Files
Jyotisha/frontend/supabase/migrations/20260729010000_epay_settings.sql
T
linmeng d956da2993
Deploy staging to test server / deploy (push) Failing after 5m31s
feat: manage epay settings securely
2026-07-29 16:36:35 +08:00

127 lines
4.3 KiB
PL/PgSQL

create table public.epay_settings (
id boolean primary key default true check (id),
gateway_url text not null,
pid text not null,
encrypted_key text not null,
notify_url text not null,
return_url text not null,
site_name text not null,
chat_enabled boolean not null default false,
updated_by uuid not null,
updated_at timestamptz not null default clock_timestamp()
);
alter table public.epay_settings enable row level security;
revoke all on table public.epay_settings from public, anon, authenticated, service_role;
grant select on table public.epay_settings to service_role;
alter table audit.admin_audit_logs
drop constraint if exists admin_audit_logs_action_check,
drop constraint if exists admin_audit_logs_target_type_check;
alter table audit.admin_audit_logs
add constraint admin_audit_logs_action_check check (
action in ('redemption_code.create', 'redemption_code.update', 'redemption_code.revoke', 'epay_settings.update')
),
add constraint admin_audit_logs_target_type_check check (
target_type in ('redemption_code', 'epay_settings')
);
create or replace function public.admin_save_epay_settings(
p_actor_user_id uuid,
p_actor_email text,
p_actor_role text,
p_request_id text,
p_gateway_url text,
p_pid text,
p_encrypted_key text,
p_notify_url text,
p_return_url text,
p_site_name text,
p_chat_enabled boolean,
p_key_changed boolean
)
returns public.epay_settings
language plpgsql
security definer
set search_path = ''
as $$
declare
v_email text;
v_before public.epay_settings;
v_after public.epay_settings;
v_target_id constant uuid := '00000000-0000-0000-0000-000000000001';
begin
v_email := public.admin_verified_actor_email(p_actor_user_id, p_actor_email, p_actor_role);
select * into v_before from public.epay_settings where id = true for update;
insert into public.epay_settings (
id, gateway_url, pid, encrypted_key, notify_url, return_url,
site_name, chat_enabled, updated_by, updated_at
) values (
true, p_gateway_url, p_pid, p_encrypted_key, p_notify_url, p_return_url,
p_site_name, p_chat_enabled, p_actor_user_id, clock_timestamp()
)
on conflict (id) do update set
gateway_url = excluded.gateway_url,
pid = excluded.pid,
encrypted_key = excluded.encrypted_key,
notify_url = excluded.notify_url,
return_url = excluded.return_url,
site_name = excluded.site_name,
chat_enabled = excluded.chat_enabled,
updated_by = excluded.updated_by,
updated_at = excluded.updated_at
returning * into v_after;
insert into audit.admin_audit_logs (
actor_user_id, actor_email, actor_role, action, target_type,
target_id, before_value, after_value, request_id
) values (
p_actor_user_id, v_email, p_actor_role, 'epay_settings.update', 'epay_settings',
v_target_id,
case when v_before.id is null then null else jsonb_build_object(
'gatewayUrl', v_before.gateway_url,
'pid', v_before.pid,
'notifyUrl', v_before.notify_url,
'returnUrl', v_before.return_url,
'siteName', v_before.site_name,
'chatEnabled', v_before.chat_enabled,
'keyConfigured', true,
'keyChanged', false
) end,
jsonb_build_object(
'gatewayUrl', v_after.gateway_url,
'pid', v_after.pid,
'notifyUrl', v_after.notify_url,
'returnUrl', v_after.return_url,
'siteName', v_after.site_name,
'chatEnabled', v_after.chat_enabled,
'keyConfigured', true,
'keyChanged', p_key_changed
),
p_request_id
);
return v_after;
end;
$$;
revoke all on function public.admin_save_epay_settings(uuid, text, text, text, text, text, text, text, text, text, boolean, boolean)
from public, anon, authenticated;
grant execute on function public.admin_save_epay_settings(uuid, text, text, text, text, text, text, text, text, text, boolean, boolean)
to service_role;
do $$
begin
if exists (select 1 from pg_roles where rolname = 'admin_runtime') then
grant select on table public.epay_settings to admin_runtime;
drop policy if exists epay_settings_admin_read on public.epay_settings;
create policy epay_settings_admin_read on public.epay_settings
for select to admin_runtime using (id = true);
grant execute on function public.admin_save_epay_settings(uuid, text, text, text, text, text, text, text, text, text, boolean, boolean)
to admin_runtime;
end if;
end;
$$;