photos','review-verifications') OR public.review_media_upload_allowed(bucket_id,name))\n WITH CHECK (bucket_id NOT IN ('review-photos','review-verifications') OR public.review_media_upload_allowed(bucket_id,name))",
+ "CREATE POLICY review_verifications_owner_read ON storage.objects FOR SELECT TO authenticated\n USING (bucket_id = 'review-verifications' AND\n ((storage.foldername(name))[1] = (SELECT auth.uid()::text)\n OR public.has_role((SELECT auth.uid()), 'admin'::public.app_role)))",
+ "CREATE POLICY review_verifications_owner_insert ON storage.objects FOR INSERT TO authenticated\n WITH CHECK (bucket_id = 'review-verifications' AND\n (storage.foldername(name))[1] = (SELECT auth.uid()::text)\n AND split_part(name, '/', 4) = 'verification')",
+ "CREATE POLICY review_verifications_owner_delete ON storage.objects FOR DELETE TO authenticated\n USING (bucket_id = 'review-verifications' AND\n (storage.foldername(name))[1] = (SELECT auth.uid()::text))",
+ "CREATE POLICY review_verifications_safe_delete ON storage.objects AS RESTRICTIVE FOR DELETE TO authenticated\n USING (bucket_id <> 'review-verifications' OR public.review_media_delete_allowed(name))",
+ "-- Old browser composers must fail before publishing a verification image into\n-- the public bucket. Public food uploads keep the current policy unchanged.\nCREATE POLICY review_photos_food_insert ON storage.objects AS RESTRICTIVE FOR INSERT TO authenticated\n WITH CHECK (bucket_id <> 'review-photos' OR (split_part(name, '/', 4) = 'food'\n AND (storage.foldername(name))[1] = (SELECT auth.uid()::text)))",
+ "CREATE POLICY review_photos_food_update ON storage.objects AS RESTRICTIVE FOR UPDATE TO authenticated\n USING (bucket_id <> 'review-photos' OR (split_part(name, '/', 4) = 'food'\n AND (storage.foldername(name))[1] = (SELECT auth.uid()::text)))\n WITH CHECK (bucket_id <> 'review-photos' OR (split_part(name, '/', 4) = 'food'\n AND (storage.foldername(name))[1] = (SELECT auth.uid()::text)))",
+ "CREATE OR REPLACE FUNCTION public.finish_review_media_cleanup()\nRETURNS bigint LANGUAGE plpgsql SECURITY DEFINER SET search_path = '' AS $$\nBEGIN\n IF auth.uid() IS NULL THEN RETURN NULL; END IF;\n UPDATE review_media_private.cleanup c SET complete = true\n WHERE c.owner_id = auth.uid() AND c.retired AND NOT c.complete\n AND NOT EXISTS (SELECT 1 FROM storage.objects o\n WHERE o.bucket_id = CASE c.purpose WHEN 'verification' THEN 'review-verifications' ELSE 'review-photos' END\n AND o.name = c.path)\n AND NOT EXISTS (SELECT 1 FROM storage.objects o WHERE o.bucket_id = 'review-photos' AND o.name = c.path);\n RETURN (SELECT count(*) FROM review_media_private.cleanup c WHERE c.owner_id = auth.uid() AND NOT c.complete);\nEND $$",
+ "REVOKE ALL ON FUNCTION public.finish_review_media_cleanup() FROM PUBLIC, anon",
+ "GRANT EXECUTE ON FUNCTION public.finish_review_media_cleanup() TO authenticated",
+ "COMMIT"
+ ]
+ },
+ {
+ "id": "review_media_catalog_integration",
+ "version": "20261008201635",
+ "name": "review_media_catalog_integration",
+ "path": "backend/supabase/migrations/20261008201635_review_media_catalog_integration.sql",
+ "bytes": 47177,
+ "sha256": "6e820eb535bc514e78f258110e36dff00537bcaefcffd8b354356107ca9c09fe",
+ "statementCount": 11,
+ "statementVectorSha256": "e69060e11abab0564f63decd2ba601630d13724c0a71b2f6cb2c616c0bb03e9c",
+ "originalStatementVector": [
+ "-- Integrate exactly the two preceding review-media sources into G014.\n-- CLI 2.117.0 generated this new migration. No assertion body or immutable\n-- manifest row is changed. Execute the complete transaction; do not split it.\nBEGIN",
+ "SET LOCAL lock_timeout = '2s'",
+ "SELECT pg_catalog.pg_advisory_xact_lock(pg_catalog.hashtextextended('tzudong:review-media-catalog:v1', 0))",
+ "CREATE TEMP TABLE review_media_expected (\n signature text PRIMARY KEY, body_sha256 text NOT NULL, final_body_sha256 text NOT NULL, definer boolean NOT NULL,\n volatility text NOT NULL, language text NOT NULL, result text NOT NULL, argument_names text[] NOT NULL\n) ON COMMIT DROP",
+ "INSERT INTO review_media_expected VALUES\n ('public.finish_review_media_cleanup()','f7e925a25dedb987a3166c5ca641ba7db1568a7583bdeca3cee04f27d9189f20','f6c4e71988ed2b789b887484af5fdf2e482bde98f1d1c5b5d4e7ad124c314bd1',true,'v','plpgsql','bigint',ARRAY[]::text[]),\n ('public.mutate_review_with_media(uuid,uuid,text,timestamp with time zone,text,text[],text[])','6f1450d4afaa7d3e9dcba3abb231de62aeb7c0a687cc2a9ceafbbe6dc2c2e413','50bfad7bc4fc7ddbc9d9379e8eb13facd938a15f66553576cc69fbcf69aa98b1',true,'v','plpgsql','text',ARRAY['p_operation_id','p_review_id','p_kind','p_expected_updated_at','p_content','p_categories','p_food_photos']::text[]),\n ('public.pending_review_media_cleanup()','21fa71446354fe855508550a3df78ddbe0ad4c1f7007ea905d04bdb98f1ac766','5a92c8f282c895eabaa77f8cf3f452fb659bac33bd519ed8cf439dc1f2905c7b',true,'v','plpgsql','TABLE(path text, owner_id uuid, review_id uuid, purpose text)',ARRAY[]::text[]),\n ('public.queue_review_upload_cleanup(uuid,text[])','00784e9daa9b6b707432200e4df6592010e9f22d2bc9db831bf8329e14bdb453','89c3b573891f598cac5df6ce9a3217639092801a7439ec0404f338f2097114a8',true,'v','plpgsql','text',ARRAY['p_review_id','p_paths']::text[]),\n ('public.read_review_media_commit(uuid,uuid,text)','c7d2e4e111223150ceeda5893310df0e9656e5930823db053135812a69222081','2f14abfc04864f369467f5ac5f0603defa149b8023d7e6b04e2bb8535f8a268e',true,'v','sql','text',ARRAY['p_operation_id','p_review_id','p_kind']::text[]),\n ('public.review_media_delete_allowed(text)','45fd396f240fb1d9fc084f31bd4feea7ee097017f2fd2b8d12df9c2c59152f78','a75dbd787dd388b0761bee11c82a56d5f410688e4cfd953181bce4d613062ae7',true,'v','plpgsql','boolean',ARRAY['p_path']::text[]),\n ('public.review_media_upload_allowed(text,text)','0a3d375685c5e3fd82721bd8033345c93031704c838a0a7f1b61ff248d9b6636','298c6a127f3a44a193b78be8c1f2577ab58aa34c772b66ccd53f774d807cc90c',true,'v','plpgsql','boolean',ARRAY['p_bucket','p_path']::text[]),\n ('review_media_private.canonical(text,uuid,uuid,text)','87d8397c36cf4c7b986f75cbc2788979333a76be2cc26dc5522cd362f62414a9','87d8397c36cf4c7b986f75cbc2788979333a76be2cc26dc5522cd362f62414a9',false,'i','sql','boolean',ARRAY['p_path','p_owner','p_review','p_purpose']::text[]),\n ('review_media_private.enqueue_removed()','7edb21d70ea3ff81ab90e13617e8c1c2749b54b1506f1ff42aaa6c5dc33f9e38','7edb21d70ea3ff81ab90e13617e8c1c2749b54b1506f1ff42aaa6c5dc33f9e38',true,'v','plpgsql','trigger',ARRAY[]::text[]),\n ('review_media_private.guard_references()','846030547ffd76e17596755d7eee4279dcb9b563361435260826071d2f250d59','846030547ffd76e17596755d7eee4279dcb9b563361435260826071d2f250d59',true,'v','plpgsql','trigger',ARRAY[]::text[]),\n ('review_media_private.lock_changes()','381d89aa6bbf5a59c2ee0fef2a7392ef705147252b324527201b8b6f74376250','381d89aa6bbf5a59c2ee0fef2a7392ef705147252b324527201b8b6f74376250',true,'v','plpgsql','trigger',ARRAY[]::text[]),\n ('review_media_private.owned_legacy(text,uuid,text)','a2d55f09f03fcaeedd77461198511673da7342a6a4873d37227f9cf612090980','a2d55f09f03fcaeedd77461198511673da7342a6a4873d37227f9cf612090980',false,'i','sql','boolean',ARRAY['p_path','p_owner','p_purpose']::text[]),\n ('review_media_private.reference_key(text)','a8910cb09bfd959951045e8b0b8233b1e2a8bdc45073abeebdfc26b552b1dae7','a8910cb09bfd959951045e8b0b8233b1e2a8bdc45073abeebdfc26b552b1dae7',false,'i','plpgsql','text',ARRAY['p_value']::text[]),\n ('review_media_private.referenced(text)','cc295115d85a3a11b380e1378e2ee91b0d9f7f587c68839653f54ed826c398ce','cc295115d85a3a11b380e1378e2ee91b0d9f7f587c68839653f54ed826c398ce',true,'v','sql','boolean',ARRAY['p_path']::text[])",
+ "REVOKE ALL ON pg_temp.review_media_expected FROM PUBLIC, anon, authenticated, service_role",
+ "GRANT SELECT ON pg_temp.review_media_expected TO privacy_workflow_owner",
+ "DO $integration$\nDECLARE\n v_expected record; v_function record; v_oid oid;\n v_owner oid := 'privacy_workflow_owner'::regrole;\n v_runner oid := 'postgres'::regrole;\n v_members jsonb; v_assertions jsonb; v_manifest jsonb; v_functions jsonb;\n v_known oid := (SELECT p.oid FROM pg_proc p JOIN pg_namespace n ON n.oid=p.pronamespace\n WHERE n.nspname='privacy_retention' AND p.proname='g014_catalog_protected_relations' AND p.pronargs=0);\n v_definition text;\n v_public jsonb;\n v_self jsonb; v_major integer := current_setting('server_version_num')::integer / 10000;\n v_pg15_lease boolean := false;\nBEGIN\n IF current_user <> 'postgres' OR session_user <> 'postgres' OR v_major NOT IN (15,17)\n OR current_setting('transaction_read_only') <> 'off'\n OR NOT EXISTS (SELECT 1 FROM pg_roles WHERE oid=v_owner AND NOT rolsuper\n AND NOT rolbypassrls AND NOT rolcanlogin AND NOT rolinherit) THEN\n RAISE EXCEPTION 'review_media_catalog_executor_denied';\n END IF;\n SELECT coalesce(jsonb_agg(to_jsonb(m) ORDER BY roleid,member,grantor),'[]')\n INTO v_members FROM pg_auth_members m;\n SELECT to_jsonb(n) INTO v_public FROM pg_namespace n WHERE nspname='public';\n IF NOT has_schema_privilege(v_owner,'public','CREATE') THEN\n RAISE EXCEPTION 'review_media_catalog_existing_public_create_missing';\n END IF;\n SELECT to_jsonb(m) INTO v_self FROM pg_auth_members m\n WHERE roleid=v_owner AND member=v_runner AND grantor=v_runner;\n IF v_self IS NOT NULL AND (v_self->>'admin_option')::boolean THEN\n RAISE EXCEPTION 'review_media_catalog_membership_denied';\n END IF;\n SELECT jsonb_agg(CASE WHEN p.oid=v_known THEN to_jsonb(p)-'prosrc' ELSE to_jsonb(p) END ORDER BY p.oid) INTO v_assertions FROM pg_proc p\n WHERE p.pronamespace='privacy_retention'::regnamespace;\n -- Pre-existing RPC/helper bodies and complete type/default metadata are pinned\n -- before any ownership or grant change. No unknown overload is admitted.\n FOR v_expected IN SELECT * FROM pg_temp.review_media_expected LOOP\n v_oid := to_regprocedure(v_expected.signature);\n SELECT * INTO v_function FROM pg_proc WHERE oid=v_oid;\n IF v_oid IS NULL OR v_function.proowner<>v_runner OR v_function.prokind<>'f'\n OR v_function.prosecdef IS DISTINCT FROM v_expected.definer OR v_function.provolatile::text<>v_expected.volatility\n OR v_function.proconfig IS DISTINCT FROM ARRAY['search_path=\"\"']::text[]\n OR (SELECT lanname FROM pg_language WHERE oid=v_function.prolang)<>v_expected.language\n OR pg_get_function_result(v_oid) IS DISTINCT FROM v_expected.result\n OR coalesce(v_function.proargnames[1:v_function.pronargs],ARRAY[]::text[]) IS DISTINCT FROM v_expected.argument_names\n OR encode(sha256(convert_to(v_function.prosrc,'UTF8')),'hex')<>v_expected.body_sha256\n OR v_function.pronargdefaults<>(CASE WHEN v_function.proname='mutate_review_with_media' THEN 3 ELSE 0 END)\n OR (v_function.pronargdefaults=3 AND pg_get_expr(v_function.proargdefaults,0)<>'NULL::text, NULL::text[], NULL::text[]')\n OR (SELECT count(*) FROM pg_proc x WHERE x.pronamespace=v_function.pronamespace AND x.proname=v_function.proname)<>1 THEN\n RAISE EXCEPTION 'review_media_catalog_source_drift';\n END IF;\n END LOOP;\n IF (SELECT count(*) FROM pg_proc WHERE pronamespace='review_media_private'::regnamespace)<>7 THEN\n RAISE EXCEPTION 'review_media_catalog_identity_conflict';\n END IF;\n -- Preserve semantic defaults. PG15 pg_node_tree contains parser location\n -- offsets that change when the identical definition is recreated. The initial\n -- exact source/default checks above remain mandatory; retain every other field.\n SELECT jsonb_agg(((to_jsonb(p)-'proowner'-'proacl'-'prosrc'-'proargdefaults') || jsonb_build_object('proargdefaults',pg_get_expr(p.proargdefaults,0))) ORDER BY p.oid) INTO v_functions\n FROM pg_proc p JOIN pg_temp.review_media_expected e ON p.oid=to_regprocedure(e.signature);\n\n -- Use only the existing G014 owner-management authority. This transaction's\n -- noninheriting SET lease is restored exactly before unchanged assertions run.\n -- Never grant a Storage/service role or alter supautils/global configuration.\n IF v_major=17 AND NOT EXISTS (SELECT 1 FROM pg_auth_members\n WHERE roleid=v_owner AND member=v_runner AND admin_option AND grantor<>v_runner) THEN\n RAISE EXCEPTION 'review_media_catalog_existing_owner_admin_missing';\n END IF;\n IF v_major=17 THEN\n EXECUTE 'GRANT privacy_workflow_owner TO postgres WITH ADMIN FALSE, INHERIT FALSE, SET TRUE GRANTED BY postgres';\n ELSE\n -- PG15 has one row per role/member pair, even when another grantor owns it.\n -- Lease only absent membership; never revoke a pre-existing grantor's row.\n v_pg15_lease := NOT pg_has_role(v_runner,v_owner,'MEMBER');\n IF v_pg15_lease THEN GRANT privacy_workflow_owner TO postgres; END IF;\n END IF;\n SET LOCAL ROLE privacy_workflow_owner;\n -- Existing G041 claim boundary: never restore auth-schema access for the\n -- workflow owner. Pin the unchanged helper before substituting auth.uid().\n IF has_schema_privilege(v_owner,'auth','USAGE,CREATE') OR NOT EXISTS (\n SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid=p.pronamespace\n WHERE n.nspname='privacy_retention' AND p.proname='g041_current_claim_user_id'\n AND p.pronargs=0 AND p.proowner=v_owner AND p.prosecdef AND p.prokind='f'\n AND NOT p.proretset AND p.prorettype='uuid'::regtype AND p.provolatile='s'\n AND p.prolang=(SELECT oid FROM pg_language WHERE lanname='plpgsql')\n AND p.proconfig=ARRAY['search_path=\"\"']::text[]\n AND encode(sha256(convert_to(p.prosrc,'UTF8')),'hex')='43f3ff2ed914944802555c4ffe3ff8ecece213e82288e2c1c47ae22efdf81585'\n AND has_function_privilege(v_owner,p.oid,'EXECUTE')\n AND NOT has_function_privilege('anon',p.oid,'EXECUTE')\n AND NOT has_function_privilege('authenticated',p.oid,'EXECUTE')\n AND NOT has_function_privilege('service_role',p.oid,'EXECUTE')\n ) THEN RAISE EXCEPTION 'review_media_catalog_claim_boundary_drift'; END IF;\n IF EXISTS (SELECT 1 FROM privacy_retention.g014_public_rpc_allowlist a\n JOIN pg_temp.review_media_expected e ON a.function_name=split_part(split_part(e.signature,'(',1),'.',2)\n WHERE a.function_schema='public') THEN\n RAISE EXCEPTION 'review_media_catalog_identity_conflict';\n END IF;\n SELECT jsonb_agg(to_jsonb(m) ORDER BY manifest_kind,manifest_key) INTO v_manifest\n FROM privacy_retention.g014_catalog_contract_manifest m;\n PERFORM privacy_retention.assert_g014_catalog_manifest();\n RESET ROLE;\n GRANT USAGE, CREATE ON SCHEMA review_media_private TO privacy_workflow_owner;\n FOR v_expected IN SELECT * FROM pg_temp.review_media_expected LOOP\n EXECUTE format('ALTER FUNCTION %s OWNER TO privacy_workflow_owner',to_regprocedure(v_expected.signature));\n SET LOCAL ROLE privacy_workflow_owner;\n IF v_expected.signature LIKE 'public.%' THEN\n SELECT pg_get_functiondef(oid) INTO v_definition FROM pg_proc WHERE oid=to_regprocedure(v_expected.signature);\n EXECUTE replace(v_definition,'auth.uid()','privacy_retention.g041_current_claim_user_id()');\n END IF;\n IF (SELECT encode(sha256(convert_to(prosrc,'UTF8')),'hex') FROM pg_proc\n WHERE oid=to_regprocedure(v_expected.signature)) IS DISTINCT FROM v_expected.final_body_sha256 THEN\n RAISE EXCEPTION 'review_media_catalog_claim_transition_drift';\n END IF;\n EXECUTE format('REVOKE ALL ON FUNCTION %s FROM PUBLIC, anon, authenticated, service_role',to_regprocedure(v_expected.signature));\n IF v_expected.signature LIKE 'public.