185 allow organization specific roles

README.md

@@ -226,5 +226,5 @@ DATABASE_URL=postgres://refactor:password@localhost:5432/refactor_platform sea-o
 Note that to generate a new Entity using the CLI you must ignore all other tables using the `--ignore-tables` option. You must add the option for _each_ table you are ignoring.
 
 ```bash
- DATABASE_URL=postgres://refactor:password@localhost:5432/refactor_platform sea-orm-cli generate entity  -s refactor_platform -o entity/src -v --with-serde both --serde-skip-deserializing-primary-key --ignore-tables {table to ignore} --ignore-tables {other table to ignore}
+ DATABASE_URL=postgres://refactor:password@localhost:5432/refactor sea-orm-cli generate entity  -s refactor_platform -o entity/src -v --with-serde both --serde-skip-deserializing-primary-key --ignore-tables {table to ignore} --ignore-tables {other table to ignore}
 ```

docs/db/refactor_platform_rs.dbml

@@ -40,6 +40,15 @@ Table refactor_platform.users {
   updated_at timestamptz [not null, default: `now()`, note: 'The last date and time fields were changed']
 }
 
+Table refactor_platform.user_roles {
+  id uuid [primary key, unique, not null, default: `gen_random_uuid()`]
+  role refactor_platform.role [not null]
+  organization_id uuid [note: 'The organization joined to the user']
+  user_id uuid [not null, note: 'The user joined to the organization']
+  created_at timestamptz [not null, default: `now()`]
+  updated_at timestamptz [not null, default: `now()`, note: 'The last date and time fields were changed']
+}
+
 Table refactor_platform.organizations_users {
   id uuid [primary key, unique, not null, default: `gen_random_uuid()`]
   organization_id uuid [not null, note: 'The organization joined to the user']
@@ -121,6 +130,12 @@ enum refactor_platform.status {
   wont_do
 }
 
+enum refactor_platform.role {
+  user
+  admin
+  super_admin
+}
+
 // coaching_relationships relationships
 Ref: refactor_platform.coaching_relationships.organization_id > refactor_platform.organizations.id
 Ref: refactor_platform.coaching_relationships.coachee_id > refactor_platform.users.id
@@ -146,3 +161,7 @@ Ref: refactor_platform.actions.coaching_session_id > refactor_platform.coaching_
 // organizations_users relationships
 Ref: refactor_platform.organizations_users.organization_id > refactor_platform.organizations.id
 Ref: refactor_platform.organizations_users.user_id > refactor_platform.users.id
+
+//user_roles relationships
+Ref: refactor_platform.user_roles.organization_id > refactor_platform.organizations.id
+Ref: refactor_platform.user_roles.user_id > refactor_platform.users.id

entity/src/lib.rs

@@ -15,6 +15,7 @@ pub mod organizations_users;
 pub mod overarching_goals;
 pub mod roles;
 pub mod status;
+pub mod user_roles;
 pub mod users;
 
 /// A type alias that represents any Entity's internal id field data type.

entity/src/roles.rs

@@ -11,13 +11,16 @@ pub enum Role {
     User,
     #[sea_orm(string_value = "admin")]
     Admin,
+    #[sea_orm(string_value = "super_admin")]
+    SuperAdmin,
 }
 
 impl std::fmt::Display for Role {
     fn fmt(&self, fmt: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         match self {
             Role::User => write!(fmt, "user"),
             Role::Admin => write!(fmt, "admin"),
+            Role::SuperAdmin => write!(fmt, "super_admin"),
         }
     }
 }

entity/src/user_roles.rs

@@ -0,0 +1,52 @@
+//! `SeaORM` Entity, @generated by sea-orm-codegen 1.1.13
+
+use super::roles::Role;
+use sea_orm::entity::prelude::*;
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, Eq, Serialize, Deserialize)]
+#[sea_orm(schema_name = "refactor_platform", table_name = "user_roles")]
+pub struct Model {
+    #[sea_orm(primary_key, auto_increment = false)]
+    #[serde(skip_deserializing)]
+    pub id: Uuid,
+    pub role: Role,
+    pub organization_id: Option<Uuid>,
+    pub user_id: Uuid,
+    pub created_at: DateTimeWithTimeZone,
+    pub updated_at: DateTimeWithTimeZone,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {
+    #[sea_orm(
+        belongs_to = "super::organizations::Entity",
+        from = "Column::OrganizationId",
+        to = "super::organizations::Column::Id",
+        on_update = "Cascade",
+        on_delete = "Cascade"
+    )]
+    Organizations,
+    #[sea_orm(
+        belongs_to = "super::users::Entity",
+        from = "Column::UserId",
+        to = "super::users::Column::Id",
+        on_update = "Cascade",
+        on_delete = "Cascade"
+    )]
+    Users,
+}
+
+impl Related<super::organizations::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::Organizations.def()
+    }
+}
+
+impl Related<super::users::Entity> for Entity {
+    fn to() -> RelationDef {
+        Relation::Users.def()
+    }
+}
+
+impl ActiveModelBehavior for ActiveModel {}

migration/src/base_refactor_platform_rs.sql

@@ -1,6 +1,6 @@
 -- SQL dump generated using DBML (dbml.dbdiagram.io)
 -- Database: PostgreSQL
--- Generated at: 2025-07-11T12:54:19.417Z
+-- Generated at: 2025-09-18T01:56:35.997Z
 
