From ba767045a494837c5aa95439db2fc9e3573ed592 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=90=D0=BB=D0=B5=D0=BA=D1=81=D0=B0=D0=BD=D0=B4=D1=80=20?=
 =?UTF-8?q?=D0=97=D0=B8=D0=BC=D0=B8=D0=BD?= <zimin.an@nstart.space>
Date: Tue, 2 Jun 2026 09:13:23 +0000
Subject: [PATCH] fix(workflow): drop DB self-approve constraints (unblock
 admin override)

---
 .../0029-drop-self-approve-constraints.xml    | 60 +++++++++++++++++++
 .../main/resources/db/changelog/master.xml    |  1 +
 2 files changed, 61 insertions(+)
 create mode 100644 ordinis-migrations/src/main/resources/db/changelog/changes/0029-drop-self-approve-constraints.xml

diff --git a/ordinis-migrations/src/main/resources/db/changelog/changes/0029-drop-self-approve-constraints.xml b/ordinis-migrations/src/main/resources/db/changelog/changes/0029-drop-self-approve-constraints.xml
new file mode 100644
index 0000000..0d49ffe
--- /dev/null
+++ b/ordinis-migrations/src/main/resources/db/changelog/changes/0029-drop-self-approve-constraints.xml
@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<databaseChangeLog
+  xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+                      http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.27.xsd">
+
+  <!--
+    Drop self-approve CHECK constraints для record_drafts + dictionary_schema_drafts.
+
+    Контекст: в 0019 (record_drafts) и 0022 (schema_drafts) был добавлен
+    DB-level CHECK constraint `maker_id != reviewer_id` (resp. decision_user_id)
+    как defence-in-depth. В MR !280 mы добавили admin-override на Java
+    layer — admin может approve свой draft. Но DB CHECK блокирует на
+    INSERT/UPDATE независимо от Java логики:
+
+      ERROR: new row for relation "dictionary_schema_drafts" violates
+      check constraint "schema_drafts_no_self_approve"
+
+    → 500 для юзера, который пытается admin self-approve.
+
+    Defence-in-depth теперь сохраняется на Java layer:
+    - DraftService.approve / SchemaDraftService.decide throw'ит 409
+      `self_approve_forbidden` для non-admin makers.
+    - Admin role tail-match (см. WorkflowRoles.isAdmin) override'ит check
+      + логирует INFO `Admin self-(approve|decide) override` для audit
+      trail.
+
+    Если в будущем понадобится strict maker-checker (regulated env) —
+    отдельная feature flag `ordinis.workflow.admin-self-approve.enabled`
+    в Java layer. DB constraint восстанавливать не будем — слишком
+    rigid.
+  -->
+
+  <changeSet id="0029-1-drop-record-drafts-no-self-approve" author="ordinis">
+    <comment>Drop record_drafts_no_self_approve CHECK — admin override moved to Java</comment>
+    <sql>
+      ALTER TABLE record_drafts
+        DROP CONSTRAINT IF EXISTS record_drafts_no_self_approve;
+    </sql>
+    <rollback>
+      ALTER TABLE record_drafts
+        ADD CONSTRAINT record_drafts_no_self_approve
+        CHECK (reviewer_id IS NULL OR maker_id != reviewer_id);
+    </rollback>
+  </changeSet>
+
+  <changeSet id="0029-2-drop-schema-drafts-no-self-approve" author="ordinis">
+    <comment>Drop schema_drafts_no_self_approve CHECK — admin override moved to Java</comment>
+    <sql>
+      ALTER TABLE dictionary_schema_drafts
+        DROP CONSTRAINT IF EXISTS schema_drafts_no_self_approve;
+    </sql>
+    <rollback>
+      ALTER TABLE dictionary_schema_drafts
+        ADD CONSTRAINT schema_drafts_no_self_approve
+        CHECK (decision_user_id IS NULL OR maker_id != decision_user_id);
+    </rollback>
+  </changeSet>
+</databaseChangeLog>
diff --git a/ordinis-migrations/src/main/resources/db/changelog/master.xml b/ordinis-migrations/src/main/resources/db/changelog/master.xml
index ba6ef33..e97ab8f 100644
--- a/ordinis-migrations/src/main/resources/db/changelog/master.xml
+++ b/ordinis-migrations/src/main/resources/db/changelog/master.xml
@@ -38,5 +38,6 @@
   <include file="changes/0026-notification-quiet-hours.xml" relativeToChangelogFile="true"/>
   <include file="changes/0027-spacecraft-mission-fk.xml" relativeToChangelogFile="true"/>
   <include file="changes/0028-phase3-prep-org-id.xml" relativeToChangelogFile="true"/>
+  <include file="changes/0029-drop-self-approve-constraints.xml" relativeToChangelogFile="true"/>
 
 </databaseChangeLog>