%' THEN\n EXECUTE format('GRANT EXECUTE ON FUNCTION %s TO authenticated',to_regprocedure(v_expected.signature));\n END IF;\n RESET ROLE;\n END LOOP;\n REVOKE CREATE ON SCHEMA review_media_private FROM privacy_workflow_owner;\n REVOKE ALL ON SCHEMA review_media_private FROM PUBLIC, anon, authenticated, service_role;\n REVOKE ALL ON TABLE review_media_private.commits, review_media_private.cleanup FROM PUBLIC, anon, authenticated, service_role;\n -- Private tables keep their migration owner. The implementation role receives\n -- only operations used by the reviewed functions, with explicit RLS policies.\n GRANT SELECT, INSERT ON review_media_private.commits TO privacy_workflow_owner;\n GRANT SELECT, INSERT, UPDATE ON review_media_private.cleanup TO privacy_workflow_owner;\n ALTER TABLE review_media_private.commits FORCE ROW LEVEL SECURITY;\n ALTER TABLE review_media_private.cleanup FORCE ROW LEVEL SECURITY;\n CREATE POLICY review_media_commits_select ON review_media_private.commits FOR SELECT TO privacy_workflow_owner USING (true);\n CREATE POLICY review_media_commits_insert ON review_media_private.commits FOR INSERT TO privacy_workflow_owner WITH CHECK (true);\n CREATE POLICY review_media_cleanup_select ON review_media_private.cleanup FOR SELECT TO privacy_workflow_owner USING (true);\n CREATE POLICY review_media_cleanup_insert ON review_media_private.cleanup FOR INSERT TO privacy_workflow_owner WITH CHECK (true);\n CREATE POLICY review_media_cleanup_update ON review_media_private.cleanup FOR UPDATE TO privacy_workflow_owner USING (true) WITH CHECK (true);\n -- Existing account-deletion contracts already require reviews SELECT/DELETE\n -- and storage.objects SELECT. Add only the six columns this RPC updates.\n GRANT UPDATE(content,categories,food_photos,is_verified,admin_note,updated_at)\n ON public.reviews TO privacy_workflow_owner;\n -- Existing supautils.policy_grants may authorize this DDL without table-owner\n -- USAGE/SET membership. Let the actual policy command decide; no fallback grant.\n CREATE POLICY review_media_workflow_read ON storage.objects FOR SELECT TO privacy_workflow_owner\n USING (bucket_id IN ('review-photos','review-verifications'));\n\n SET LOCAL ROLE privacy_workflow_owner;\n INSERT INTO privacy_retention.g014_public_rpc_allowlist\n (function_schema,function_name,identity_arguments,grantee,source_signature)\n SELECT 'public',p.proname,p.proargtypes::text,'authenticated',e.signature\n FROM pg_temp.review_media_expected e JOIN pg_proc p ON p.oid=to_regprocedure(e.signature)\n WHERE e.signature LIKE 'public.%';\n IF NOT FOUND THEN RAISE EXCEPTION 'review_media_catalog_allowlist_missing'; END IF;\n\n PERFORM privacy_retention.assert_g014_catalog_manifest();\n IF EXISTS (\n WITH expected(relation,ordinal,name,type,not_null,default_expr) AS (VALUES\n ('commits',1,'operation_id','uuid',true,NULL::text),\n ('commits',2,'owner_id','uuid',true,NULL::text),\n ('commits',3,'review_id','uuid',true,NULL::text),\n ('commits',4,'kind','text',true,NULL::text),\n ('commits',5,'request_hash','text',true,NULL::text),\n ('cleanup',1,'path','text',true,NULL::text),\n ('cleanup',2,'owner_id','uuid',true,NULL::text),\n ('cleanup',3,'review_id','uuid',true,NULL::text),\n ('cleanup',4,'purpose','text',true,NULL::text),\n ('cleanup',5,'retired','boolean',true,'false'),\n ('cleanup',6,'complete','boolean',true,'false')\n ), actual AS (\n SELECT c.relname::text,a.attnum::integer,a.attname::text,pg_catalog.format_type(a.atttypid,a.atttypmod),a.attnotnull,\n pg_catalog.pg_get_expr(d.adbin,d.adrelid)\n FROM pg_catalog.pg_class c JOIN pg_catalog.pg_attribute a ON a.attrelid=c.oid AND a.attnum>0 AND NOT a.attisdropped\n LEFT JOIN pg_catalog.pg_attrdef d ON d.adrelid=a.attrelid AND d.adnum=a.attnum\n WHERE c.relnamespace='review_media_private'::regnamespace AND c.relkind IN ('r','p')\n )\n (SELECT * FROM expected EXCEPT SELECT * FROM actual) UNION ALL (SELECT * FROM actual EXCEPT SELECT * FROM expected)\n ) THEN RAISE EXCEPTION 'review_media_catalog_column_shape_drift'; END IF;\n IF EXISTS (\n WITH expected(relation,name,definition) AS (VALUES\n ('commits','commits_pkey','PRIMARY KEY (operation_id)'),\n ('commits','commits_kind_check','CHECK ((kind = ANY (ARRAY[''edit''::text, ''delete''::text])))'),\n ('cleanup','cleanup_pkey','PRIMARY KEY (path)'),\n ('cleanup','cleanup_purpose_check','CHECK ((purpose = ANY (ARRAY[''food''::text, ''verification''::text])))')\n ), actual AS (\n SELECT c.relname::text,k.conname::text,pg_catalog.pg_get_constraintdef(k.oid)\n FROM pg_catalog.pg_class c JOIN pg_catalog.pg_constraint k ON k.conrelid=c.oid\n WHERE c.relnamespace='review_media_private'::regnamespace\n )\n (SELECT * FROM expected EXCEPT SELECT * FROM actual) UNION ALL (SELECT * FROM actual EXCEPT SELECT * FROM expected)\n ) OR EXISTS (SELECT 1 FROM pg_catalog.pg_trigger t JOIN pg_catalog.pg_class c ON c.oid=t.tgrelid\n WHERE c.relnamespace='review_media_private'::regnamespace AND NOT t.tgisinternal)\n OR EXISTS (SELECT 1 FROM pg_catalog.pg_constraint k JOIN pg_catalog.pg_class c ON c.oid=k.conrelid\n WHERE c.relnamespace='review_media_private'::regnamespace AND (NOT k.convalidated OR k.condeferrable OR k.condeferred))\n OR (SELECT count(*) FROM pg_catalog.pg_index i JOIN pg_catalog.pg_class c ON c.oid=i.indrelid\n WHERE c.relnamespace='review_media_private'::regnamespace)<>2\n OR EXISTS (SELECT 1 FROM pg_catalog.pg_index i JOIN pg_catalog.pg_class c ON c.oid=i.indrelid\n WHERE c.relnamespace='review_media_private'::regnamespace AND (NOT i.indisprimary OR NOT i.indisvalid OR NOT i.indisready)) THEN\n RAISE EXCEPTION 'review_media_catalog_constraint_shape_drift';\n END IF;\n -- Extend only the declarative protected-relation list, never an assertion.\n IF NOT EXISTS (SELECT 1 FROM pg_catalog.pg_proc WHERE oid=v_known AND proowner=v_owner\n AND prosecdef AND prokind='f' AND proretset AND provolatile='s'\n AND proconfig=ARRAY['search_path=\"\"']::text[]\n AND prolang=(SELECT oid FROM pg_catalog.pg_language WHERE lanname='sql')\n AND pg_catalog.pg_get_function_result(oid)='TABLE(schema_name name, relation_name name)') THEN\n RAISE EXCEPTION 'review_media_catalog_known_identity_metadata_drift';\n END IF;\n SELECT pg_catalog.pg_get_functiondef(v_known) INTO v_definition;\n IF (SELECT pg_catalog.encode(pg_catalog.sha256(pg_catalog.convert_to(prosrc,'UTF8')),'hex') FROM pg_catalog.pg_proc WHERE oid=v_known)<>'43bf370fe74864708e9efbc6559d899a6afa5b353e6cbc930306e31c9ecdc499'\n OR EXISTS (SELECT 1 FROM privacy_retention.g014_catalog_contract_manifest\n WHERE manifest_key->>'schema'='review_media_private') THEN\n RAISE EXCEPTION 'review_media_catalog_known_identity_source_drift';\n END IF;\n EXECUTE pg_catalog.replace(v_definition,\n $known_anchor$ ('public', 'notifications'),$known_anchor$,\n $known_replacement$ ('review_media_private', 'commits'),\n ('review_media_private', 'cleanup'),\n ('public', 'notifications'),$known_replacement$);\n IF (SELECT pg_catalog.encode(pg_catalog.sha256(pg_catalog.convert_to(prosrc,'UTF8')),'hex') FROM pg_catalog.pg_proc WHERE oid=v_known)<>'20acd5742d891cf8a33b265a3a1298c65dd9646402c58391cd17829951cf92f2' THEN\n RAISE EXCEPTION 'review_media_catalog_known_identity_post_drift';\n END IF;\n INSERT INTO privacy_retention.g014_catalog_contract_manifest(manifest_kind,manifest_key,manifest_value)\n SELECT manifest_kind,manifest_key,manifest_value FROM privacy_retention.g014_catalog_manifest_rows()\n WHERE manifest_key->>'schema'='review_media_private'\n AND manifest_key->>'relation' IN ('commits','cleanup');\n IF NOT FOUND THEN RAISE EXCEPTION 'review_media_catalog_manifest_append_missing'; END IF;\n PERFORM privacy_retention.assert_g014_catalog_manifest();\n CREATE FUNCTION pg_temp.review_media_g014_assert() RETURNS void\n LANGUAGE plpgsql SECURITY DEFINER SET search_path='' AS $bridge$\n BEGIN\n IF EXISTS (SELECT 1 FROM pg_temp.review_media_expected e\n JOIN pg_proc p ON p.oid=to_regprocedure(e.signature)\n WHERE e.signature LIKE 'public.%' AND (\n (SELECT count(*) FROM privacy_retention.g014_public_rpc_allowlist a\n WHERE a.function_schema='public' AND a.function_name=p.proname)<>1\n OR NOT EXISTS (SELECT 1 FROM privacy_retention.g014_public_rpc_allowlist a\n WHERE a.source_signature=e.signature AND a.function_schema='public' AND a.function_name=p.proname\n AND a.identity_arguments=p.proargtypes::text AND a.grantee='authenticated'))) THEN\n RAISE EXCEPTION 'review_media_catalog_allowlist_drift';\n END IF;\n PERFORM privacy_retention.assert_g014_public_rpc_allowlist();\n PERFORM privacy_retention.assert_g014_definer_contract();\n PERFORM privacy_retention.assert_g014_catalog_contract();\n DROP FUNCTION pg_temp.review_media_g014_assert();\n END $bridge$;\n REVOKE ALL ON FUNCTION pg_temp.review_media_g014_assert() FROM PUBLIC,anon,authenticated,service_role;\n GRANT EXECUTE ON FUNCTION pg_temp.review_media_g014_assert() TO postgres;\n IF (SELECT jsonb_agg(to_jsonb(m) ORDER BY manifest_kind,manifest_key)\n FROM privacy_retention.g014_catalog_contract_manifest m\n WHERE m.manifest_key->>'schema' IS DISTINCT FROM 'review_media_private') IS DISTINCT FROM v_manifest THEN\n RAISE EXCEPTION 'review_media_catalog_manifest_drift';\n END IF;\n RESET ROLE;\n IF v_major=15 THEN\n IF v_pg15_lease THEN REVOKE privacy_workflow_owner FROM postgres; END IF;\n ELSIF v_self IS NULL THEN\n REVOKE privacy_workflow_owner FROM postgres GRANTED BY postgres;\n ELSE\n EXECUTE format('GRANT privacy_workflow_owner TO postgres WITH ADMIN FALSE, INHERIT %s, SET %s GRANTED BY postgres',\n upper(v_self->>'inherit_option'),upper(v_self->>'set_option'));\n END IF;\n IF (SELECT coalesce(jsonb_agg(to_jsonb(m) ORDER BY roleid,member,grantor),'[]') FROM pg_auth_members m) IS DISTINCT FROM v_members\n OR (SELECT to_jsonb(n) FROM pg_namespace n WHERE nspname='public') IS DISTINCT FROM v_public\n OR (SELECT jsonb_agg(CASE WHEN p.oid=v_known THEN to_jsonb(p)-'prosrc' ELSE to_jsonb(p) END ORDER BY p.oid) FROM pg_proc p\n WHERE p.pronamespace='privacy_retention'::regnamespace) IS DISTINCT FROM v_assertions\n OR (SELECT jsonb_agg(((to_jsonb(p)-'proowner'-'proacl'-'prosrc'-'proargdefaults') || jsonb_build_object('proargdefaults',pg_get_expr(p.proargdefaults,0))) ORDER BY p.oid) FROM pg_proc p\n JOIN pg_temp.review_media_expected e ON p.oid=to_regprocedure(e.signature)) IS DISTINCT FROM v_functions THEN\n RAISE EXCEPTION 'review_media_catalog_preservation_drift' USING DETAIL =\n jsonb_build_object(\n 'membershipPreserved',(SELECT coalesce(jsonb_agg(to_jsonb(m) ORDER BY roleid,member,grantor),'[]') FROM pg_auth_members m) IS NOT DISTINCT FROM v_members,\n 'publicNamespacePreserved',(SELECT to_jsonb(n) FROM pg_namespace n WHERE nspname='public') IS NOT DISTINCT FROM v_public,\n 'assertionsPreserved',(SELECT jsonb_agg(CASE WHEN p.oid=v_known THEN to_jsonb(p)-'prosrc' ELSE to_jsonb(p) END ORDER BY p.oid) FROM pg_proc p\n WHERE p.pronamespace='privacy_retention'::regnamespace) IS NOT DISTINCT FROM v_assertions,\n 'functionMetadataPreserved',(SELECT jsonb_agg(((to_jsonb(p)-'proowner'-'proacl'-'prosrc'-'proargdefaults') || jsonb_build_object('proargdefaults',pg_get_expr(p.proargdefaults,0))) ORDER BY p.oid) FROM pg_proc p\n JOIN pg_temp.review_media_expected e ON p.oid=to_regprocedure(e.signature)) IS NOT DISTINCT FROM v_functions,\n 'changedMetadataFields',(SELECT jsonb_agg(DISTINCT old_field.key ORDER BY old_field.key)\n FROM jsonb_array_elements(v_functions) AS old_function(value)\n CROSS JOIN LATERAL jsonb_each(old_function.value) AS old_field(key,value)\n JOIN pg_proc p ON p.oid=(old_function.value->>'oid')::oid\n WHERE old_field.value IS DISTINCT FROM (((to_jsonb(p)-'proowner'-'proacl'-'prosrc'-'proargdefaults') || jsonb_build_object('proargdefaults',pg_get_expr(p.proargdefaults,0))))->old_field.key)\n )::text;\n END IF;\n PERFORM pg_temp.review_media_g014_assert();\n IF to_regprocedure('pg_temp.review_media_g014_assert()') IS NOT NULL THEN\n RAISE EXCEPTION 'review_media_catalog_bridge_remaining';\n END IF;\nEND $integration$",
+ "-- REVIEW_MEDIA_READBACK_BEGIN\n-- The same independent catalog-only checks are embedded in canonical readback.\nDO $review_media_catalog_readback$\nDECLARE\n v_expected record; v_function record; v_relation record;\n v_owner oid := 'privacy_workflow_owner'::regrole;\n v_path text := current_setting('search_path');\nBEGIN\n -- Existing G041 claim boundary: never restore auth-schema access for the\n -- workflow owner. Pin the unchanged helper before substituting auth.uid().\n IF has_schema_privilege(v_owner,'auth','USAGE,CREATE') OR NOT EXISTS (\n SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid=p.pronamespace\n WHERE n.nspname='privacy_retention' AND p.proname='g041_current_claim_user_id'\n AND p.pronargs=0 AND p.proowner=v_owner AND p.prosecdef AND p.prokind='f'\n AND NOT p.proretset AND p.prorettype='uuid'::regtype AND p.provolatile='s'\n AND p.prolang=(SELECT oid FROM pg_language WHERE lanname='plpgsql')\n AND p.proconfig=ARRAY['search_path=\"\"']::text[]\n AND encode(sha256(convert_to(p.prosrc,'UTF8')),'hex')='43f3ff2ed914944802555c4ffe3ff8ecece213e82288e2c1c47ae22efdf81585'\n AND has_function_privilege(v_owner,p.oid,'EXECUTE')\n AND NOT has_function_privilege('anon',p.oid,'EXECUTE')\n AND NOT has_function_privilege('authenticated',p.oid,'EXECUTE')\n AND NOT has_function_privilege('service_role',p.oid,'EXECUTE')\n ) THEN RAISE EXCEPTION 'review_media_catalog_claim_boundary_drift'; END IF;\n -- Fix pg_get_expr qualification before comparing the exact parsed predicates.