 
 CREATE TYPE "refactor_platform"."status" AS ENUM (

migration/src/lib.rs

@@ -8,6 +8,7 @@ mod m20250611_115337_promote_admin_user_to_admin_role;
 mod m20250705_200000_add_timezone_to_users;
 mod m20250730_000000_add_coaching_sessions_sorting_indexes;
 mod m20250801_000000_add_sorting_indexes;
+mod m20250916_060419_add_user_roles_table_and_super_admin;
 
 pub struct Migrator;
 
@@ -23,6 +24,7 @@ impl MigratorTrait for Migrator {
             Box::new(m20250705_200000_add_timezone_to_users::Migration),
             Box::new(m20250730_000000_add_coaching_sessions_sorting_indexes::Migration),
             Box::new(m20250801_000000_add_sorting_indexes::Migration),
+            Box::new(m20250916_060419_add_user_roles_table_and_super_admin::Migration),
         ]
     }
 }

migration/src/m20250916_060419_add_user_roles_table_and_super_admin.rs

@@ -0,0 +1,95 @@
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        // 1. Add super_admin variant to the existing role enum
+        // Note: We use execute_unprepared() instead of SeaORM's schema builder because:
+        // - PostgreSQL's ALTER TYPE ... ADD VALUE has special transaction restrictions
+        // - It cannot be executed in a transaction block that has other commands
+        // - execute_unprepared() gives us direct control over the SQL execution
+        // - The IF NOT EXISTS clause makes it safe for re-runs
+        manager
+            .get_connection()
+            .execute_unprepared(
+                "ALTER TYPE refactor_platform.role ADD VALUE IF NOT EXISTS 'super_admin'",
+            )
+            .await?;
+
+        // 2. Create the user_roles table
+        // We continue using execute_unprepared() for consistency and to ensure
+        // proper PostgreSQL schema qualification (refactor_platform.user_roles)
+        let create_table_sql = "CREATE TABLE IF NOT EXISTS refactor_platform.user_roles (
+            id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+            role refactor_platform.role NOT NULL,
+            organization_id UUID,
+            user_id UUID NOT NULL,
+            created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+            updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+            CONSTRAINT fk_user_roles_organization 
+                FOREIGN KEY (organization_id) 
+                REFERENCES refactor_platform.organizations(id) 
+                ON DELETE CASCADE 
+                ON UPDATE CASCADE,
+            CONSTRAINT fk_user_roles_user 
+                FOREIGN KEY (user_id) 
+                REFERENCES refactor_platform.users(id) 
+                ON DELETE CASCADE 
+                ON UPDATE CASCADE
+        )";
+
+        manager
+            .get_connection()
+            .execute_unprepared(create_table_sql)
+            .await?;
+
+        // 3. Create partial unique indexes to prevent duplicate role assignments
+        // This handles NULL organization_id properly (for super_admin roles)
+
+        // Partial index for organization-scoped roles (where organization_id is NOT NULL)
+        let create_org_index_sql =
+            "CREATE UNIQUE INDEX IF NOT EXISTS user_roles_user_org_role_unique 
+            ON refactor_platform.user_roles(user_id, organization_id, role)
+            WHERE organization_id IS NOT NULL";
+
+        manager
+            .get_connection()
+            .execute_unprepared(create_org_index_sql)
+            .await?;
+
+        // Partial index for global roles (prevents duplicate global roles for same user)
+        // This includes super_admin and any other future global roles
+        let create_global_role_index_sql =
+            "CREATE UNIQUE INDEX IF NOT EXISTS user_roles_user_global_role_unique 
+            ON refactor_platform.user_roles(user_id, role)
+            WHERE organization_id IS NULL";
+
+        manager
+            .get_connection()
+            .execute_unprepared(create_global_role_index_sql)
+            .await?;
+
+        Ok(())
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        // Drop the user_roles table (this will also drop the indexes and foreign keys)
+        manager
+            .get_connection()
+            .execute_unprepared("DROP TABLE IF EXISTS refactor_platform.user_roles")
+            .await?;
+
+        // Note: We cannot remove the 'super_admin' value from the enum in PostgreSQL
+        // once it has been added. This is a PostgreSQL limitation.
+        // If you need to truly remove it, you would need to:
+        // 1. Create a new enum type without 'super_admin'
+        // 2. Update all columns using the old type to use the new type
+        // 3. Drop the old enum type
+        // This is complex and risky, so we'll leave the enum value in place.
+
+        Ok(())
+    }
+}

web/src/protect/mod.rs

@@ -164,6 +164,21 @@ impl Check for UserIsAdmin {
         authenticated_user.role == domain::users::Role::Admin
     }
 }
+// Not used yet
+#[allow(dead_code)]
+pub struct UserIsSuperAdmin;
+
+#[async_trait]
+impl Check for UserIsSuperAdmin {
+    async fn eval(
+        &self,
+        _app_state: &AppState,
+        authenticated_user: &domain::users::Model,
+        _args: Vec<Id>,
+    ) -> bool {
+        authenticated_user.role == domain::users::Role::SuperAdmin
+    }
+}
 
 pub struct UserCanAccessCoachingSession;