Merge branch 'fix/drop-self-approve-db-constraints' into 'main'

fix(workflow): drop DB self-approve constraints (unblock admin override) See merge request 2-6/2-6-4/terravault/ordinis!281
2026-06-02 09:13:23 +00:00
parent ff0fd1e3e9 ba767045a4
commit da7d4c489c
2 changed files with 61 additions and 0 deletions
@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<databaseChangeLog
+  xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+                      http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.27.xsd">
+
+  <!--
+    Drop self-approve CHECK constraints для record_drafts + dictionary_schema_drafts.
+
+    Контекст: в 0019 (record_drafts) и 0022 (schema_drafts) был добавлен
+    DB-level CHECK constraint `maker_id != reviewer_id` (resp. decision_user_id)
+    как defence-in-depth. В MR !280 mы добавили admin-override на Java
+    layer — admin может approve свой draft. Но DB CHECK блокирует на
+    INSERT/UPDATE независимо от Java логики:
+
+      ERROR: new row for relation "dictionary_schema_drafts" violates
+      check constraint "schema_drafts_no_self_approve"
+
+    → 500 для юзера, который пытается admin self-approve.
+
+    Defence-in-depth теперь сохраняется на Java layer:
+    - DraftService.approve / SchemaDraftService.decide throw'ит 409
+      `self_approve_forbidden` для non-admin makers.
+    - Admin role tail-match (см. WorkflowRoles.isAdmin) override'ит check
+      + логирует INFO `Admin self-(approve|decide) override` для audit
+      trail.
+
+    Если в будущем понадобится strict maker-checker (regulated env) —
+    отдельная feature flag `ordinis.workflow.admin-self-approve.enabled`
+    в Java layer. DB constraint восстанавливать не будем — слишком
+    rigid.
+  -->
+
+  <changeSet id="0029-1-drop-record-drafts-no-self-approve" author="ordinis">
+    <comment>Drop record_drafts_no_self_approve CHECK — admin override moved to Java</comment>
+    <sql>
+      ALTER TABLE record_drafts
+        DROP CONSTRAINT IF EXISTS record_drafts_no_self_approve;
+    </sql>
+    <rollback>
+      ALTER TABLE record_drafts
+        ADD CONSTRAINT record_drafts_no_self_approve
+        CHECK (reviewer_id IS NULL OR maker_id != reviewer_id);
+    </rollback>
+  </changeSet>
+
+  <changeSet id="0029-2-drop-schema-drafts-no-self-approve" author="ordinis">
+    <comment>Drop schema_drafts_no_self_approve CHECK — admin override moved to Java</comment>
+    <sql>
+      ALTER TABLE dictionary_schema_drafts
+        DROP CONSTRAINT IF EXISTS schema_drafts_no_self_approve;
+    </sql>
+    <rollback>
+      ALTER TABLE dictionary_schema_drafts
+        ADD CONSTRAINT schema_drafts_no_self_approve
+        CHECK (decision_user_id IS NULL OR maker_id != decision_user_id);
+    </rollback>
+  </changeSet>
+</databaseChangeLog>
@@ -38,5 +38,6 @@
  <include file="changes/0026-notification-quiet-hours.xml" relativeToChangelogFile="true"/>
  <include file="changes/0027-spacecraft-mission-fk.xml" relativeToChangelogFile="true"/>
  <include file="changes/0028-phase3-prep-org-id.xml" relativeToChangelogFile="true"/>
+  <include file="changes/0029-drop-self-approve-constraints.xml" relativeToChangelogFile="true"/>

 </databaseChangeLog>