\n PERFORM set_config('search_path','public, pg_catalog',true);\n FOR v_expected IN SELECT * FROM (VALUES\n ('public.finish_review_media_cleanup()','f6c4e71988ed2b789b887484af5fdf2e482bde98f1d1c5b5d4e7ad124c314bd1',true,'v','plpgsql','bigint',ARRAY[]::text[]),\n ('public.mutate_review_with_media(uuid,uuid,text,timestamp with time zone,text,text[],text[])','50bfad7bc4fc7ddbc9d9379e8eb13facd938a15f66553576cc69fbcf69aa98b1',true,'v','plpgsql','text',ARRAY['p_operation_id','p_review_id','p_kind','p_expected_updated_at','p_content','p_categories','p_food_photos']::text[]),\n ('public.pending_review_media_cleanup()','5a92c8f282c895eabaa77f8cf3f452fb659bac33bd519ed8cf439dc1f2905c7b',true,'v','plpgsql','TABLE(path text, owner_id uuid, review_id uuid, purpose text)',ARRAY[]::text[]),\n ('public.queue_review_upload_cleanup(uuid,text[])','89c3b573891f598cac5df6ce9a3217639092801a7439ec0404f338f2097114a8',true,'v','plpgsql','text',ARRAY['p_review_id','p_paths']::text[]),\n ('public.read_review_media_commit(uuid,uuid,text)','2f14abfc04864f369467f5ac5f0603defa149b8023d7e6b04e2bb8535f8a268e',true,'v','sql','text',ARRAY['p_operation_id','p_review_id','p_kind']::text[]),\n ('public.review_media_delete_allowed(text)','a75dbd787dd388b0761bee11c82a56d5f410688e4cfd953181bce4d613062ae7',true,'v','plpgsql','boolean',ARRAY['p_path']::text[]),\n ('public.review_media_upload_allowed(text,text)','298c6a127f3a44a193b78be8c1f2577ab58aa34c772b66ccd53f774d807cc90c',true,'v','plpgsql','boolean',ARRAY['p_bucket','p_path']::text[]),\n ('review_media_private.canonical(text,uuid,uuid,text)','87d8397c36cf4c7b986f75cbc2788979333a76be2cc26dc5522cd362f62414a9',false,'i','sql','boolean',ARRAY['p_path','p_owner','p_review','p_purpose']::text[]),\n ('review_media_private.enqueue_removed()','7edb21d70ea3ff81ab90e13617e8c1c2749b54b1506f1ff42aaa6c5dc33f9e38',true,'v','plpgsql','trigger',ARRAY[]::text[]),\n ('review_media_private.guard_references()','846030547ffd76e17596755d7eee4279dcb9b563361435260826071d2f250d59',true,'v','plpgsql','trigger',ARRAY[]::text[]),\n ('review_media_private.lock_changes()','381d89aa6bbf5a59c2ee0fef2a7392ef705147252b324527201b8b6f74376250',true,'v','plpgsql','trigger',ARRAY[]::text[]),\n ('review_media_private.owned_legacy(text,uuid,text)','a2d55f09f03fcaeedd77461198511673da7342a6a4873d37227f9cf612090980',false,'i','sql','boolean',ARRAY['p_path','p_owner','p_purpose']::text[]),\n ('review_media_private.reference_key(text)','a8910cb09bfd959951045e8b0b8233b1e2a8bdc45073abeebdfc26b552b1dae7',false,'i','plpgsql','text',ARRAY['p_value']::text[]),\n ('review_media_private.referenced(text)','cc295115d85a3a11b380e1378e2ee91b0d9f7f587c68839653f54ed826c398ce',true,'v','sql','boolean',ARRAY['p_path']::text[])\n ) AS expected(signature,body_sha256,definer,volatility,language,result,argument_names) LOOP\n SELECT * INTO v_function FROM pg_proc WHERE oid=to_regprocedure(v_expected.signature);\n IF v_function.oid IS NULL OR v_function.proowner<>v_owner OR v_function.prokind<>'f'\n OR v_function.prosecdef IS DISTINCT FROM v_expected.definer OR v_function.provolatile::text<>v_expected.volatility\n OR v_function.proconfig IS DISTINCT FROM ARRAY['search_path=\"\"']::text[]\n OR (SELECT lanname FROM pg_language WHERE oid=v_function.prolang)<>v_expected.language\n OR pg_get_function_result(v_function.oid) IS DISTINCT FROM v_expected.result\n OR coalesce(v_function.proargnames[1:v_function.pronargs],ARRAY[]::text[]) IS DISTINCT FROM v_expected.argument_names\n OR v_function.pronargdefaults<>(CASE WHEN v_function.proname='mutate_review_with_media' THEN 3 ELSE 0 END)\n OR (v_function.pronargdefaults=3 AND pg_get_expr(v_function.proargdefaults,0)<>'NULL::text, NULL::text[], NULL::text[]')\n OR encode(sha256(convert_to(v_function.prosrc,'UTF8')),'hex')<>v_expected.body_sha256\n OR (SELECT count(*) FROM pg_proc x WHERE x.pronamespace=v_function.pronamespace AND x.proname=v_function.proname)<>1\n OR NOT has_function_privilege(v_owner,v_function.oid,'EXECUTE')\n OR has_function_privilege('anon',v_function.oid,'EXECUTE')\n OR has_function_privilege('service_role',v_function.oid,'EXECUTE')\n OR has_function_privilege('authenticated',v_function.oid,'EXECUTE') IS DISTINCT FROM (v_expected.signature LIKE 'public.%')\n OR EXISTS (SELECT 1 FROM aclexplode(coalesce(v_function.proacl,acldefault('f',v_function.proowner))) a\n WHERE a.is_grantable OR a.privilege_type<>'EXECUTE'\n OR (a.grantee<>v_owner AND NOT (v_expected.signature LIKE 'public.%' AND a.grantee='authenticated'::regrole))) THEN\n RAISE EXCEPTION 'review_media_catalog_function_drift';\n END IF;\n END LOOP;\n IF (SELECT count(*) FROM pg_proc WHERE pronamespace='review_media_private'::regnamespace)<>7\n OR (SELECT count(*) FROM pg_class WHERE relnamespace='review_media_private'::regnamespace AND relkind IN ('r','p','v','m','f','S'))<>2\n OR NOT EXISTS (SELECT 1 FROM pg_namespace WHERE nspname='review_media_private' AND nspowner='postgres'::regrole)\n OR NOT has_schema_privilege(v_owner,'review_media_private','USAGE')\n OR has_schema_privilege(v_owner,'review_media_private','CREATE')\n OR EXISTS (SELECT 1 FROM pg_namespace n CROSS JOIN LATERAL aclexplode(coalesce(n.nspacl,acldefault('n',n.nspowner))) a\n WHERE n.nspname='review_media_private' AND a.grantee<>n.nspowner\n AND (a.grantee<>v_owner OR a.privilege_type<>'USAGE' OR a.is_grantable)) THEN\n RAISE EXCEPTION 'review_media_catalog_private_schema_drift';\n END IF;\n FOR v_expected IN SELECT * FROM (VALUES\n ('commits',ARRAY['INSERT','SELECT']::text[]),\n ('cleanup',ARRAY['INSERT','SELECT','UPDATE']::text[])\n ) AS expected(name,privileges) LOOP\n SELECT * INTO v_relation FROM pg_class WHERE oid=to_regclass('review_media_private.'||v_expected.name);\n IF v_relation.relkind<>'r' OR v_relation.relowner<>'postgres'::regrole OR NOT v_relation.relrowsecurity OR NOT v_relation.relforcerowsecurity\n OR (SELECT array_agg(a.privilege_type ORDER BY a.privilege_type) FROM aclexplode(v_relation.relacl) a\n WHERE a.grantee=v_owner) IS DISTINCT FROM v_expected.privileges\n OR EXISTS (SELECT 1 FROM aclexplode(v_relation.relacl) a WHERE a.grantee<>v_relation.relowner AND (a.grantee<>v_owner OR a.is_grantable))\n OR EXISTS (SELECT 1 FROM pg_attribute WHERE attrelid=v_relation.oid AND attacl IS NOT NULL) THEN\n RAISE EXCEPTION 'review_media_catalog_private_table_drift';\n END IF;\n END LOOP;\n IF EXISTS (\n WITH expected(relation, name, cmd, using_expr, check_expr) AS (VALUES\n ('commits','review_media_commits_select','r','true'::text,NULL::text),\n ('commits','review_media_commits_insert','a',NULL::text,'true'),\n ('cleanup','review_media_cleanup_select','r','true',NULL::text),\n ('cleanup','review_media_cleanup_insert','a',NULL::text,'true'),\n ('cleanup','review_media_cleanup_update','w','true','true')\n ), actual AS (\n SELECT c.relname::text,p.polname::text,p.polcmd::text,pg_get_expr(p.polqual,p.polrelid),pg_get_expr(p.polwithcheck,p.polrelid),p.polpermissive,p.polroles\n FROM pg_policy p JOIN pg_class c ON c.oid=p.polrelid WHERE c.relnamespace='review_media_private'::regnamespace\n ), wanted AS (SELECT *,true,ARRAY[v_owner] FROM expected)\n (SELECT * FROM wanted EXCEPT SELECT * FROM actual) UNION ALL (SELECT * FROM actual EXCEPT SELECT * FROM wanted)\n ) THEN RAISE EXCEPTION 'review_media_catalog_private_policy_drift'; END IF;\n IF EXISTS (\n SELECT 1 FROM (VALUES ('anon'),('authenticated'),('service_role')) r(name)\n WHERE has_schema_privilege(r.name,'review_media_private','USAGE,CREATE')\n OR has_table_privilege(r.name,'review_media_private.commits','SELECT,INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n OR has_table_privilege(r.name,'review_media_private.cleanup','SELECT,INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n ) OR NOT has_table_privilege(v_owner,'public.reviews','SELECT')\n OR NOT has_table_privilege(v_owner,'public.reviews','DELETE')\n OR EXISTS (SELECT 1 FROM unnest(ARRAY['content','categories','food_photos','is_verified','admin_note','updated_at']) c(name)\n WHERE NOT has_column_privilege(v_owner,'public.reviews',c.name,'UPDATE'))\n OR has_table_privilege(v_owner,'public.reviews','INSERT,UPDATE,TRUNCATE,REFERENCES,TRIGGER')\n OR EXISTS (SELECT 1 FROM pg_attribute a WHERE a.attrelid='public.reviews'::regclass AND a.attnum>0 AND NOT a.attisdropped\n AND a.attname<>ALL(ARRAY['content','categories','food_photos','is_verified','admin_note','updated_at'])\n AND has_column_privilege(v_owner,a.attrelid,a.attnum,'UPDATE'))\n OR NOT has_table_privilege(v_owner,'storage.objects','SELECT')\n OR has_table_privilege(v_owner,'storage.objects','INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER') THEN\n RAISE EXCEPTION 'review_media_catalog_minimum_grant_drift';\n END IF;\n IF EXISTS (\n WITH expected(relation,ordinal,name,type,not_null,default_expr) AS (VALUES\n ('commits',1,'operation_id','uuid',true,NULL::text),\n ('commits',2,'owner_id','uuid',true,NULL::text),\n ('commits',3,'review_id','uuid',true,NULL::text),\n ('commits',4,'kind','text',true,NULL::text),\n ('commits',5,'request_hash','text',true,NULL::text),\n ('cleanup',1,'path','text',true,NULL::text),\n ('cleanup',2,'owner_id','uuid',true,NULL::text),\n ('cleanup',3,'review_id','uuid',true,NULL::text),\n ('cleanup',4,'purpose','text',true,NULL::text),\n ('cleanup',5,'retired','boolean',true,'false'),\n ('cleanup',6,'complete','boolean',true,'false')\n ), actual AS (\n SELECT c.relname::text,a.attnum::integer,a.attname::text,pg_catalog.format_type(a.atttypid,a.atttypmod),a.attnotnull,\n pg_catalog.pg_get_expr(d.adbin,d.adrelid)\n FROM pg_catalog.pg_class c JOIN pg_catalog.pg_attribute a ON a.attrelid=c.oid AND a.attnum>0 AND NOT a.attisdropped\n LEFT JOIN pg_catalog.pg_attrdef d ON d.adrelid=a.attrelid AND d.adnum=a.attnum\n WHERE c.relnamespace='review_media_private'::regnamespace AND c.relkind IN ('r','p')\n )\n (SELECT * FROM expected EXCEPT SELECT * FROM actual) UNION ALL (SELECT * FROM actual EXCEPT SELECT * FROM expected)\n ) THEN RAISE EXCEPTION 'review_media_catalog_column_shape_drift'; END IF;\n IF EXISTS (\n WITH expected(relation,name,definition) AS (VALUES\n ('commits','commits_pkey','PRIMARY KEY (operation_id)'),\n ('commits','commits_kind_check','CHECK ((kind = ANY (ARRAY[''edit''::text, ''delete''::text])))'),\n ('cleanup','cleanup_pkey','PRIMARY KEY (path)'),\n ('cleanup','cleanup_purpose_check','CHECK ((purpose = ANY (ARRAY[''food''::text, ''verification''::text])))')\n ), actual AS (\n SELECT c.relname::text,k.conname::text,pg_catalog.pg_get_constraintdef(k.oid)\n FROM pg_catalog.pg_class c JOIN pg_catalog.pg_constraint k ON k.conrelid=c.oid\n WHERE c.relnamespace='review_media_private'::regnamespace\n )\n (SELECT * FROM expected EXCEPT SELECT * FROM actual) UNION ALL (SELECT * FROM actual EXCEPT SELECT * FROM expected)\n ) OR EXISTS (SELECT 1 FROM pg_catalog.pg_trigger t JOIN pg_catalog.pg_class c ON c.oid=t.tgrelid\n WHERE c.relnamespace='review_media_private'::regnamespace AND NOT t.tgisinternal)\n OR EXISTS (SELECT 1 FROM pg_catalog.pg_constraint k JOIN pg_catalog.pg_class c ON c.oid=k.conrelid\n WHERE c.relnamespace='review_media_private'::regnamespace AND (NOT k.convalidated OR k.condeferrable OR k.condeferred))\n OR (SELECT count(*) FROM pg_catalog.pg_index i JOIN pg_catalog.pg_class c ON c.oid=i.indrelid\n WHERE c.relnamespace='review_media_private'::regnamespace)<>2\n OR EXISTS (SELECT 1 FROM pg_catalog.pg_index i JOIN pg_catalog.pg_class c ON c.oid=i.indrelid\n WHERE c.relnamespace='review_media_private'::regnamespace AND (NOT i.indisprimary OR NOT i.indisvalid OR NOT i.indisready)) THEN\n RAISE EXCEPTION 'review_media_catalog_constraint_shape_drift';\n END IF;\n IF (SELECT pg_catalog.encode(pg_catalog.sha256(pg_catalog.convert_to(prosrc,'UTF8')),'hex') FROM pg_catalog.pg_proc\n WHERE pronamespace=(SELECT oid FROM pg_namespace WHERE nspname='privacy_retention')\n AND proname='g014_catalog_protected_relations' AND pronargs=0) IS DISTINCT FROM '20acd5742d891cf8a33b265a3a1298c65dd9646402c58391cd17829951cf92f2' THEN\n RAISE EXCEPTION 'review_media_catalog_known_identity_post_drift';\n END IF;\n -- Exact allowlist and unchanged G014 assertions run through the owner bridge\n -- above; canonical readback also runs them before this catalog-only block.\n -- REVIEW_MEDIA_TRIGGER_READBACK_BEGIN\n IF EXISTS (\n WITH expected(name,definition) AS (VALUES\n ('review_media_enqueue_removed','CREATE TRIGGER review_media_enqueue_removed AFTER DELETE OR UPDATE OF food_photos, verification_photo, user_id, id ON public.reviews FOR EACH ROW EXECUTE FUNCTION review_media_private.enqueue_removed()'),\n ('review_media_reference_guard','CREATE TRIGGER review_media_reference_guard BEFORE INSERT OR UPDATE OF food_photos, verification_photo, user_id, id ON public.reviews FOR EACH ROW EXECUTE FUNCTION review_media_private.guard_references()'),\n ('review_media_serialize','CREATE TRIGGER review_media_serialize BEFORE INSERT OR DELETE OR UPDATE OF food_photos, verification_photo, user_id, id ON public.reviews FOR EACH STATEMENT EXECUTE FUNCTION review_media_private.lock_changes()')\n ), actual AS (\n SELECT tgname::text,pg_get_triggerdef(oid),tgenabled::text FROM pg_trigger\n WHERE tgrelid='public.reviews'::regclass AND tgname LIKE 'review_media_%' AND NOT tgisinternal\n ), wanted AS (SELECT name,definition,'O'::text FROM expected)\n (SELECT * FROM wanted EXCEPT SELECT * FROM actual) UNION ALL (SELECT * FROM actual EXCEPT SELECT * FROM wanted)\n ) THEN RAISE EXCEPTION 'review_media_catalog_trigger_drift'; END IF;\n -- REVIEW_MEDIA_TRIGGER_READBACK_END\n -- Compare command, role, permissive/restrictive bit and BOTH complete predicates.\n IF EXISTS (\n WITH expected(name,cmd,permissive,role_name,using_expr,check_expr) AS (VALUES\n ('review_media_safe_delete','d',false,'authenticated','((bucket_id <> ''review-photos''::text) OR review_media_delete_allowed(name))',NULL::text),\n ('review_media_safe_insert','a',false,'authenticated',NULL::text,'((bucket_id <> ALL (ARRAY[''review-photos''::text, ''review-verifications''::text])) OR review_media_upload_allowed(bucket_id, name))'),\n ('review_media_safe_update','w',false,'authenticated','((bucket_id <> ALL (ARRAY[''review-photos''::text, ''review-verifications''::text])) OR review_media_upload_allowed(bucket_id, name))','((bucket_id <> ALL (ARRAY[''review-photos''::text, ''review-verifications''::text])) OR review_media_upload_allowed(bucket_id, name))'),\n ('review_media_workflow_read','r',true,'privacy_workflow_owner','(bucket_id = ANY (ARRAY[''review-photos''::text, ''review-verifications''::text]))',NULL::text),\n ('review_photos_food_insert','a',false,'authenticated',NULL::text,'((bucket_id <> ''review-photos''::text) OR ((split_part(name, ''/''::text, 4) = ''food''::text) AND ((storage.foldername(name))[1] = ( SELECT (auth.uid())::text AS uid))))'),\n ('review_photos_food_update','w',false,'authenticated','((bucket_id <> ''review-photos''::text) OR ((split_part(name, ''/''::text, 4) = ''food''::text) AND ((storage.foldername(name))[1] = ( SELECT (auth.uid())::text AS uid))))','((bucket_id <> ''review-photos''::text) OR ((split_part(name, ''/''::text, 4) = ''food''::text) AND ((storage.foldername(name))[1] = ( SELECT (auth.uid())::text AS uid))))'),\n ('review_verifications_owner_delete','d',true,'authenticated','((bucket_id = ''review-verifications''::text) AND ((storage.foldername(name))[1] = ( SELECT (auth.uid())::text AS uid)))',NULL::text),\n ('review_verifications_owner_insert','a',true,'authenticated',NULL::text,'((bucket_id = ''review-verifications''::text) AND ((storage.foldername(name))[1] = ( SELECT (auth.uid())::text AS uid)) AND (split_part(name, ''/''::text, 4) = ''verification''::text))'),\n ('review_verifications_owner_read','r',true,'authenticated','((bucket_id = ''review-verifications''::text) AND (((storage.foldername(name))[1] = ( SELECT (auth.uid())::text AS uid)) OR has_role(( SELECT auth.uid() AS uid), ''admin''::app_role)))',NULL::text),\n ('review_verifications_safe_delete','d',false,'authenticated','((bucket_id <> ''review-verifications''::text) OR review_media_delete_allowed(name))',NULL::text)\n ), actual AS (\n SELECT p.polname::text,p.polcmd::text,p.polpermissive,p.polroles,\n regexp_replace(pg_get_expr(p.polqual,p.polrelid),'[[:space:]]+',' ','g'),\n regexp_replace(pg_get_expr(p.polwithcheck,p.polrelid),'[[:space:]]+',' ','g')\n FROM pg_policy p WHERE p.polrelid='storage.objects'::regclass\n AND (p.polname LIKE 'review_media_%' OR p.polname LIKE 'review_photos_%' OR p.polname LIKE 'review_verifications_%')\n ), wanted AS (SELECT name,cmd,permissive,ARRAY[to_regrole(role_name)::oid],using_expr,check_expr FROM expected)\n (SELECT * FROM wanted EXCEPT SELECT * FROM actual) UNION ALL (SELECT * FROM actual EXCEPT SELECT * FROM wanted)\n ) THEN RAISE EXCEPTION 'review_media_catalog_storage_policy_drift'; END IF;\n IF NOT EXISTS (SELECT 1 FROM storage.buckets WHERE id='review-verifications' AND name='review-verifications'\n AND public=false AND file_size_limit=5242880\n AND allowed_mime_types=ARRAY['image/jpeg','image/png','image/webp','image/avif']::text[]) THEN\n RAISE EXCEPTION 'review_media_catalog_private_bucket_drift';\n END IF;\n -- Admit the strict canonical local read policy or the three exact deployed\n -- bucket read identities. All existing API-role reads must match a known\n -- predicate; the private verification bucket is never publicly readable.