fix(migrations): close RLS column-scope gap and B2B reapply dead-end

019: Postgres RLS is row-level only, so the admin update policies let an
admin session change any column on orders/products/commissions/payouts,
not just the status/price/inventory fields the comment documents. Added
column-scoping triggers that reject updates touching columns outside the
documented admin-editable set.

020: user_id is unique and the update policy required status='pending',
so a rejected user had no way to resubmit (can't insert a second row,
can't update the rejected row). Widened the policy to allow editing a
rejected row back to 'pending' (with-check still pins the result to
'pending' only, so a user can never self-approve), and added a trigger
to clear stale reviewer fields on resubmission.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: Newmusicyy111

migrations/019_admin_rls_policies.sql

@@ -98,3 +98,65 @@ create policy "Admins can read audit logs"
   on public.admin_audit_logs
   for select
   using (exists (select 1 from public.users where users.id = auth.uid() and users.tier = 'admin'));
+
+-- Column-scoping guards -----------------------------------------------------
+-- RLS policies above are row-level only: Postgres RLS cannot restrict which
+-- *columns* an update touches, so the "admins cannot modify user tier or
+-- delete orders (only status updates)" comment above is not actually
+-- enforced by the `for update` policies alone — an admin session could
+-- update any column on a row it can see (e.g. orders.total, orders.user_id).
+-- These triggers close that gap by rejecting updates that touch a column
+-- outside the documented admin-editable set. They only apply when the admin
+-- RLS predicate matches, so non-admin updates (already blocked by RLS, or
+-- performed by the service role) are unaffected.
+create or replace function public.enforce_admin_column_scope()
+returns trigger
+language plpgsql
+as $$
+declare
+  is_admin boolean;
+  allowed_cols text[] := tg_argv;
+  col text;
+begin
+  is_admin := exists (select 1 from public.users where users.id = auth.uid() and users.tier = 'admin');
+  if not is_admin then
+    return new;
+  end if;
+
+  foreach col in array (
+    select key from jsonb_each(to_jsonb(new)) t(key, value)
+    where to_jsonb(new) -> key is distinct from to_jsonb(old) -> key
+  )
+  loop
+    if not (col = any (allowed_cols)) then
+      raise exception 'Admin update to column "%" on % is not permitted (allowed: %)', col, tg_table_name, allowed_cols;
+    end if;
+  end loop;
+
+  return new;
+end;
+$$;
+
+drop trigger if exists admin_column_scope_orders on public.orders;
+create trigger admin_column_scope_orders
+  before update on public.orders
+  for each row
+  execute function public.enforce_admin_column_scope('status', 'updated_at');
+
+drop trigger if exists admin_column_scope_products on public.products;
+create trigger admin_column_scope_products
+  before update on public.products
+  for each row
+  execute function public.enforce_admin_column_scope('price', 'original_price', 'in_stock', 'inventory', 'updated_at');
+
+drop trigger if exists admin_column_scope_commissions on public.commissions;
+create trigger admin_column_scope_commissions
+  before update on public.commissions
+  for each row
+  execute function public.enforce_admin_column_scope('status', 'paid_at', 'updated_at');
+
+drop trigger if exists admin_column_scope_commission_payouts on public.commission_payouts;
+create trigger admin_column_scope_commission_payouts
+  before update on public.commission_payouts
+  for each row
+  execute function public.enforce_admin_column_scope('status', 'payout_date', 'updated_at');

migrations/020_b2b_upgrade_requests.sql

@@ -54,11 +54,15 @@ create policy "Users can insert own upgrade requests"
   for insert
   with check (auth.uid() = user_id);
 
--- Users can update their own pending requests
-create policy "Users can update own pending requests"
+-- Users can update their own pending OR rejected requests. The unique constraint
+-- on user_id means a rejected user has no way to submit a *new* row, so the
+-- reapply path is editing the existing one back to 'pending' -- the with-check
+-- pins the resulting status to 'pending' so a user can never self-approve or
+-- resubmit into any other state.
+create policy "Users can update own pending or rejected requests"
   on public.b2b_upgrade_requests
   for update
-  using (auth.uid() = user_id and status = 'pending')
+  using (auth.uid() = user_id and status in ('pending', 'rejected'))
   with check (auth.uid() = user_id and status = 'pending');
 
 -- Admin can update any request (reviewed_by, status, reviewed_at, rejection_reason)
@@ -67,3 +71,27 @@ create policy "Admin can update all requests"
   for update
   using (exists (select 1 from public.users where users.id = auth.uid() and users.tier = 'admin'))
   with check (exists (select 1 from public.users where users.id = auth.uid() and users.tier = 'admin'));
+
+-- Clear stale reviewer fields whenever a non-admin resubmission flips a
+-- rejected request back to 'pending' -- otherwise the old rejection_reason/
+-- reviewed_by/reviewed_at would linger and misrepresent the new submission
+-- as already reviewed.
+create or replace function public.reset_b2b_review_fields_on_resubmit()
+returns trigger
+language plpgsql
+as $$
+begin
+  if old.status = 'rejected' and new.status = 'pending' then
+    new.reviewed_by := null;
+    new.reviewed_at := null;
+    new.rejection_reason := null;
+  end if;
+  return new;
+end;
+$$;
+
+drop trigger if exists b2b_reset_review_fields_on_resubmit on public.b2b_upgrade_requests;
+create trigger b2b_reset_review_fields_on_resubmit
+  before update on public.b2b_upgrade_requests
+  for each row
+  execute function public.reset_b2b_review_fields_on_resubmit();