\n IF EXISTS (SELECT 1 FROM pg_policy p WHERE p.polrelid='storage.objects'::regclass\n AND p.polcmd='r' AND p.polpermissive AND p.polroles && ARRAY[0::oid,'anon'::regrole::oid,'authenticated'::regrole::oid]\n AND p.polname NOT IN ('tzudong_public_media_read','Anyone can view review photos','Public read access',\n 'Public read access for profile-avatars','local_nightly_avatar_read','review_verifications_owner_read'))\n OR EXISTS (SELECT 1 FROM pg_policy p JOIN (VALUES\n ('Anyone can view review photos','(bucket_id = ''review-photos''::text)'),\n ('Public read access','(bucket_id = ''ad-banner-images''::text)'),\n ('Public read access for profile-avatars','(bucket_id = ''profile-avatars''::text)')\n ) e(name,predicate) ON p.polname=e.name\n WHERE p.polrelid='storage.objects'::regclass AND (p.polcmd<>'r' OR NOT p.polpermissive\n OR p.polroles<>ARRAY[0::oid] OR p.polwithcheck IS NOT NULL OR pg_get_expr(p.polqual,p.polrelid)<>e.predicate))\n OR EXISTS (SELECT 1 FROM pg_policy p WHERE p.polrelid='storage.objects'::regclass\n AND p.polname='tzudong_public_media_read' AND (p.polcmd<>'r' OR NOT p.polpermissive\n OR NOT p.polroles @> ARRAY['anon'::regrole::oid,'authenticated'::regrole::oid] OR cardinality(p.polroles)<>2\n OR p.polwithcheck IS NOT NULL OR pg_get_expr(p.polqual,p.polrelid)<>'(bucket_id = ANY (ARRAY[''profile-avatars''::text, ''review-photos''::text, ''ad-banner-images''::text]))'))\n OR EXISTS (SELECT 1 FROM pg_policy p WHERE p.polrelid='storage.objects'::regclass AND p.polname='local_nightly_avatar_read'\n AND (p.polcmd<>'r' OR NOT p.polpermissive OR NOT p.polroles @> ARRAY['anon'::regrole::oid,'authenticated'::regrole::oid]\n OR cardinality(p.polroles)<>2 OR p.polwithcheck IS NOT NULL OR pg_get_expr(p.polqual,p.polrelid)<>'(bucket_id = ''avatars''::text)')) THEN\n RAISE EXCEPTION 'review_media_catalog_public_read_drift';\n END IF;\n IF NOT EXISTS (SELECT 1 FROM pg_policy WHERE polrelid='storage.objects'::regclass\n AND polname='tzudong_public_media_read' AND polcmd='r' AND polpermissive\n AND polroles @> ARRAY['anon'::regrole::oid,'authenticated'::regrole::oid]\n AND cardinality(polroles)=2 AND polwithcheck IS NULL\n AND pg_get_expr(polqual,polrelid)='(bucket_id = ANY (ARRAY[''profile-avatars''::text, ''review-photos''::text, ''ad-banner-images''::text]))')\n AND (SELECT count(*) FROM pg_policy WHERE polrelid='storage.objects'::regclass\n AND polname IN ('Anyone can view review photos','Public read access','Public read access for profile-avatars'))<>3 THEN\n RAISE EXCEPTION 'review_media_catalog_public_read_drift';\n END IF;\n -- The global reference scan must see all reviews under the trusted role.\n IF NOT EXISTS (SELECT 1 FROM pg_policy WHERE polrelid='public.reviews'::regclass\n AND polname='g014_account_deletion_source_access' AND polcmd='*' AND polpermissive\n AND polroles=ARRAY[v_owner] AND pg_get_expr(polqual,polrelid)='true' AND pg_get_expr(polwithcheck,polrelid)='true') THEN\n RAISE EXCEPTION 'review_media_catalog_reference_visibility_drift';\n END IF;\n PERFORM set_config('search_path',v_path,true);\nEND $review_media_catalog_readback$",
+ "-- REVIEW_MEDIA_READBACK_END\nNOTIFY pgrst, 'reload schema'",
+ "COMMIT"
+ ]
+ },
+ {
+ "id": "admin_review_media_completion",
+ "version": "20261011072824",
+ "name": "admin_review_media_completion",
+ "path": "backend/supabase/migrations/20261011072824_admin_review_media_completion.sql",
+ "bytes": 13429,
+ "sha256": "32626259ca77ea913f068ee804815ff439abbff1ce310da4525e4f0bb86d8338",
+ "statementCount": 7,
+ "statementVectorSha256": "3a47d7e182bfd764ae70401e4e8462b08eaa5576baf4d051503e80534fc8fb8e",
+ "originalStatementVector": [
+ "-- Forward-only correction. Immutable applied SQL and G014 assertions stay intact.\n-- Relation locks precede the media global lock; global precedes object locks.\n-- Admin locks reviews before restaurants, matching review-trigger counter work.\nBEGIN",
+ "SET LOCAL lock_timeout='2s'",
+ "SELECT pg_advisory_xact_lock(hashtextextended('tzudong:review-media-catalog:v2',0))",
+ "DO $forward$\nDECLARE target oid; definition text; source text; patched text; metadata jsonb; defaults text;\n before_members jsonb; before_assertions jsonb; before_manifest jsonb; self_membership jsonb;\n workflow_owner oid:='privacy_workflow_owner'::regrole; runner oid:='postgres'::regrole;\n major integer:=current_setting('server_version_num')::integer/10000; pg15_lease boolean:=false;\nBEGIN\n IF current_user<>'postgres' OR session_user<>'postgres' OR major NOT IN (15,17)\n OR current_setting('transaction_read_only')<>'off' OR NOT EXISTS(SELECT 1 FROM pg_roles\n WHERE oid=workflow_owner AND NOT rolsuper AND NOT rolbypassrls AND NOT rolcanlogin AND NOT rolinherit)\n OR to_regprocedure('public.admin_review_verification_cleanup(uuid,text,text[])') IS NOT NULL\n THEN RAISE EXCEPTION 'REVIEW_MEDIA_FORWARD_EXECUTOR_DENIED'; END IF;\n SELECT coalesce(jsonb_agg(to_jsonb(m) ORDER BY roleid,member,grantor),'[]') INTO before_members FROM pg_auth_members m;\n SELECT jsonb_agg(to_jsonb(p) ORDER BY oid) INTO before_assertions FROM pg_proc p WHERE pronamespace='privacy_retention'::regnamespace;\n\n target:='public.admin_record_action(uuid,text,uuid,text,uuid[],jsonb,text)'::regprocedure;\n SELECT pg_get_functiondef(p.oid),p.prosrc,to_jsonb(p)-ARRAY['prosrc','proargdefaults'],pg_get_expr(p.proargdefaults,0)\n INTO definition,source,metadata,defaults FROM pg_proc p WHERE p.oid=target;\n IF encode(sha256(convert_to(source,'UTF8')),'hex')<>'a18fad1f748d736371a9ab549a1ca483a5b2f321674fabe71b2411b7e58b3fc9' THEN RAISE EXCEPTION 'REVIEW_MEDIA_LOCK_SOURCE_DRIFT'; END IF;\n patched:=source;\n IF (length(patched)-length(replace(patched,$old$LOCK TABLE public.restaurants,public.restaurant_submissions,public.restaurant_submission_items,public.reviews,public.restaurant_requests IN SHARE ROW EXCLUSIVE MODE;$old$,'')))/length($old$LOCK TABLE public.restaurants,public.restaurant_submissions,public.restaurant_submission_items,public.reviews,public.restaurant_requests IN SHARE ROW EXCLUSIVE MODE;$old$)<>1 THEN RAISE EXCEPTION 'REVIEW_MEDIA_LOCK_ANCHOR_DRIFT'; END IF;\n patched:=replace(patched,$old$LOCK TABLE public.restaurants,public.restaurant_submissions,public.restaurant_submission_items,public.reviews,public.restaurant_requests IN SHARE ROW EXCLUSIVE MODE;$old$,$new$LOCK TABLE public.reviews,public.restaurants,public.restaurant_submissions,public.restaurant_submission_items,public.restaurant_requests IN SHARE ROW EXCLUSIVE MODE;$new$);\n IF (length(patched)-length(replace(patched,$old$IF p_phase LIKE 'cleanup_%' THEN$old$,'')))/length($old$IF p_phase LIKE 'cleanup_%' THEN$old$)<>1 THEN RAISE EXCEPTION 'REVIEW_MEDIA_LOCK_ANCHOR_DRIFT'; END IF;\n patched:=replace(patched,$old$IF p_phase LIKE 'cleanup_%' THEN$old$,$new$IF p_phase LIKE 'cleanup_%' THEN\n PERFORM pg_advisory_xact_lock(741093, 1);$new$);\n IF (length(patched)-length(replace(patched,$old$IF p_action='review.delete' THEN\n FOR media$old$,'')))/length($old$IF p_action='review.delete' THEN\n FOR media$old$)<>1 THEN RAISE EXCEPTION 'REVIEW_MEDIA_LOCK_ANCHOR_DRIFT'; END IF;\n patched:=replace(patched,$old$IF p_action='review.delete' THEN\n FOR media$old$,$new$IF p_action='review.delete' THEN\n PERFORM pg_advisory_xact_lock(741093, 1);\n FOR media$new$);\n EXECUTE replace(definition,source,patched);\n IF (SELECT to_jsonb(p)-ARRAY['prosrc','proargdefaults'] FROM pg_proc p WHERE p.oid=target) IS DISTINCT FROM metadata\n OR (SELECT pg_get_expr(p.proargdefaults,0) FROM pg_proc p WHERE p.oid=target) IS DISTINCT FROM defaults\n OR (SELECT encode(sha256(convert_to(p.prosrc,'UTF8')),'hex') FROM pg_proc p WHERE p.oid=target)<>'2353de06b4d93f45fd603380e678f4edbcc0b16a8bd9860b5967683bea5f1157'\n THEN RAISE EXCEPTION 'REVIEW_MEDIA_LOCK_POST_DRIFT'; END IF;\n\n SELECT to_jsonb(m) INTO self_membership FROM pg_auth_members m WHERE roleid=workflow_owner AND member=runner AND grantor=runner;\n IF self_membership IS NOT NULL AND (self_membership->>'admin_option')::boolean THEN RAISE EXCEPTION 'REVIEW_MEDIA_FORWARD_MEMBERSHIP_DENIED'; END IF;\n IF major=17 THEN\n IF NOT EXISTS(SELECT 1 FROM pg_auth_members WHERE roleid=workflow_owner AND member=runner AND admin_option AND grantor<>runner)\n THEN RAISE EXCEPTION 'REVIEW_MEDIA_FORWARD_OWNER_AUTHORITY_MISSING'; END IF;\n EXECUTE 'GRANT privacy_workflow_owner TO postgres WITH ADMIN FALSE,INHERIT FALSE,SET TRUE GRANTED BY postgres';\n ELSE\n pg15_lease:=NOT pg_has_role(runner,workflow_owner,'MEMBER');\n IF pg15_lease THEN GRANT privacy_workflow_owner TO postgres; END IF;\n END IF;\n SET LOCAL ROLE privacy_workflow_owner;\n SELECT jsonb_agg(to_jsonb(m) ORDER BY manifest_kind,manifest_key) INTO before_manifest FROM privacy_retention.g014_catalog_contract_manifest m;\n\n target:='public.mutate_review_with_media(uuid,uuid,text,timestamp with time zone,text,text[],text[])'::regprocedure;\n SELECT pg_get_functiondef(p.oid),p.prosrc,to_jsonb(p)-ARRAY['prosrc','proargdefaults'],pg_get_expr(p.proargdefaults,0)\n INTO definition,source,metadata,defaults FROM pg_proc p WHERE p.oid=target;\n IF encode(sha256(convert_to(source,'UTF8')),'hex')<>'50bfad7bc4fc7ddbc9d9379e8eb13facd938a15f66553576cc69fbcf69aa98b1' THEN RAISE EXCEPTION 'REVIEW_MEDIA_LOCK_SOURCE_DRIFT'; END IF;\n patched:=source;\n IF (length(patched)-length(replace(patched,$old$PERFORM pg_advisory_xact_lock(741093, 1);$old$,'')))/length($old$PERFORM pg_advisory_xact_lock(741093, 1);$old$)<>1 THEN RAISE EXCEPTION 'REVIEW_MEDIA_LOCK_ANCHOR_DRIFT'; END IF;\n patched:=replace(patched,$old$PERFORM pg_advisory_xact_lock(741093, 1);$old$,$new$LOCK TABLE public.reviews IN ROW EXCLUSIVE MODE;\n PERFORM pg_advisory_xact_lock(741093, 1);$new$);\n EXECUTE replace(definition,source,patched);\n IF (SELECT to_jsonb(p)-ARRAY['prosrc','proargdefaults'] FROM pg_proc p WHERE p.oid=target) IS DISTINCT FROM metadata\n OR (SELECT pg_get_expr(p.proargdefaults,0) FROM pg_proc p WHERE p.oid=target) IS DISTINCT FROM defaults\n OR (SELECT encode(sha256(convert_to(p.prosrc,'UTF8')),'hex') FROM pg_proc p WHERE p.oid=target)<>'d5d6646a4294c0e7bd0cd75ea47a996c9c57bac6c32a39ac53fbb7a8b1e7e323'\n THEN RAISE EXCEPTION 'REVIEW_MEDIA_LOCK_POST_DRIFT'; END IF;\n\n EXECUTE $rpc$CREATE FUNCTION public.admin_review_verification_cleanup(p_review_id uuid,p_phase text,p_paths text[] DEFAULT NULL)\n RETURNS jsonb LANGUAGE plpgsql SECURITY DEFINER SET search_path='' AS $cleanup$\nDECLARE items jsonb;\nBEGIN\n IF p_review_id IS NULL OR p_phase IS NULL OR p_phase NOT IN ('prepare','finish')\n OR current_setting('transaction_isolation') <> 'read committed'\n OR (p_phase = 'prepare' AND p_paths IS NOT NULL)\n OR (p_phase = 'finish' AND (p_paths IS NULL OR cardinality(p_paths) > 20\n OR EXISTS (SELECT 1 FROM unnest(p_paths) x WHERE x IS NULL OR octet_length(x) > 8192)\n OR cardinality(p_paths) <> (SELECT count(DISTINCT x) FROM unnest(p_paths) x))) THEN\n RAISE EXCEPTION 'REVIEW_ADMIN_CLEANUP_INVALID';\n END IF;\n PERFORM pg_advisory_xact_lock(741093, 1);\n IF p_phase = 'prepare' THEN\n UPDATE review_media_private.cleanup c SET retired = true\n WHERE c.review_id = p_review_id AND c.purpose = 'verification'\n AND NOT c.retired AND NOT c.complete AND NOT review_media_private.referenced(c.path);\n SELECT coalesce(jsonb_agg(to_jsonb(x) ORDER BY x.path),'[]'::jsonb) INTO items\n FROM (SELECT c.path,c.owner_id,c.review_id,c.purpose FROM review_media_private.cleanup c\n WHERE c.review_id = p_review_id AND c.purpose = 'verification' AND c.retired AND NOT c.complete\n AND NOT review_media_private.referenced(c.path)\n AND (review_media_private.canonical(c.path,c.owner_id,c.review_id,c.purpose)\n OR review_media_private.owned_legacy(c.path,c.owner_id,c.purpose))\n ORDER BY c.path LIMIT 20) x;\n RETURN jsonb_build_object('status','READY','items',items);\n END IF;\n UPDATE review_media_private.cleanup c SET complete = true\n WHERE c.review_id = p_review_id AND c.purpose = 'verification' AND c.retired AND NOT c.complete\n AND c.path = ANY(p_paths)\n AND (review_media_private.canonical(c.path,c.owner_id,c.review_id,c.purpose)\n OR review_media_private.owned_legacy(c.path,c.owner_id,c.purpose))\n AND NOT review_media_private.referenced(c.path)\n AND NOT EXISTS (SELECT 1 FROM storage.objects o\n WHERE o.bucket_id IN ('review-photos','review-verifications') AND o.name = c.path);\n RETURN jsonb_build_object('remaining',(SELECT count(*) FROM review_media_private.cleanup c\n WHERE c.review_id = p_review_id AND c.purpose = 'verification' AND NOT c.complete));\nEND\n$cleanup$;$rpc$;\n REVOKE ALL ON FUNCTION public.admin_review_verification_cleanup(uuid,text,text[]) FROM PUBLIC,anon,authenticated,service_role;\n GRANT EXECUTE ON FUNCTION public.admin_review_verification_cleanup(uuid,text,text[]) TO service_role;\n INSERT INTO privacy_retention.g014_public_rpc_allowlist(function_schema,function_name,identity_arguments,grantee,source_signature)\n SELECT 'public',p.proname,p.proargtypes::text,'service_role','public.admin_review_verification_cleanup(uuid,text,text[])'\n FROM pg_proc p WHERE p.oid='public.admin_review_verification_cleanup(uuid,text,text[])'::regprocedure;\n IF to_regprocedure('pg_temp.admin_media_forward_assert()') IS NOT NULL THEN RAISE EXCEPTION 'REVIEW_MEDIA_FORWARD_BRIDGE_EXISTS'; END IF;\n CREATE FUNCTION pg_temp.admin_media_forward_assert() RETURNS void LANGUAGE plpgsql SECURITY DEFINER SET search_path='' AS $bridge$\n BEGIN\n PERFORM privacy_retention.assert_g014_public_rpc_allowlist();\n PERFORM privacy_retention.assert_g014_definer_contract();\n PERFORM privacy_retention.assert_g014_catalog_contract();\n DROP FUNCTION pg_temp.admin_media_forward_assert();\n END $bridge$;\n REVOKE ALL ON FUNCTION pg_temp.admin_media_forward_assert() FROM PUBLIC,anon,authenticated,service_role;\n GRANT EXECUTE ON FUNCTION pg_temp.admin_media_forward_assert() TO postgres;\n IF (SELECT jsonb_agg(to_jsonb(m) ORDER BY manifest_kind,manifest_key) FROM privacy_retention.g014_catalog_contract_manifest m) IS DISTINCT FROM before_manifest THEN RAISE EXCEPTION 'REVIEW_MEDIA_FORWARD_MANIFEST_DRIFT'; END IF;\n RESET ROLE;\n IF major=15 THEN\n IF pg15_lease THEN REVOKE privacy_workflow_owner FROM postgres; END IF;\n ELSIF self_membership IS NULL THEN\n REVOKE privacy_workflow_owner FROM postgres GRANTED BY postgres;\n ELSE\n EXECUTE format('GRANT privacy_workflow_owner TO postgres WITH ADMIN FALSE,INHERIT %s,SET %s GRANTED BY postgres',\n upper(self_membership->>'inherit_option'),upper(self_membership->>'set_option'));\n END IF;\n IF (SELECT coalesce(jsonb_agg(to_jsonb(m) ORDER BY roleid,member,grantor),'[]') FROM pg_auth_members m) IS DISTINCT FROM before_members\n OR (SELECT jsonb_agg(to_jsonb(p) ORDER BY oid) FROM pg_proc p WHERE pronamespace='privacy_retention'::regnamespace) IS DISTINCT FROM before_assertions\n THEN RAISE EXCEPTION 'REVIEW_MEDIA_FORWARD_PRESERVATION_DRIFT'; END IF;\n PERFORM pg_temp.admin_media_forward_assert();\n IF to_regprocedure('pg_temp.admin_media_forward_assert()') IS NOT NULL THEN RAISE EXCEPTION 'REVIEW_MEDIA_FORWARD_BRIDGE_REMAINING'; END IF;\nEND $forward$",
+ "-- ADMIN_REVIEW_MEDIA_READBACK_BEGIN\nDO $readback$\nBEGIN\n IF NOT EXISTS(SELECT 1 FROM pg_proc p WHERE p.oid='public.admin_review_verification_cleanup(uuid,text,text[])'::regprocedure\n AND p.proowner='privacy_workflow_owner'::regrole AND p.prosecdef AND p.proconfig=ARRAY['search_path=\"\"']::text[]\n AND p.pronargs=3 AND p.pronargdefaults=1 AND p.prorettype='jsonb'::regtype AND NOT p.proretset\n AND p.provolatile='v' AND p.prokind='f' AND NOT p.proisstrict\n AND p.proargnames=ARRAY['p_review_id','p_phase','p_paths']::text[]\n AND pg_get_expr(p.proargdefaults,0)='NULL::text[]'\n AND p.prolang=(SELECT oid FROM pg_language WHERE lanname='plpgsql')\n AND NOT EXISTS(SELECT 1 FROM aclexplode(coalesce(p.proacl,acldefault('f',p.proowner))) a\n WHERE a.is_grantable OR a.privilege_type<>'EXECUTE'\n OR a.grantee NOT IN ('privacy_workflow_owner'::regrole,'service_role'::regrole))\n AND encode(sha256(convert_to(p.prosrc,'UTF8')),'hex')='f4d19bc5b41fe7808635240cae80f796d12f6cad8b13802577a88afbb1f024a7'\n AND NOT has_function_privilege('anon',p.oid,'EXECUTE') AND NOT has_function_privilege('authenticated',p.oid,'EXECUTE')\n AND has_function_privilege('service_role',p.oid,'EXECUTE'))\n OR (SELECT encode(sha256(convert_to(prosrc,'UTF8')),'hex') FROM pg_proc WHERE oid='public.admin_record_action(uuid,text,uuid,text,uuid[],jsonb,text)'::regprocedure)<>'2353de06b4d93f45fd603380e678f4edbcc0b16a8bd9860b5967683bea5f1157'\n OR (SELECT encode(sha256(convert_to(prosrc,'UTF8')),'hex') FROM pg_proc WHERE oid='public.mutate_review_with_media(uuid,uuid,text,timestamp with time zone,text,text[],text[])'::regprocedure)<>'d5d6646a4294c0e7bd0cd75ea47a996c9c57bac6c32a39ac53fbb7a8b1e7e323'\n THEN RAISE EXCEPTION 'REVIEW_MEDIA_FORWARD_READBACK_DRIFT'; END IF;\nEND $readback$",
+ "-- ADMIN_REVIEW_MEDIA_READBACK_END\nNOTIFY pgrst,'reload schema'",
+ "COMMIT"
+ ]
+ },
+ {
+ "id": "review_legacy_shared_cleanup",
+ "version": "20261011085342",
+ "name": "review_legacy_shared_cleanup",
+ "path": "backend/supabase/migrations/20261011085342_review_legacy_shared_cleanup.sql",
+ "bytes": 7661,
+ "sha256": "623236ddbd87059b94c84486f9e14822dba0190d2448656259991bd1345a434f",
+ "statementCount": 6,
+ "statementVectorSha256": "b7b7cc3636ba9496aea569ec18ddeeeb18dbd97e20228e3490a41dd37f6f3956",
+ "originalStatementVector": [
+ "-- Unreferenced shared legacy receipts follow their last authoritative review.\n-- Applied SQL, grants, actor authorization and canonical key ownership stay intact.\nBEGIN",
+ "SET LOCAL lock_timeout='2s'",
+ "SELECT pg_advisory_xact_lock(hashtextextended('tzudong:review-media-catalog:v2',0))",
+ "DO $forward$\nDECLARE target oid:='review_media_private.enqueue_removed()'::regprocedure;\n definition text; source text; patched text; metadata jsonb;\n before_members jsonb; before_assertions jsonb; before_manifest jsonb; self_membership jsonb;\n before_schema jsonb; schema_lease boolean;\n workflow_owner oid:='privacy_workflow_owner'::regrole; runner oid:='postgres'::regrole;\n major integer:=current_setting('server_version_num')::integer/10000; pg15_lease boolean:=false;\nBEGIN\n IF current_user<>'postgres' OR session_user<>'postgres' OR major NOT IN (15,17)\n OR current_setting('transaction_read_only')<>'off' OR NOT EXISTS(SELECT 1 FROM pg_roles\n WHERE oid=workflow_owner AND NOT rolsuper AND NOT rolbypassrls AND NOT rolcanlogin AND NOT rolinherit)\n THEN RAISE EXCEPTION 'REVIEW_SHARED_EXECUTOR_DENIED'; END IF;\n SELECT coalesce(jsonb_agg(to_jsonb(m) ORDER BY roleid,member,grantor),'[]') INTO before_members FROM pg_auth_members m;\n SELECT jsonb_agg(to_jsonb(p) ORDER BY oid) INTO before_assertions FROM pg_proc p WHERE pronamespace='privacy_retention'::regnamespace;\n SELECT pg_get_functiondef(p.oid),p.prosrc,to_jsonb(p)-'prosrc' INTO definition,source,metadata FROM pg_proc p WHERE p.oid=target;\n IF metadata->>'proowner'<>workflow_owner::text OR encode(sha256(convert_to(source,'UTF8')),'hex')<>'7edb21d70ea3ff81ab90e13617e8c1c2749b54b1506f1ff42aaa6c5dc33f9e38'\n THEN RAISE EXCEPTION 'REVIEW_SHARED_SOURCE_DRIFT'; END IF;\n SELECT to_jsonb(n) INTO before_schema FROM pg_namespace n WHERE n.oid='review_media_private'::regnamespace;\n IF before_schema->>'nspowner'<>runner::text THEN RAISE EXCEPTION 'REVIEW_SHARED_SCHEMA_OWNER_DRIFT'; END IF;\n schema_lease:=NOT has_schema_privilege(workflow_owner,'review_media_private','CREATE');\n IF schema_lease THEN GRANT CREATE ON SCHEMA review_media_private TO privacy_workflow_owner; END IF;\n SELECT to_jsonb(m) INTO self_membership FROM pg_auth_members m WHERE roleid=workflow_owner AND member=runner AND grantor=runner;\n IF self_membership IS NOT NULL AND (self_membership->>'admin_option')::boolean THEN RAISE EXCEPTION 'REVIEW_MEDIA_FORWARD_MEMBERSHIP_DENIED'; END IF;\n IF major=17 THEN\n IF NOT EXISTS(SELECT 1 FROM pg_auth_members WHERE roleid=workflow_owner AND member=runner AND admin_option AND grantor<>runner)\n THEN RAISE EXCEPTION 'REVIEW_MEDIA_FORWARD_OWNER_AUTHORITY_MISSING'; END IF;\n EXECUTE 'GRANT privacy_workflow_owner TO postgres WITH ADMIN FALSE,INHERIT FALSE,SET TRUE GRANTED BY postgres';\n ELSE\n pg15_lease:=NOT pg_has_role(runner,workflow_owner,'MEMBER');\n IF pg15_lease THEN GRANT privacy_workflow_owner TO postgres; END IF;\n END IF;\n SET LOCAL ROLE privacy_workflow_owner;\n SELECT jsonb_agg(to_jsonb(m) ORDER BY manifest_kind,manifest_key) INTO before_manifest FROM privacy_retention.g014_catalog_contract_manifest m;\n\n IF (length(source)-length(replace(source,$old$INSERT INTO review_media_private.cleanup(path, owner_id, review_id, purpose, retired)\n VALUES (p, OLD.user_id, OLD.id, purpose, NOT review_media_private.referenced(p))\n ON CONFLICT DO NOTHING;$old$,'')))/length($old$INSERT INTO review_media_private.cleanup(path, owner_id, review_id, purpose, retired)\n VALUES (p, OLD.user_id, OLD.id, purpose, NOT review_media_private.referenced(p))\n ON CONFLICT DO NOTHING;$old$)<>1\n THEN RAISE EXCEPTION 'REVIEW_SHARED_ANCHOR_DRIFT'; END IF;\n patched:=replace(source,$old$INSERT INTO review_media_private.cleanup(path, owner_id, review_id, purpose, retired)\n VALUES (p, OLD.user_id, OLD.id, purpose, NOT review_media_private.referenced(p))\n ON CONFLICT DO NOTHING;$old$,$new$INSERT INTO review_media_private.cleanup AS queued(path, owner_id, review_id, purpose, retired)\n VALUES (p, OLD.user_id, OLD.id, purpose, NOT review_media_private.referenced(p))\n ON CONFLICT (path) DO UPDATE SET review_id = EXCLUDED.review_id,\n retired = queued.retired OR EXCLUDED.retired\n WHERE queued.owner_id = EXCLUDED.owner_id AND queued.purpose = EXCLUDED.purpose\n AND queued.purpose = 'verification' AND NOT queued.retired AND NOT queued.complete\n AND review_media_private.owned_legacy(queued.path, queued.owner_id, queued.purpose);$new$);\n EXECUTE replace(definition,source,patched);\n IF (SELECT to_jsonb(p)-'prosrc' FROM pg_proc p WHERE p.oid=target) IS DISTINCT FROM metadata\n OR (SELECT encode(sha256(convert_to(p.prosrc,'UTF8')),'hex') FROM pg_proc p WHERE p.oid=target)<>'cbf6a87e453e8c2e14d67acd73a92e399fbba4b4f24ac27966806e13ef1fd905'\n THEN RAISE EXCEPTION 'REVIEW_SHARED_POST_DRIFT'; END IF;\n CREATE FUNCTION pg_temp.review_shared_assert() RETURNS void LANGUAGE plpgsql SECURITY DEFINER SET search_path='' AS $bridge$\n BEGIN\n PERFORM privacy_retention.assert_g014_public_rpc_allowlist();\n PERFORM privacy_retention.assert_g014_definer_contract();\n PERFORM privacy_retention.assert_g014_catalog_contract();\n DROP FUNCTION pg_temp.review_shared_assert();\n END $bridge$;\n REVOKE ALL ON FUNCTION pg_temp.review_shared_assert() FROM PUBLIC,anon,authenticated,service_role;\n GRANT EXECUTE ON FUNCTION pg_temp.review_shared_assert() TO postgres;\n IF (SELECT jsonb_agg(to_jsonb(m) ORDER BY manifest_kind,manifest_key) FROM privacy_retention.g014_catalog_contract_manifest m) IS DISTINCT FROM before_manifest\n THEN RAISE EXCEPTION 'REVIEW_SHARED_MANIFEST_DRIFT'; END IF;\n RESET ROLE;\n IF schema_lease THEN REVOKE CREATE ON SCHEMA review_media_private FROM privacy_workflow_owner; END IF;\n IF major=15 THEN\n IF pg15_lease THEN REVOKE privacy_workflow_owner FROM postgres; END IF;\n ELSIF self_membership IS NULL THEN\n REVOKE privacy_workflow_owner FROM postgres GRANTED BY postgres;\n ELSE\n EXECUTE format('GRANT privacy_workflow_owner TO postgres WITH ADMIN FALSE,INHERIT %s,SET %s GRANTED BY postgres',\n upper(self_membership->>'inherit_option'),upper(self_membership->>'set_option'));\n END IF;\n\n IF (SELECT coalesce(jsonb_agg(to_jsonb(m) ORDER BY roleid,member,grantor),'[]') FROM pg_auth_members m) IS DISTINCT FROM before_members\n OR (SELECT jsonb_agg(to_jsonb(p) ORDER BY oid) FROM pg_proc p WHERE pronamespace='privacy_retention'::regnamespace) IS DISTINCT FROM before_assertions\n OR (SELECT to_jsonb(n) FROM pg_namespace n WHERE n.oid='review_media_private'::regnamespace) IS DISTINCT FROM before_schema\n THEN RAISE EXCEPTION 'REVIEW_SHARED_PRESERVATION_DRIFT'; END IF;\n PERFORM pg_temp.review_shared_assert();\nEND $forward$",
+ "-- REVIEW_SHARED_MEDIA_READBACK_BEGIN\nDO $readback$\nBEGIN\n IF NOT EXISTS(SELECT 1 FROM pg_proc p WHERE p.oid='review_media_private.enqueue_removed()'::regprocedure\n AND p.proowner='privacy_workflow_owner'::regrole AND p.prosecdef AND p.proconfig=ARRAY['search_path=\"\"']::text[]\n AND p.prorettype='trigger'::regtype AND p.provolatile='v' AND p.pronargs=0\n AND p.prolang=(SELECT oid FROM pg_language WHERE lanname='plpgsql')\n AND encode(sha256(convert_to(p.prosrc,'UTF8')),'hex')='cbf6a87e453e8c2e14d67acd73a92e399fbba4b4f24ac27966806e13ef1fd905'\n AND NOT has_function_privilege('anon',p.oid,'EXECUTE')\n AND NOT has_function_privilege('authenticated',p.oid,'EXECUTE')\n AND NOT has_function_privilege('service_role',p.oid,'EXECUTE'))\n THEN RAISE EXCEPTION 'REVIEW_SHARED_READBACK_DRIFT'; END IF;\nEND $readback$",
+ "-- REVIEW_SHARED_MEDIA_READBACK_END\nCOMMIT"
+ ]
+ },
+ {
+ "id": "admin_evaluation_revision_safeupdate",
+ "version": "20261011094346",
+ "name": "admin_evaluation_revision_safeupdate",
+ "path": "backend/supabase/migrations/20261011094346_admin_evaluation_revision_safeupdate.sql",
+ "bytes": 3666,
+ "sha256": "b7061015ea07192dccfcf0774d5548a9c2a584c7daa140d77fccd7c75cb8bf88",
+ "statementCount": 6,
+ "statementVectorSha256": "8cfd8d94d5419712b767b1360361ed905b151e45c8ba3d9cca8d7fe3f1adbd69",
+ "originalStatementVector": [
+ "-- Keep Supabase safeupdate enabled while advancing the single catalog revision.\n-- This is a forward, source-bound replacement; applied migrations are immutable.\nBEGIN",
+ "SET LOCAL lock_timeout='2s'",
+ "SELECT pg_advisory_xact_lock(hashtextextended('tzudong:admin-revision-safeupdate:v1',0))",
+ "DO $forward$\nDECLARE target oid:='pipeline_control.bump_admin_evaluation_revision()'::regprocedure;\n definition text; source text; patched text; metadata jsonb;\n before_members jsonb; before_manifest jsonb; before_schema jsonb;\nBEGIN\n IF current_user<>'postgres' OR session_user<>'postgres'\n OR current_setting('transaction_read_only')<>'off'\n OR current_setting('server_version_num')::integer/10000 NOT IN (15,17)\n THEN RAISE EXCEPTION 'ADMIN_REVISION_EXECUTOR_DENIED'; END IF;\n SELECT coalesce(jsonb_agg(to_jsonb(m) ORDER BY roleid,member,grantor),'[]') INTO before_members FROM pg_auth_members m;\n SELECT jsonb_agg(to_jsonb(m) ORDER BY manifest_kind,manifest_key) INTO before_manifest FROM privacy_retention.g014_catalog_contract_manifest m;\n SELECT to_jsonb(n) INTO before_schema FROM pg_namespace n WHERE n.oid='pipeline_control'::regnamespace;\n SELECT pg_get_functiondef(p.oid),p.prosrc,to_jsonb(p)-'prosrc' INTO definition,source,metadata FROM pg_proc p WHERE p.oid=target;\n IF metadata->>'proowner'<>'postgres'::regrole::oid::text\n OR encode(sha256(convert_to(source,'UTF8')),'hex')<>'ed16226885c03b05cb459381cc5ef7c8352506f7ea1f88ae526a6511e4cc1b20'\n OR (SELECT count(*) FROM pipeline_control.admin_evaluation_catalog_revision WHERE singleton)<>1\n THEN RAISE EXCEPTION 'ADMIN_REVISION_SOURCE_DRIFT'; END IF;\n IF (length(source)-length(replace(source,$old$UPDATE pipeline_control.admin_evaluation_catalog_revision SET revision = revision + 1;$old$,'')))/length($old$UPDATE pipeline_control.admin_evaluation_catalog_revision SET revision = revision + 1;$old$)<>1\n THEN RAISE EXCEPTION 'ADMIN_REVISION_ANCHOR_DRIFT'; END IF;\n patched:=replace(source,$old$UPDATE pipeline_control.admin_evaluation_catalog_revision SET revision = revision + 1;$old$,$new$UPDATE pipeline_control.admin_evaluation_catalog_revision SET revision = revision + 1 WHERE singleton;$new$);\n EXECUTE replace(definition,source,patched);\n IF (SELECT to_jsonb(p)-'prosrc' FROM pg_proc p WHERE p.oid=target) IS DISTINCT FROM metadata\n OR (SELECT encode(sha256(convert_to(p.prosrc,'UTF8')),'hex') FROM pg_proc p WHERE p.oid=target)<>'4a3bf9e7cc7d91fb1a2a5195d01f40de728539daad1a0a8132a7c10404dc7936'\n OR (SELECT coalesce(jsonb_agg(to_jsonb(m) ORDER BY roleid,member,grantor),'[]') FROM pg_auth_members m) IS DISTINCT FROM before_members\n OR (SELECT jsonb_agg(to_jsonb(m) ORDER BY manifest_kind,manifest_key) FROM privacy_retention.g014_catalog_contract_manifest m) IS DISTINCT FROM before_manifest\n OR (SELECT to_jsonb(n) FROM pg_namespace n WHERE n.oid='pipeline_control'::regnamespace) IS DISTINCT FROM before_schema\n THEN RAISE EXCEPTION 'ADMIN_REVISION_POST_DRIFT'; END IF;\nEND $forward$",
+ "-- ADMIN_REVISION_READBACK_BEGIN\nDO $readback$\nBEGIN\n IF NOT EXISTS(SELECT 1 FROM pg_proc WHERE oid='pipeline_control.bump_admin_evaluation_revision()'::regprocedure\n AND proowner='postgres'::regrole AND prosecdef AND proconfig=ARRAY['search_path=\"\"']::text[]\n AND proacl=ARRAY['postgres=X/postgres']::aclitem[]\n AND encode(sha256(convert_to(prosrc,'UTF8')),'hex')='4a3bf9e7cc7d91fb1a2a5195d01f40de728539daad1a0a8132a7c10404dc7936')\n OR (SELECT count(*) FROM pipeline_control.admin_evaluation_catalog_revision WHERE singleton)<>1\n THEN RAISE EXCEPTION 'ADMIN_REVISION_READBACK_DRIFT'; END IF;\nEND $readback$",
+ "-- ADMIN_REVISION_READBACK_END\nCOMMIT"
+ ]
+ },
+ {
+ "id": "admin_record_expired_preview_readback",
+ "version": "20261011100730",
+ "name": "admin_record_expired_preview_readback",
+ "path": "backend/supabase/migrations/20261011100730_admin_record_expired_preview_readback.sql",
+ "bytes": 4163,
+ "sha256": "26c64074bb98e718ba96732ac2baeedb851afe6ff745e0ddb5ca075359892472",
+ "statementCount": 6,
+ "statementVectorSha256": "afa3246f159064fa19046cc9da75c3cc215150dc78ad8cf80f887f6263966f5a",
+ "originalStatementVector": [
+ "-- A locked, expired preview is definitively unapplied; never infer this from a client clock.\n-- Applied receipts remain recoverable after expiry. No Apply is retried here.\nBEGIN",
+ "SET LOCAL lock_timeout='2s'",
+ "SELECT pg_advisory_xact_lock(hashtextextended('tzudong:admin-preview-expiry:v1',0))",
+ "DO $forward$\nDECLARE target oid:='public.admin_record_action(uuid,text,uuid,text,uuid[],jsonb,text)'::regprocedure;\n definition text; source text; patched text; metadata jsonb; defaults text;\n before_members jsonb; before_manifest jsonb; before_schema jsonb;\nBEGIN\n IF current_user<>'postgres' OR session_user<>'postgres'\n OR current_setting('transaction_read_only')<>'off'\n OR current_setting('server_version_num')::integer/10000 NOT IN (15,17)\n THEN RAISE EXCEPTION 'ADMIN_PREVIEW_EXECUTOR_DENIED'; END IF;\n SELECT coalesce(jsonb_agg(to_jsonb(m) ORDER BY roleid,member,grantor),'[]') INTO before_members FROM pg_auth_members m;\n SELECT jsonb_agg(to_jsonb(m) ORDER BY manifest_kind,manifest_key) INTO before_manifest FROM privacy_retention.g014_catalog_contract_manifest m;\n SELECT to_jsonb(n) INTO before_schema FROM pg_namespace n WHERE n.oid='public'::regnamespace;\n SELECT pg_get_functiondef(p.oid),p.prosrc,to_jsonb(p)-ARRAY['prosrc','proargdefaults'],pg_get_expr(p.proargdefaults,0)\n INTO definition,source,metadata,defaults FROM pg_proc p WHERE p.oid=target;\n IF metadata->>'proowner'<>'postgres'::regrole::oid::text\n OR encode(sha256(convert_to(source,'UTF8')),'hex')<>'2353de06b4d93f45fd603380e678f4edbcc0b16a8bd9860b5967683bea5f1157'\n THEN RAISE EXCEPTION 'ADMIN_PREVIEW_SOURCE_DRIFT'; END IF;\n IF (length(source)-length(replace(source,$old$IF op.id IS NULL THEN RAISE EXCEPTION 'RECORD_ACTION_NOT_FOUND'; END IF;\n RETURN op.receipt||$old$,'')))/length($old$IF op.id IS NULL THEN RAISE EXCEPTION 'RECORD_ACTION_NOT_FOUND'; END IF;\n RETURN op.receipt||$old$)<>1\n THEN RAISE EXCEPTION 'ADMIN_PREVIEW_ANCHOR_DRIFT'; END IF;\n patched:=replace(source,$old$IF op.id IS NULL THEN RAISE EXCEPTION 'RECORD_ACTION_NOT_FOUND'; END IF;\n RETURN op.receipt||$old$,$new$IF op.id IS NULL THEN RAISE EXCEPTION 'RECORD_ACTION_NOT_FOUND'; END IF;\n IF op.state='preview' AND op.expires_at<=clock_timestamp() THEN RAISE EXCEPTION 'RECORD_ACTION_PREVIEW_EXPIRED'; END IF;\n RETURN op.receipt||$new$);\n EXECUTE replace(definition,source,patched);\n IF (SELECT to_jsonb(p)-ARRAY['prosrc','proargdefaults'] FROM pg_proc p WHERE p.oid=target) IS DISTINCT FROM metadata\n OR (SELECT pg_get_expr(p.proargdefaults,0) FROM pg_proc p WHERE p.oid=target) IS DISTINCT FROM defaults\n OR (SELECT encode(sha256(convert_to(p.prosrc,'UTF8')),'hex') FROM pg_proc p WHERE p.oid=target)<>'50b5900a7b6ca43062d6373dbba75378d714312c9ef02c6939997389f6833ba0'\n OR (SELECT coalesce(jsonb_agg(to_jsonb(m) ORDER BY roleid,member,grantor),'[]') FROM pg_auth_members m) IS DISTINCT FROM before_members\n OR (SELECT jsonb_agg(to_jsonb(m) ORDER BY manifest_kind,manifest_key) FROM privacy_retention.g014_catalog_contract_manifest m) IS DISTINCT FROM before_manifest\n OR (SELECT to_jsonb(n) FROM pg_namespace n WHERE n.oid='public'::regnamespace) IS DISTINCT FROM before_schema\n THEN RAISE EXCEPTION 'ADMIN_PREVIEW_POST_DRIFT'; END IF;\nEND $forward$",
+ "-- ADMIN_PREVIEW_EXPIRY_READBACK_BEGIN\nDO $readback$\nBEGIN\n IF NOT EXISTS(SELECT 1 FROM pg_proc WHERE oid='public.admin_record_action(uuid,text,uuid,text,uuid[],jsonb,text)'::regprocedure\n AND proowner='postgres'::regrole AND NOT prosecdef AND proconfig=ARRAY['search_path=\"\"']::text[]\n AND encode(sha256(convert_to(prosrc,'UTF8')),'hex')='50b5900a7b6ca43062d6373dbba75378d714312c9ef02c6939997389f6833ba0')\n OR has_function_privilege('anon','public.admin_record_action(uuid,text,uuid,text,uuid[],jsonb,text)','EXECUTE')\n OR has_function_privilege('authenticated','public.admin_record_action(uuid,text,uuid,text,uuid[],jsonb,text)','EXECUTE')\n OR NOT has_function_privilege('service_role','public.admin_record_action(uuid,text,uuid,text,uuid[],jsonb,text)','EXECUTE')\n THEN RAISE EXCEPTION 'ADMIN_PREVIEW_READBACK_DRIFT'; END IF;\nEND $readback$",
+ "-- ADMIN_PREVIEW_EXPIRY_READBACK_END\nCOMMIT"
+ ]
+ },
+ {
+ "id": "admin_verification_durable_staging",
+ "version": "20261011103501",
+ "name": "admin_verification_durable_staging",
+ "path": "backend/supabase/migrations/20261011103501_admin_verification_durable_staging.sql",
+ "bytes": 12008,
+ "sha256": "081c48e91172e4e98079b03aa210c0f7481d95a21945e5a288187263089e57db",
+ "statementCount": 6,
+ "statementVectorSha256": "9c2f696f41d5e001d574809b911ba6dc2451bbd6cc9f23684a98fe543d56b512",
+ "originalStatementVector": [
+ "-- Persist an owner-bound private verification key before Storage transport.\n-- Only retired unreferenced cleanup counts as outstanding work; shared references remain protected.\n-- Applied SQL, grants, actor authorization and canonical key ownership stay intact.\nBEGIN",
+ "SET LOCAL lock_timeout='2s'",
+ "SELECT pg_advisory_xact_lock(hashtextextended('tzudong:review-media-catalog:v2',0))",
+ "DO $forward$\nDECLARE target oid:='public.admin_review_verification_cleanup(uuid,text,text[])'::regprocedure;\n definition text; source text; patched text; metadata jsonb; defaults text;\n before_members jsonb; before_assertions jsonb; before_manifest jsonb; self_membership jsonb;\n before_schema jsonb; schema_lease boolean;\n workflow_owner oid:='privacy_workflow_owner'::regrole; runner oid:='postgres'::regrole;\n major integer:=current_setting('server_version_num')::integer/10000; pg15_lease boolean:=false;\nBEGIN\n IF current_user<>'postgres' OR session_user<>'postgres' OR major NOT IN (15,17)\n OR current_setting('transaction_read_only')<>'off' OR NOT EXISTS(SELECT 1 FROM pg_roles\n WHERE oid=workflow_owner AND NOT rolsuper AND NOT rolbypassrls AND NOT rolcanlogin AND NOT rolinherit)\n THEN RAISE EXCEPTION 'REVIEW_SHARED_EXECUTOR_DENIED'; END IF;\n SELECT coalesce(jsonb_agg(to_jsonb(m) ORDER BY roleid,member,grantor),'[]') INTO before_members FROM pg_auth_members m;\n SELECT jsonb_agg(to_jsonb(p) ORDER BY oid) INTO before_assertions FROM pg_proc p WHERE pronamespace='privacy_retention'::regnamespace;\n SELECT pg_get_functiondef(p.oid),p.prosrc,to_jsonb(p)-ARRAY['prosrc','proargdefaults'],pg_get_expr(p.proargdefaults,0) INTO definition,source,metadata,defaults FROM pg_proc p WHERE p.oid=target;\n IF metadata->>'proowner'<>workflow_owner::text OR encode(sha256(convert_to(source,'UTF8')),'hex')<>'f4d19bc5b41fe7808635240cae80f796d12f6cad8b13802577a88afbb1f024a7'\n THEN RAISE EXCEPTION 'REVIEW_SHARED_SOURCE_DRIFT'; END IF;\n SELECT to_jsonb(n) INTO before_schema FROM pg_namespace n WHERE n.oid='public'::regnamespace;\n IF before_schema->>'nspowner' NOT IN (runner::text,'pg_database_owner'::regrole::oid::text)\n THEN RAISE EXCEPTION 'REVIEW_SHARED_SCHEMA_OWNER_DRIFT'; END IF;\n schema_lease:=NOT has_schema_privilege(workflow_owner,'public','CREATE');\n IF schema_lease THEN GRANT CREATE ON SCHEMA public TO privacy_workflow_owner; END IF;\n SELECT to_jsonb(m) INTO self_membership FROM pg_auth_members m WHERE roleid=workflow_owner AND member=runner AND grantor=runner;\n IF self_membership IS NOT NULL AND (self_membership->>'admin_option')::boolean THEN RAISE EXCEPTION 'REVIEW_MEDIA_FORWARD_MEMBERSHIP_DENIED'; END IF;\n IF major=17 THEN\n IF NOT EXISTS(SELECT 1 FROM pg_auth_members WHERE roleid=workflow_owner AND member=runner AND admin_option AND grantor<>runner)\n THEN RAISE EXCEPTION 'REVIEW_MEDIA_FORWARD_OWNER_AUTHORITY_MISSING'; END IF;\n EXECUTE 'GRANT privacy_workflow_owner TO postgres WITH ADMIN FALSE,INHERIT FALSE,SET TRUE GRANTED BY postgres';\n ELSE\n pg15_lease:=NOT pg_has_role(runner,workflow_owner,'MEMBER');\n IF pg15_lease THEN GRANT privacy_workflow_owner TO postgres; END IF;\n END IF;\n SET LOCAL ROLE privacy_workflow_owner;\n SELECT jsonb_agg(to_jsonb(m) ORDER BY manifest_kind,manifest_key) INTO before_manifest FROM privacy_retention.g014_catalog_contract_manifest m;\n\n IF source IS DISTINCT FROM $old$\nDECLARE items jsonb;\nBEGIN\n IF p_review_id IS NULL OR p_phase IS NULL OR p_phase NOT IN ('prepare','finish')\n OR current_setting('transaction_isolation') <> 'read committed'\n OR (p_phase = 'prepare' AND p_paths IS NOT NULL)\n OR (p_phase = 'finish' AND (p_paths IS NULL OR cardinality(p_paths) > 20\n OR EXISTS (SELECT 1 FROM unnest(p_paths) x WHERE x IS NULL OR octet_length(x) > 8192)\n OR cardinality(p_paths) <> (SELECT count(DISTINCT x) FROM unnest(p_paths) x))) THEN\n RAISE EXCEPTION 'REVIEW_ADMIN_CLEANUP_INVALID';\n END IF;\n PERFORM pg_advisory_xact_lock(741093, 1);\n IF p_phase = 'prepare' THEN\n UPDATE review_media_private.cleanup c SET retired = true\n WHERE c.review_id = p_review_id AND c.purpose = 'verification'\n AND NOT c.retired AND NOT c.complete AND NOT review_media_private.referenced(c.path);\n SELECT coalesce(jsonb_agg(to_jsonb(x) ORDER BY x.path),'[]'::jsonb) INTO items\n FROM (SELECT c.path,c.owner_id,c.review_id,c.purpose FROM review_media_private.cleanup c\n WHERE c.review_id = p_review_id AND c.purpose = 'verification' AND c.retired AND NOT c.complete\n AND NOT review_media_private.referenced(c.path)\n AND (review_media_private.canonical(c.path,c.owner_id,c.review_id,c.purpose)\n OR review_media_private.owned_legacy(c.path,c.owner_id,c.purpose))\n ORDER BY c.path LIMIT 20) x;\n RETURN jsonb_build_object('status','READY','items',items);\n END IF;\n UPDATE review_media_private.cleanup c SET complete = true\n WHERE c.review_id = p_review_id AND c.purpose = 'verification' AND c.retired AND NOT c.complete\n AND c.path = ANY(p_paths)\n AND (review_media_private.canonical(c.path,c.owner_id,c.review_id,c.purpose)\n OR review_media_private.owned_legacy(c.path,c.owner_id,c.purpose))\n AND NOT review_media_private.referenced(c.path)\n AND NOT EXISTS (SELECT 1 FROM storage.objects o\n WHERE o.bucket_id IN ('review-photos','review-verifications') AND o.name = c.path);\n RETURN jsonb_build_object('remaining',(SELECT count(*) FROM review_media_private.cleanup c\n WHERE c.review_id = p_review_id AND c.purpose = 'verification' AND NOT c.complete));\nEND\n$old$ THEN RAISE EXCEPTION 'REVIEW_SHARED_ANCHOR_DRIFT'; END IF;\n patched:=$new$\nDECLARE items jsonb; owner uuid;\nBEGIN\n IF p_review_id IS NULL OR p_phase IS NULL OR p_phase NOT IN ('prepare','finish','stage')\n OR current_setting('transaction_isolation') <> 'read committed'\n OR (p_phase = 'prepare' AND p_paths IS NOT NULL)\n OR (p_phase IN ('finish','stage') AND (p_paths IS NULL OR cardinality(p_paths) > 20\n OR EXISTS (SELECT 1 FROM unnest(p_paths) x WHERE x IS NULL OR octet_length(x) > 8192)\n OR cardinality(p_paths) <> (SELECT count(DISTINCT x) FROM unnest(p_paths) x))) THEN\n RAISE EXCEPTION 'REVIEW_ADMIN_CLEANUP_INVALID';\n END IF;\n PERFORM pg_advisory_xact_lock(741093, 1);\n IF p_phase = 'stage' THEN\n SELECT user_id INTO owner FROM public.reviews WHERE id=p_review_id;\n IF owner IS NULL OR cardinality(p_paths)<>1\n OR NOT review_media_private.canonical(p_paths[1],owner,p_review_id,'verification')\n THEN RAISE EXCEPTION 'REVIEW_ADMIN_CLEANUP_INVALID'; END IF;\n INSERT INTO review_media_private.cleanup(path,owner_id,review_id,purpose,retired)\n VALUES(p_paths[1],owner,p_review_id,'verification',false) ON CONFLICT DO NOTHING;\n IF NOT EXISTS(SELECT 1 FROM review_media_private.cleanup WHERE path=p_paths[1]\n AND owner_id=owner AND review_id=p_review_id AND purpose='verification'\n AND NOT retired AND NOT complete) THEN RAISE EXCEPTION 'REVIEW_ADMIN_UPLOAD_RETIRED'; END IF;\n RETURN jsonb_build_object('status','STAGED');\n END IF;\n IF p_phase = 'prepare' THEN\n UPDATE review_media_private.cleanup c SET retired = true\n WHERE c.review_id = p_review_id AND c.purpose = 'verification'\n AND NOT c.retired AND NOT c.complete AND NOT review_media_private.referenced(c.path);\n SELECT coalesce(jsonb_agg(to_jsonb(x) ORDER BY x.path),'[]'::jsonb) INTO items\n FROM (SELECT c.path,c.owner_id,c.review_id,c.purpose FROM review_media_private.cleanup c\n WHERE c.review_id = p_review_id AND c.purpose = 'verification' AND c.retired AND NOT c.complete\n AND NOT review_media_private.referenced(c.path)\n AND (review_media_private.canonical(c.path,c.owner_id,c.review_id,c.purpose)\n OR review_media_private.owned_legacy(c.path,c.owner_id,c.purpose))\n ORDER BY c.path LIMIT 20) x;\n RETURN jsonb_build_object('status','READY','items',items);\n END IF;\n UPDATE review_media_private.cleanup c SET complete = true\n WHERE c.review_id = p_review_id AND c.purpose = 'verification' AND c.retired AND NOT c.complete\n AND c.path = ANY(p_paths)\n AND (review_media_private.canonical(c.path,c.owner_id,c.review_id,c.purpose)\n OR review_media_private.owned_legacy(c.path,c.owner_id,c.purpose))\n AND NOT review_media_private.referenced(c.path)\n AND NOT EXISTS (SELECT 1 FROM storage.objects o\n WHERE o.bucket_id IN ('review-photos','review-verifications') AND o.name = c.path);\n RETURN jsonb_build_object('remaining',(SELECT count(*) FROM review_media_private.cleanup c\n WHERE c.review_id = p_review_id AND c.purpose = 'verification' AND c.retired AND NOT c.complete\n AND NOT review_media_private.referenced(c.path)));\nEND\n$new$;\n EXECUTE replace(definition,source,patched);\n IF (SELECT to_jsonb(p)-ARRAY['prosrc','proargdefaults'] FROM pg_proc p WHERE p.oid=target) IS DISTINCT FROM metadata\n OR (SELECT pg_get_expr(p.proargdefaults,0) FROM pg_proc p WHERE p.oid=target) IS DISTINCT FROM defaults\n OR (SELECT encode(sha256(convert_to(p.prosrc,'UTF8')),'hex') FROM pg_proc p WHERE p.oid=target)<>'468c12ee6c3463876cbccb394fcba8f870459a1f6cf3d945d97307f8551f094b'\n THEN RAISE EXCEPTION 'REVIEW_SHARED_POST_DRIFT'; END IF;\n CREATE FUNCTION pg_temp.review_shared_assert() RETURNS void LANGUAGE plpgsql SECURITY DEFINER SET search_path='' AS $bridge$\n BEGIN\n PERFORM privacy_retention.assert_g014_public_rpc_allowlist();\n PERFORM privacy_retention.assert_g014_definer_contract();\n PERFORM privacy_retention.assert_g014_catalog_contract();\n DROP FUNCTION pg_temp.review_shared_assert();\n END $bridge$;\n REVOKE ALL ON FUNCTION pg_temp.review_shared_assert() FROM PUBLIC,anon,authenticated,service_role;\n GRANT EXECUTE ON FUNCTION pg_temp.review_shared_assert() TO postgres;\n IF (SELECT jsonb_agg(to_jsonb(m) ORDER BY manifest_kind,manifest_key) FROM privacy_retention.g014_catalog_contract_manifest m) IS DISTINCT FROM before_manifest\n THEN RAISE EXCEPTION 'REVIEW_SHARED_MANIFEST_DRIFT'; END IF;\n RESET ROLE;\n IF schema_lease THEN REVOKE CREATE ON SCHEMA public FROM privacy_workflow_owner; END IF;\n IF major=15 THEN\n IF pg15_lease THEN REVOKE privacy_workflow_owner FROM postgres; END IF;\n ELSIF self_membership IS NULL THEN\n REVOKE privacy_workflow_owner FROM postgres GRANTED BY postgres;\n ELSE\n EXECUTE format('GRANT privacy_workflow_owner TO postgres WITH ADMIN FALSE,INHERIT %s,SET %s GRANTED BY postgres',\n upper(self_membership->>'inherit_option'),upper(self_membership->>'set_option'));\n END IF;\n\n IF (SELECT coalesce(jsonb_agg(to_jsonb(m) ORDER BY roleid,member,grantor),'[]') FROM pg_auth_members m) IS DISTINCT FROM before_members\n OR (SELECT jsonb_agg(to_jsonb(p) ORDER BY oid) FROM pg_proc p WHERE pronamespace='privacy_retention'::regnamespace) IS DISTINCT FROM before_assertions\n OR (SELECT to_jsonb(n) FROM pg_namespace n WHERE n.oid='public'::regnamespace) IS DISTINCT FROM before_schema\n THEN RAISE EXCEPTION 'REVIEW_SHARED_PRESERVATION_DRIFT'; END IF;\n PERFORM pg_temp.review_shared_assert();\nEND $forward$",
+ "-- ADMIN_STAGING_READBACK_BEGIN\nDO $readback$\nBEGIN\n IF NOT EXISTS(SELECT 1 FROM pg_proc WHERE oid='public.admin_review_verification_cleanup(uuid,text,text[])'::regprocedure\n AND proowner='privacy_workflow_owner'::regrole AND prosecdef AND proconfig=ARRAY['search_path=\"\"']::text[]\n AND encode(sha256(convert_to(prosrc,'UTF8')),'hex')='468c12ee6c3463876cbccb394fcba8f870459a1f6cf3d945d97307f8551f094b')\n OR has_function_privilege('anon','public.admin_review_verification_cleanup(uuid,text,text[])','EXECUTE')\n OR has_function_privilege('authenticated','public.admin_review_verification_cleanup(uuid,text,text[])','EXECUTE')\n OR NOT has_function_privilege('service_role','public.admin_review_verification_cleanup(uuid,text,text[])','EXECUTE')\n THEN RAISE EXCEPTION 'ADMIN_STAGING_READBACK_DRIFT'; END IF;\nEND $readback$",
+ "-- ADMIN_STAGING_READBACK_END\nCOMMIT"
+ ]
+ },
+ {
+ "id": "review_media_storage_retirement_fence",
+ "version": "20261011105114",
+ "name": "review_media_storage_retirement_fence",
+ "path": "backend/supabase/migrations/20261011105114_review_media_storage_retirement_fence.sql",
+ "bytes": 11418,
+ "sha256": "79375138d7e82a3be2b85b219ff52147db13db9c93070569be40a61ab97c3d53",
+ "statementCount": 6,
+ "statementVectorSha256": "6be5e2a7387d2e6d71e8ee830cb9a48df74b592ffd18bb51eba43869fc005c89",
+ "originalStatementVector": [
+ "-- Retirement must also fence late privileged Storage metadata commits.\n-- A BEFORE STATEMENT serializer takes the global lock before row or object locks.\n-- Applied SQL, grants, actor authorization and canonical key ownership stay intact.\nBEGIN",
+ "SET LOCAL lock_timeout='2s'",
+ "SELECT pg_advisory_xact_lock(hashtextextended('tzudong:review-media-catalog:v2',0))",
+ "DO $forward$\nDECLARE target oid:='review_media_private.guard_references()'::regprocedure;\n definition text; source text; patched text; metadata jsonb;\n before_members jsonb; before_assertions jsonb; before_manifest jsonb; self_membership jsonb;\n before_schema jsonb; schema_lease boolean;\n workflow_owner oid:='privacy_workflow_owner'::regrole; runner oid:='postgres'::regrole;\n major integer:=current_setting('server_version_num')::integer/10000; pg15_lease boolean:=false;\nBEGIN\n IF current_user<>'postgres' OR session_user<>'postgres' OR major NOT IN (15,17)\n OR current_setting('transaction_read_only')<>'off' OR NOT EXISTS(SELECT 1 FROM pg_roles\n WHERE oid=workflow_owner AND NOT rolsuper AND NOT rolbypassrls AND NOT rolcanlogin AND NOT rolinherit)\n THEN RAISE EXCEPTION 'REVIEW_SHARED_EXECUTOR_DENIED'; END IF;\n SELECT coalesce(jsonb_agg(to_jsonb(m) ORDER BY roleid,member,grantor),'[]') INTO before_members FROM pg_auth_members m;\n SELECT jsonb_agg(to_jsonb(p) ORDER BY oid) INTO before_assertions FROM pg_proc p WHERE pronamespace='privacy_retention'::regnamespace;\n SELECT pg_get_functiondef(p.oid),p.prosrc,to_jsonb(p)-'prosrc' INTO definition,source,metadata FROM pg_proc p WHERE p.oid=target;\n IF metadata->>'proowner'<>workflow_owner::text OR encode(sha256(convert_to(source,'UTF8')),'hex')<>'846030547ffd76e17596755d7eee4279dcb9b563361435260826071d2f250d59'\n THEN RAISE EXCEPTION 'REVIEW_SHARED_SOURCE_DRIFT'; END IF;\n SELECT to_jsonb(n) INTO before_schema FROM pg_namespace n WHERE n.oid='review_media_private'::regnamespace;\n IF before_schema->>'nspowner'<>runner::text THEN RAISE EXCEPTION 'REVIEW_SHARED_SCHEMA_OWNER_DRIFT'; END IF;\n schema_lease:=NOT has_schema_privilege(workflow_owner,'review_media_private','CREATE');\n IF schema_lease THEN GRANT CREATE ON SCHEMA review_media_private TO privacy_workflow_owner; END IF;\n SELECT to_jsonb(m) INTO self_membership FROM pg_auth_members m WHERE roleid=workflow_owner AND member=runner AND grantor=runner;\n IF self_membership IS NOT NULL AND (self_membership->>'admin_option')::boolean THEN RAISE EXCEPTION 'REVIEW_MEDIA_FORWARD_MEMBERSHIP_DENIED'; END IF;\n IF major=17 THEN\n IF NOT EXISTS(SELECT 1 FROM pg_auth_members WHERE roleid=workflow_owner AND member=runner AND admin_option AND grantor<>runner)\n THEN RAISE EXCEPTION 'REVIEW_MEDIA_FORWARD_OWNER_AUTHORITY_MISSING'; END IF;\n EXECUTE 'GRANT privacy_workflow_owner TO postgres WITH ADMIN FALSE,INHERIT FALSE,SET TRUE GRANTED BY postgres';\n ELSE\n pg15_lease:=NOT pg_has_role(runner,workflow_owner,'MEMBER');\n IF pg15_lease THEN GRANT privacy_workflow_owner TO postgres; END IF;\n END IF;\n SET LOCAL ROLE privacy_workflow_owner;\n SELECT jsonb_agg(to_jsonb(m) ORDER BY manifest_kind,manifest_key) INTO before_manifest FROM privacy_retention.g014_catalog_contract_manifest m;\n\n IF source IS DISTINCT FROM $old$\nDECLARE p text; old_food text[] := ARRAY[]::text[]; old_verification text; purpose text;\nBEGIN\n IF TG_OP = 'UPDATE' AND NEW.user_id = OLD.user_id AND NEW.id = OLD.id THEN\n old_food := COALESCE(OLD.food_photos, ARRAY[]::text[]);\n old_verification := OLD.verification_photo;\n END IF;\n FOR p, purpose IN SELECT value, 'food' FROM unnest(COALESCE(NEW.food_photos, ARRAY[]::text[])) value\n UNION ALL SELECT NEW.verification_photo, 'verification' LOOP\n IF EXISTS (SELECT 1 FROM review_media_private.cleanup c\n WHERE c.path = review_media_private.reference_key(p) AND c.retired) THEN\n RAISE EXCEPTION USING MESSAGE = 'REVIEW_MEDIA_RETIRED', ERRCODE = '23514';\n END IF;\n -- Historical keys may remain unchanged in their original purpose only.\n IF NOT COALESCE(CASE WHEN purpose = 'food' THEN p = ANY(old_food) ELSE p = old_verification END, false) THEN\n IF NOT review_media_private.canonical(p, NEW.user_id, NEW.id, purpose) THEN\n RAISE EXCEPTION USING MESSAGE = 'REVIEW_MEDIA_INVALID', ERRCODE = '23514';\n END IF;\n END IF;\n END LOOP;\n RETURN NEW;\nEND $old$ THEN RAISE EXCEPTION 'REVIEW_SHARED_ANCHOR_DRIFT'; END IF;\n patched:=$new$\nDECLARE p text; old_food text[] := ARRAY[]::text[]; old_verification text; purpose text;\nBEGIN\n IF TG_TABLE_SCHEMA='storage' AND TG_TABLE_NAME='objects' THEN\n IF NEW.bucket_id IN ('review-photos','review-verifications') AND EXISTS(\n SELECT 1 FROM review_media_private.cleanup WHERE path=NEW.name AND retired)\n THEN RAISE EXCEPTION USING MESSAGE='REVIEW_MEDIA_RETIRED',ERRCODE='23514'; END IF;\n RETURN NEW;\n END IF;\n IF TG_OP = 'UPDATE' AND NEW.user_id = OLD.user_id AND NEW.id = OLD.id THEN\n old_food := COALESCE(OLD.food_photos, ARRAY[]::text[]);\n old_verification := OLD.verification_photo;\n END IF;\n FOR p, purpose IN SELECT value, 'food' FROM unnest(COALESCE(NEW.food_photos, ARRAY[]::text[])) value\n UNION ALL SELECT NEW.verification_photo, 'verification' LOOP\n IF EXISTS (SELECT 1 FROM review_media_private.cleanup c\n WHERE c.path = review_media_private.reference_key(p) AND c.retired) THEN\n RAISE EXCEPTION USING MESSAGE = 'REVIEW_MEDIA_RETIRED', ERRCODE = '23514';\n END IF;\n -- Historical keys may remain unchanged in their original purpose only.\n IF NOT COALESCE(CASE WHEN purpose = 'food' THEN p = ANY(old_food) ELSE p = old_verification END, false) THEN\n IF NOT review_media_private.canonical(p, NEW.user_id, NEW.id, purpose) THEN\n RAISE EXCEPTION USING MESSAGE = 'REVIEW_MEDIA_INVALID', ERRCODE = '23514';\n END IF;\n END IF;\n END LOOP;\n RETURN NEW;\nEND $new$;\n EXECUTE replace(definition,source,patched);\n IF (SELECT to_jsonb(p)-'prosrc' FROM pg_proc p WHERE p.oid=target) IS DISTINCT FROM metadata\n OR (SELECT encode(sha256(convert_to(p.prosrc,'UTF8')),'hex') FROM pg_proc p WHERE p.oid=target)<>'94113c8ae1231e8eae5a698f35a1370a38367e42c79cc87ac62db76c32e735b1'\n THEN RAISE EXCEPTION 'REVIEW_SHARED_POST_DRIFT'; END IF;\n CREATE FUNCTION pg_temp.review_shared_assert() RETURNS void LANGUAGE plpgsql SECURITY DEFINER SET search_path='' AS $bridge$\n BEGIN\n PERFORM privacy_retention.assert_g014_public_rpc_allowlist();\n PERFORM privacy_retention.assert_g014_definer_contract();\n PERFORM privacy_retention.assert_g014_catalog_contract();\n DROP FUNCTION pg_temp.review_shared_assert();\n END $bridge$;\n REVOKE ALL ON FUNCTION pg_temp.review_shared_assert() FROM PUBLIC,anon,authenticated,service_role;\n GRANT EXECUTE ON FUNCTION pg_temp.review_shared_assert() TO postgres;\n IF (SELECT jsonb_agg(to_jsonb(m) ORDER BY manifest_kind,manifest_key) FROM privacy_retention.g014_catalog_contract_manifest m) IS DISTINCT FROM before_manifest\n THEN RAISE EXCEPTION 'REVIEW_SHARED_MANIFEST_DRIFT'; END IF;\n IF has_function_privilege('postgres','review_media_private.guard_references()','EXECUTE')\n OR has_function_privilege('postgres','review_media_private.lock_changes()','EXECUTE')\n THEN RAISE EXCEPTION 'STORAGE_FENCE_LEASE_BASELINE_DRIFT'; END IF;\n GRANT EXECUTE ON FUNCTION review_media_private.guard_references(),review_media_private.lock_changes() TO postgres;\n RESET ROLE;\n CREATE TRIGGER a00_review_media_storage_serialize BEFORE INSERT OR UPDATE OF bucket_id,name ON storage.objects\n FOR EACH STATEMENT EXECUTE FUNCTION review_media_private.lock_changes();\n CREATE TRIGGER a00_review_media_storage_guard BEFORE INSERT OR UPDATE OF bucket_id,name ON storage.objects\n FOR EACH ROW EXECUTE FUNCTION review_media_private.guard_references();\n SET LOCAL ROLE privacy_workflow_owner;\n REVOKE EXECUTE ON FUNCTION review_media_private.guard_references(),review_media_private.lock_changes() FROM postgres;\n RESET ROLE;\n IF schema_lease THEN REVOKE CREATE ON SCHEMA review_media_private FROM privacy_workflow_owner; END IF;\n IF major=15 THEN\n IF pg15_lease THEN REVOKE privacy_workflow_owner FROM postgres; END IF;\n ELSIF self_membership IS NULL THEN\n REVOKE privacy_workflow_owner FROM postgres GRANTED BY postgres;\n ELSE\n EXECUTE format('GRANT privacy_workflow_owner TO postgres WITH ADMIN FALSE,INHERIT %s,SET %s GRANTED BY postgres',\n upper(self_membership->>'inherit_option'),upper(self_membership->>'set_option'));\n END IF;\n\n IF (SELECT coalesce(jsonb_agg(to_jsonb(m) ORDER BY roleid,member,grantor),'[]') FROM pg_auth_members m) IS DISTINCT FROM before_members\n OR (SELECT jsonb_agg(to_jsonb(p) ORDER BY oid) FROM pg_proc p WHERE pronamespace='privacy_retention'::regnamespace) IS DISTINCT FROM before_assertions\n OR (SELECT to_jsonb(n) FROM pg_namespace n WHERE n.oid='review_media_private'::regnamespace) IS DISTINCT FROM before_schema\n THEN RAISE EXCEPTION 'REVIEW_SHARED_PRESERVATION_DRIFT'; END IF;\n PERFORM pg_temp.review_shared_assert();\nEND $forward$",
+ "-- STORAGE_RETIREMENT_FENCE_READBACK_BEGIN\nDO $readback$\nBEGIN\n IF NOT EXISTS(SELECT 1 FROM pg_proc WHERE oid='review_media_private.guard_references()'::regprocedure\n AND proowner='privacy_workflow_owner'::regrole AND prosecdef AND proconfig=ARRAY['search_path=\"\"']::text[]\n AND encode(sha256(convert_to(prosrc,'UTF8')),'hex')='94113c8ae1231e8eae5a698f35a1370a38367e42c79cc87ac62db76c32e735b1')\n OR has_function_privilege('anon','review_media_private.guard_references()','EXECUTE')\n OR has_function_privilege('authenticated','review_media_private.guard_references()','EXECUTE')\n OR has_function_privilege('service_role','review_media_private.guard_references()','EXECUTE')\n OR has_function_privilege('postgres','review_media_private.guard_references()','EXECUTE')\n OR NOT EXISTS(SELECT 1 FROM pg_proc WHERE oid='review_media_private.lock_changes()'::regprocedure\n AND proowner='privacy_workflow_owner'::regrole AND prosecdef AND proconfig=ARRAY['search_path=\"\"']::text[]\n AND encode(sha256(convert_to(prosrc,'UTF8')),'hex')='381d89aa6bbf5a59c2ee0fef2a7392ef705147252b324527201b8b6f74376250')\n OR EXISTS(SELECT 1 FROM unnest(ARRAY['anon','authenticated','service_role','postgres']) r\n WHERE has_function_privilege(r,'review_media_private.lock_changes()','EXECUTE'))\n OR NOT EXISTS(SELECT 1 FROM pg_trigger WHERE tgrelid='storage.objects'::regclass AND tgname='a00_review_media_storage_serialize'\n AND tgenabled='O' AND NOT tgisinternal AND tgfoid='review_media_private.lock_changes()'::regprocedure AND tgtype=22 AND pg_get_triggerdef(oid)='CREATE TRIGGER a00_review_media_storage_serialize BEFORE INSERT OR UPDATE OF bucket_id, name ON storage.objects FOR EACH STATEMENT EXECUTE FUNCTION review_media_private.lock_changes()')\n OR NOT EXISTS(SELECT 1 FROM pg_trigger WHERE tgrelid='storage.objects'::regclass AND tgname='a00_review_media_storage_guard'\n AND tgenabled='O' AND NOT tgisinternal AND tgfoid='review_media_private.guard_references()'::regprocedure AND tgtype=23 AND pg_get_triggerdef(oid)='CREATE TRIGGER a00_review_media_storage_guard BEFORE INSERT OR UPDATE OF bucket_id, name ON storage.objects FOR EACH ROW EXECUTE FUNCTION review_media_private.guard_references()')\n THEN RAISE EXCEPTION 'STORAGE_RETIREMENT_FENCE_READBACK_DRIFT'; END IF;\nEND $readback$",
+ "-- STORAGE_RETIREMENT_FENCE_READBACK_END\nCOMMIT"
+ ]
+ },
+ {
+ "id": "review_storage_caller_bound_admin_policy",
+ "version": "20261011110108",
+ "name": "review_storage_caller_bound_admin_policy",
+ "path": "backend/supabase/migrations/20261011110108_review_storage_caller_bound_admin_policy.sql",
+ "bytes": 8463,
+ "sha256": "45b2a0db333a1e24ac1f68b7693c7cfb98e10cd0ab366b98089c3679a6b5dfbc",
+ "statementCount": 7,
+ "statementVectorSha256": "02a88a7bb3c01228d2534cd0147c59f5791e42c790b53dad009ac0d442a4f0cd",
+ "originalStatementVector": [
+ "-- Retired legacy administrator EXEC must not poison unrelated Storage writes.\n-- Admit only the two exact historical banner policies, or their absence in a\n-- fresh canonical replay. Private receipt reads remain owner-only; admin reads use the guarded server route.\n-- No public function, table grant or RPC is added.\nBEGIN",
+ "SET LOCAL lock_timeout='2s'",
+ "SET LOCAL search_path=public,extensions",
+ "SELECT pg_advisory_xact_lock(hashtextextended('tzudong:review-media-catalog:v2',0))",
+ "DO $forward$\nDECLARE item record; actual record; before_other jsonb; before_functions jsonb;\n before_members jsonb; before_manifest jsonb; before_schema jsonb;\n expression text := $predicate$(bucket_id = 'ad-banner-images' AND EXISTS (\n SELECT 1 FROM public.user_roles AS role_row\n JOIN public.user_account_status AS status_row ON status_row.user_id=role_row.user_id\n WHERE role_row.user_id=(SELECT auth.uid()) AND role_row.role::text='admin'\n AND status_row.account_status='active' AND status_row.disabled_at IS NULL))$predicate$;\nBEGIN\n IF current_user<>'postgres' OR session_user<>'postgres' OR current_setting('transaction_read_only')<>'off'\n OR current_setting('server_version_num')::integer/10000 NOT IN (15,17)\n THEN RAISE EXCEPTION 'STORAGE_ADMIN_POLICY_EXECUTOR_DENIED'; END IF;\n SELECT coalesce(jsonb_agg(to_jsonb(p) ORDER BY oid),'[]') INTO before_other FROM pg_policy p\n WHERE polrelid<>'storage.objects'::regclass OR polname NOT IN ('Admin upload access','Admin delete access','review_verifications_owner_read');\n SELECT jsonb_agg(to_jsonb(p) ORDER BY oid) INTO before_functions FROM pg_proc p\n WHERE pronamespace IN ('public'::regnamespace,'privacy_retention'::regnamespace,'review_media_private'::regnamespace);\n SELECT coalesce(jsonb_agg(to_jsonb(m) ORDER BY roleid,member,grantor),'[]') INTO before_members FROM pg_auth_members m;\n SELECT jsonb_agg(to_jsonb(m) ORDER BY manifest_kind,manifest_key) INTO before_manifest FROM privacy_retention.g014_catalog_contract_manifest m;\n SELECT jsonb_agg(to_jsonb(n) ORDER BY oid) INTO before_schema FROM pg_namespace n;\n IF (SELECT count(*) FROM pg_policy WHERE polrelid='storage.objects'::regclass\n AND polname IN ('Admin upload access','Admin delete access')) NOT IN (0,2)\n THEN RAISE EXCEPTION 'STORAGE_ADMIN_POLICY_INVENTORY_DRIFT'; END IF;\n FOR item IN SELECT * FROM (VALUES ('Admin upload access','a'::\"char\"),('Admin delete access','d'::\"char\")) AS expected(name,cmd) LOOP\n SELECT p.*,pg_get_expr(polqual,polrelid) AS using_expr,pg_get_expr(polwithcheck,polrelid) AS check_expr INTO actual\n FROM pg_policy p WHERE polrelid='storage.objects'::regclass AND polname=item.name;\n IF NOT FOUND THEN CONTINUE; END IF;\n IF NOT actual.polpermissive OR actual.polcmd<>item.cmd OR actual.polroles<>ARRAY[0::oid]\n OR (CASE WHEN item.cmd='a' THEN actual.using_expr IS NOT NULL ELSE actual.check_expr IS NOT NULL END)\n OR coalesce(CASE WHEN item.cmd='a' THEN actual.check_expr ELSE actual.using_expr END,'') NOT IN (\n '((bucket_id = ''ad-banner-images''::text) AND is_user_admin(uid()))',\n '((bucket_id = ''ad-banner-images''::text) AND is_user_admin(auth.uid()))')\n OR (SELECT count(*) FROM pg_depend WHERE classid='pg_policy'::regclass AND objid=actual.oid\n AND refclassid='pg_proc'::regclass AND refobjid='public.is_user_admin(uuid)'::regprocedure)<>1\n OR (SELECT count(*) FROM pg_depend WHERE classid='pg_policy'::regclass AND objid=actual.oid\n AND refclassid='pg_proc'::regclass AND refobjid='auth.uid()'::regprocedure)<>1\n THEN RAISE EXCEPTION 'STORAGE_ADMIN_POLICY_SOURCE_DRIFT'; END IF;\n EXECUTE format('ALTER POLICY %I ON storage.objects TO authenticated %s (%s)',item.name,\n CASE WHEN item.cmd='a' THEN 'WITH CHECK' ELSE 'USING' END,expression);\n END LOOP;\n SELECT p.*,pg_get_expr(polqual,polrelid) AS using_expr,pg_get_expr(polwithcheck,polrelid) AS check_expr INTO actual\n FROM pg_policy p WHERE polrelid='storage.objects'::regclass AND polname='review_verifications_owner_read';\n IF NOT FOUND OR actual.polcmd<>'r' OR NOT actual.polpermissive\n OR actual.polroles<>ARRAY['authenticated'::regrole::oid] OR actual.check_expr IS NOT NULL\n OR replace(actual.using_expr,'auth.uid()','uid()') IS DISTINCT FROM\n '((bucket_id = ''review-verifications''::text) AND (((storage.foldername(name))[1] = ( SELECT (uid())::text AS uid)) OR has_role(( SELECT uid() AS uid), ''admin''::app_role)))'\n OR (SELECT count(*) FROM pg_depend WHERE classid='pg_policy'::regclass AND objid=actual.oid\n AND refclassid='pg_proc'::regclass AND refobjid='public.has_role(uuid,public.app_role)'::regprocedure)<>1\n THEN RAISE EXCEPTION 'STORAGE_OWNER_READ_SOURCE_DRIFT'; END IF;\n ALTER POLICY review_verifications_owner_read ON storage.objects TO authenticated\n USING (bucket_id='review-verifications' AND (storage.foldername(name))[1]=(SELECT auth.uid()::text));\n IF (SELECT coalesce(jsonb_agg(to_jsonb(p) ORDER BY oid),'[]') FROM pg_policy p\n WHERE polrelid<>'storage.objects'::regclass OR polname NOT IN ('Admin upload access','Admin delete access','review_verifications_owner_read')) IS DISTINCT FROM before_other\n OR (SELECT jsonb_agg(to_jsonb(p) ORDER BY oid) FROM pg_proc p\n WHERE pronamespace IN ('public'::regnamespace,'privacy_retention'::regnamespace,'review_media_private'::regnamespace)) IS DISTINCT FROM before_functions\n OR (SELECT coalesce(jsonb_agg(to_jsonb(m) ORDER BY roleid,member,grantor),'[]') FROM pg_auth_members m) IS DISTINCT FROM before_members\n OR (SELECT jsonb_agg(to_jsonb(m) ORDER BY manifest_kind,manifest_key) FROM privacy_retention.g014_catalog_contract_manifest m) IS DISTINCT FROM before_manifest\n OR (SELECT jsonb_agg(to_jsonb(n) ORDER BY oid) FROM pg_namespace n) IS DISTINCT FROM before_schema\n THEN RAISE EXCEPTION 'STORAGE_ADMIN_POLICY_PRESERVATION_DRIFT'; END IF;\nEND $forward$",
+ "-- STORAGE_CALLER_BOUND_ADMIN_READBACK_BEGIN\nDO $readback$\nDECLARE item record; policy_row record; expression text;\nBEGIN\n IF EXISTS(SELECT 1 FROM pg_depend d JOIN pg_policy p ON d.classid='pg_policy'::regclass AND d.objid=p.oid\n WHERE p.polrelid='storage.objects'::regclass AND d.refclassid='pg_proc'::regclass\n AND d.refobjid IN ('public.is_user_admin(uuid)'::regprocedure,'public.has_role(uuid,public.app_role)'::regprocedure))\n OR has_function_privilege('anon','public.is_user_admin(uuid)','EXECUTE')\n OR has_function_privilege('authenticated','public.is_user_admin(uuid)','EXECUTE')\n OR has_function_privilege('service_role','public.is_user_admin(uuid)','EXECUTE')\n THEN RAISE EXCEPTION 'STORAGE_ADMIN_POLICY_READBACK_DRIFT'; END IF;\n IF NOT EXISTS(SELECT 1 FROM pg_policy WHERE polrelid='storage.objects'::regclass AND polname='review_verifications_owner_read'\n AND polcmd='r' AND polpermissive AND polroles=ARRAY['authenticated'::regrole::oid] AND polwithcheck IS NULL\n AND replace(pg_get_expr(polqual,polrelid),'auth.uid()','uid()')='((bucket_id = ''review-verifications''::text) AND ((storage.foldername(name))[1] = ( SELECT (uid())::text AS uid)))')\n THEN RAISE EXCEPTION 'STORAGE_OWNER_READ_READBACK_DRIFT'; END IF;\n FOR item IN SELECT * FROM (VALUES ('Admin upload access','a'::\"char\"),('Admin delete access','d'::\"char\")) AS expected(name,cmd) LOOP\n SELECT p.*,pg_get_expr(polqual,polrelid) AS using_expr,pg_get_expr(polwithcheck,polrelid) AS check_expr INTO policy_row\n FROM pg_policy p WHERE polrelid='storage.objects'::regclass AND polname=item.name;\n IF NOT FOUND THEN CONTINUE; END IF;\n expression:=coalesce(CASE WHEN item.cmd='a' THEN policy_row.check_expr ELSE policy_row.using_expr END,'');\n IF NOT policy_row.polpermissive OR policy_row.polcmd<>item.cmd\n OR policy_row.polroles<>ARRAY['authenticated'::regrole::oid]\n OR (CASE WHEN item.cmd='a' THEN policy_row.using_expr IS NOT NULL ELSE policy_row.check_expr IS NOT NULL END)\n OR encode(sha256(convert_to(regexp_replace(replace(expression,'auth.uid()','uid()'),'[[:space:]]+',' ','g'),'UTF8')),'hex')<>'049d579041975ddfaa0c560f56e4c57ee06099b2290f742636ba5bd9345463df'\n OR (SELECT count(*) FROM pg_depend WHERE classid='pg_policy'::regclass AND objid=policy_row.oid\n AND refclassid='pg_proc'::regclass AND refobjid='auth.uid()'::regprocedure)<>1\n THEN RAISE EXCEPTION 'STORAGE_ADMIN_POLICY_READBACK_DRIFT'; END IF;\n END LOOP;\nEND $readback$",
+ "-- STORAGE_CALLER_BOUND_ADMIN_READBACK_END\nCOMMIT"
+ ]
+ },
+ {
+ "id": "review_owner_cleanup_completion",
+ "version": "20261011175912",
+ "name": "review_owner_cleanup_completion",
+ "path": "backend/supabase/migrations/20261011175912_review_owner_cleanup_completion.sql",
+ "bytes": 6694,
+ "sha256": "9164be35fc17e67c3f1aaf98aad13139a8fd469130bd1315879bff5dac63ba26",
+ "statementCount": 6,
+ "statementVectorSha256": "1343501bbfeac4c075fcb09f07de1a11e3b02c27d12d5091b65d72c99555269a",
+ "originalStatementVector": [
+ "-- Count only retired, unreferenced owner cleanup, excluding live OCR staging.\n-- Forward correction preserves applied SQL, RPC metadata, ACLs and G014 rows.\nBEGIN",
+ "SET LOCAL lock_timeout='2s'",
+ "SELECT pg_advisory_xact_lock(hashtextextended('tzudong:review-media-catalog:v2',0))",
+ "DO $forward$\nDECLARE target oid:='public.finish_review_media_cleanup()'::regprocedure;\n definition text; source text; patched text; metadata jsonb; defaults text;\n before_members jsonb; before_assertions jsonb; before_manifest jsonb; self_membership jsonb;\n before_schema jsonb; schema_lease boolean;\n workflow_owner oid:='privacy_workflow_owner'::regrole; runner oid:='postgres'::regrole;\n major integer:=current_setting('server_version_num')::integer/10000; pg15_lease boolean:=false;\nBEGIN\n IF current_user<>'postgres' OR session_user<>'postgres' OR major NOT IN (15,17)\n OR current_setting('transaction_read_only')<>'off' OR NOT EXISTS(SELECT 1 FROM pg_roles\n WHERE oid=workflow_owner AND NOT rolsuper AND NOT rolbypassrls AND NOT rolcanlogin AND NOT rolinherit)\n THEN RAISE EXCEPTION 'REVIEW_SHARED_EXECUTOR_DENIED'; END IF;\n SELECT coalesce(jsonb_agg(to_jsonb(m) ORDER BY roleid,member,grantor),'[]') INTO before_members FROM pg_auth_members m;\n SELECT jsonb_agg(to_jsonb(p) ORDER BY oid) INTO before_assertions FROM pg_proc p WHERE pronamespace='privacy_retention'::regnamespace;\n SELECT pg_get_functiondef(p.oid),p.prosrc,to_jsonb(p)-ARRAY['prosrc','proargdefaults'],pg_get_expr(p.proargdefaults,0) INTO definition,source,metadata,defaults FROM pg_proc p WHERE p.oid=target;\n IF metadata->>'proowner'<>workflow_owner::text OR encode(sha256(convert_to(source,'UTF8')),'hex')<>'f6c4e71988ed2b789b887484af5fdf2e482bde98f1d1c5b5d4e7ad124c314bd1'\n THEN RAISE EXCEPTION 'REVIEW_SHARED_SOURCE_DRIFT'; END IF;\n SELECT to_jsonb(n) INTO before_schema FROM pg_namespace n WHERE n.oid='public'::regnamespace;\n IF before_schema->>'nspowner' NOT IN (runner::text,'pg_database_owner'::regrole::oid::text)\n THEN RAISE EXCEPTION 'REVIEW_SHARED_SCHEMA_OWNER_DRIFT'; END IF;\n schema_lease:=NOT has_schema_privilege(workflow_owner,'public','CREATE');\n IF schema_lease THEN GRANT CREATE ON SCHEMA public TO privacy_workflow_owner; END IF;\n SELECT to_jsonb(m) INTO self_membership FROM pg_auth_members m WHERE roleid=workflow_owner AND member=runner AND grantor=runner;\n IF self_membership IS NOT NULL AND (self_membership->>'admin_option')::boolean THEN RAISE EXCEPTION 'REVIEW_MEDIA_FORWARD_MEMBERSHIP_DENIED'; END IF;\n IF major=17 THEN\n IF NOT EXISTS(SELECT 1 FROM pg_auth_members WHERE roleid=workflow_owner AND member=runner AND admin_option AND grantor<>runner)\n THEN RAISE EXCEPTION 'REVIEW_MEDIA_FORWARD_OWNER_AUTHORITY_MISSING'; END IF;\n EXECUTE 'GRANT privacy_workflow_owner TO postgres WITH ADMIN FALSE,INHERIT FALSE,SET TRUE GRANTED BY postgres';\n ELSE\n pg15_lease:=NOT pg_has_role(runner,workflow_owner,'MEMBER');\n IF pg15_lease THEN GRANT privacy_workflow_owner TO postgres; END IF;\n END IF;\n SET LOCAL ROLE privacy_workflow_owner;\n SELECT jsonb_agg(to_jsonb(m) ORDER BY manifest_kind,manifest_key) INTO before_manifest FROM privacy_retention.g014_catalog_contract_manifest m;\n\n IF (length(source)-length(replace(source,$old$AND NOT c.complete);$old$,'')))/length($old$AND NOT c.complete);$old$)<>1\n THEN RAISE EXCEPTION 'OWNER_CLEANUP_ANCHOR_DRIFT'; END IF;\n patched:=replace(source,$old$AND NOT c.complete);$old$,$new$AND c.retired AND NOT c.complete AND NOT review_media_private.referenced(c.path));$new$);\n EXECUTE replace(definition,source,patched);\n IF (SELECT to_jsonb(p)-ARRAY['prosrc','proargdefaults'] FROM pg_proc p WHERE p.oid=target) IS DISTINCT FROM metadata\n OR (SELECT pg_get_expr(p.proargdefaults,0) FROM pg_proc p WHERE p.oid=target) IS DISTINCT FROM defaults\n OR (SELECT encode(sha256(convert_to(p.prosrc,'UTF8')),'hex') FROM pg_proc p WHERE p.oid=target)<>'a6b4211b2d8486d482f0758ce249eec157249e1a5176be286b76af7e7a775ee9'\n THEN RAISE EXCEPTION 'OWNER_CLEANUP_POST_DRIFT'; END IF;\n CREATE FUNCTION pg_temp.review_shared_assert() RETURNS void LANGUAGE plpgsql SECURITY DEFINER SET search_path='' AS $bridge$\n BEGIN\n PERFORM privacy_retention.assert_g014_public_rpc_allowlist();\n PERFORM privacy_retention.assert_g014_definer_contract();\n PERFORM privacy_retention.assert_g014_catalog_contract();\n DROP FUNCTION pg_temp.review_shared_assert();\n END $bridge$;\n REVOKE ALL ON FUNCTION pg_temp.review_shared_assert() FROM PUBLIC,anon,authenticated,service_role;\n GRANT EXECUTE ON FUNCTION pg_temp.review_shared_assert() TO postgres;\n IF (SELECT jsonb_agg(to_jsonb(m) ORDER BY manifest_kind,manifest_key) FROM privacy_retention.g014_catalog_contract_manifest m) IS DISTINCT FROM before_manifest\n THEN RAISE EXCEPTION 'REVIEW_SHARED_MANIFEST_DRIFT'; END IF;\n RESET ROLE;\n IF schema_lease THEN REVOKE CREATE ON SCHEMA public FROM privacy_workflow_owner; END IF;\n IF major=15 THEN\n IF pg15_lease THEN REVOKE privacy_workflow_owner FROM postgres; END IF;\n ELSIF self_membership IS NULL THEN\n REVOKE privacy_workflow_owner FROM postgres GRANTED BY postgres;\n ELSE\n EXECUTE format('GRANT privacy_workflow_owner TO postgres WITH ADMIN FALSE,INHERIT %s,SET %s GRANTED BY postgres',\n upper(self_membership->>'inherit_option'),upper(self_membership->>'set_option'));\n END IF;\n\n IF (SELECT coalesce(jsonb_agg(to_jsonb(m) ORDER BY roleid,member,grantor),'[]') FROM pg_auth_members m) IS DISTINCT FROM before_members\n OR (SELECT jsonb_agg(to_jsonb(p) ORDER BY oid) FROM pg_proc p WHERE pronamespace='privacy_retention'::regnamespace) IS DISTINCT FROM before_assertions\n OR (SELECT to_jsonb(n) FROM pg_namespace n WHERE n.oid='public'::regnamespace) IS DISTINCT FROM before_schema\n THEN RAISE EXCEPTION 'REVIEW_SHARED_PRESERVATION_DRIFT'; END IF;\n PERFORM pg_temp.review_shared_assert();\nEND $forward$",
+ "-- OWNER_CLEANUP_READBACK_BEGIN\nDO $readback$\nBEGIN\n IF NOT EXISTS(SELECT 1 FROM pg_proc WHERE oid='public.finish_review_media_cleanup()'::regprocedure\n AND proowner='privacy_workflow_owner'::regrole AND prosecdef AND proconfig=ARRAY['search_path=\"\"']::text[]\n AND encode(sha256(convert_to(prosrc,'UTF8')),'hex')='a6b4211b2d8486d482f0758ce249eec157249e1a5176be286b76af7e7a775ee9')\n OR has_function_privilege('anon','public.finish_review_media_cleanup()','EXECUTE')\n OR has_function_privilege('service_role','public.finish_review_media_cleanup()','EXECUTE')\n OR NOT has_function_privilege('authenticated','public.finish_review_media_cleanup()','EXECUTE')\n THEN RAISE EXCEPTION 'OWNER_CLEANUP_READBACK_DRIFT'; END IF;\nEND $readback$",
+ "-- OWNER_CLEANUP_READBACK_END\nCOMMIT"
+ ]
+ }
+ ],
+ "legacyReleaseManifest": {
+ "path": ".github/supabase-migration-release-manifest.v1.json",
+ "entries": 3,
+ "sha256": "515743d094b4b431a29df772a363837bdad8f7541aa3acf4a923efb79f460c0d"
+ },
+ "toolchain": [
+ {
+ "path": "apps/web/scripts/review-media-sql-successor.mjs",
+ "sha256": "4f1b2798e0cfc13db4f11cd6eb4a8653320aa8516eccd71d410fcff6d06a7f24"
+ },
+ {
+ "path": "apps/web/scripts/review-media-sql-rehearsal.mjs",
+ "sha256": "c893c294719776bf5b064c3355866ab97e0fa9412082d9b47d7de5266094c65f"
+ },
+ {
+ "path": "apps/web/scripts/supabase-migration-bundle.mjs",
+ "sha256": "fcebc20dc4846606dc14bdbe658a07daa32430ad632e52383151f5c22d22efb9"
+ },
+ {
+ "path": "apps/web/scripts/supabase-migration-transaction.mjs",
+ "sha256": "c67bdff4c63b1bf1b4a157863b3eb5253b5973a8fb54b7fd49351270787bed26"
+ },
+ {
+ "path": "apps/web/scripts/apply-supabase-migration.mjs",
+ "sha256": "02c404e0be3e81b7c8d4d7766ff29e750b1797f5ad49b5f496168170e21192d4"
+ },
+ {
+ "path": "apps/web/scripts/vercel-rollback-readback.mjs",
+ "sha256": "fa3876153f0e949d23115612cb34bc545c6c29bccb6ba2fd6042a38e70555e04"
+ },
+ {
+ "path": "backend/supabase/scripts/g037_supabase_statement_vector.mjs",
+ "sha256": "398e3945c0d0fb656daef0d0a42409dbdeb45a9bb1f6f8c03445e4436d4db0bd"
+ }
+ ],
+ "requiredWriterFences": {
+ "adminRecordMutationsHold": "active",
+ "g037WriteFreeze": "active",
+ "automaticReviewer": "stopped",
+ "browserRpc": "stopped",
+ "directSql": "stopped",
+ "dashboard": "stopped",
+ "providerIngress": "stopped"
+ }
+}
diff --git a/apps/web/components/admin/AdminOverviewDashboard.tsx b/apps/web/components/admin/AdminOverviewDashboard.tsx
index b2076683ee..b5b8ded97d 100644
--- a/apps/web/components/admin/AdminOverviewDashboard.tsx
+++ b/apps/web/components/admin/AdminOverviewDashboard.tsx
@@ -9,6 +9,7 @@ import { Badge } from "@/components/ui/badge";
import { Button } from "@/components/ui/button";
import { Skeleton } from "@/components/ui/skeleton";
import { useNaverMaps } from "@/hooks/use-naver-maps";
+import { AdminMapLoadErrorState } from "@/components/admin/admin-map-load-error-state";
import { readAdminNaverCoordinate } from "@/lib/admin/naver-coordinate";
import { REGION_MAP_CONFIG } from "@/config/maps";
import { getNaverIndividualMarkerVisual } from "@/lib/naver-map-marker-visuals";
@@ -882,17 +883,7 @@ function AdminNaverMapSurface({
{isMapPreparing && }
{loadError && !isMapPreparing && (
-
-
-
- 네이버 지도를 불러오지 못했습니다
-
-
- {loadError.message} 지도 키가 준비되면 홈과 같은 마커와 클러스터로
- 자동 표시됩니다.
-