AI tracker: owner-only Setup tab (per-provider connections, skills, instructions, plugins, routines, agents, plan/key labels, notes; ai.provider_setup_providers + provider_setup_entries, secrets refused)

drizzle/20261026090557_ai_provider_setup/migration.sql

@@ -0,0 +1,51 @@
+CREATE TABLE "ai"."provider_setup_entries" (
+	"id" serial PRIMARY KEY,
+	"provider_id" integer NOT NULL,
+	"section" text NOT NULL,
+	"name" text NOT NULL,
+	"note" text,
+	"scope" text,
+	"link" text,
+	"body" text,
+	"sort_order" integer DEFAULT 0 NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "provider_setup_entries_section_check" CHECK ("section" IN ('connections','skills','instructions','plugins','routines','agents','plan','notes')),
+	CONSTRAINT "provider_setup_entries_scope_check" CHECK ("scope" IS NULL OR "scope" IN ('global','per-repo','app')),
+	CONSTRAINT "provider_setup_entries_name_check" CHECK (length(btrim("name")) > 0)
+);
+--> statement-breakpoint
+CREATE TABLE "ai"."provider_setup_providers" (
+	"id" serial PRIMARY KEY,
+	"name" text NOT NULL,
+	"products" text,
+	"color" text DEFAULT 'zinc' NOT NULL,
+	"sort_order" integer DEFAULT 0 NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "provider_setup_providers_name_check" CHECK (length(btrim("name")) > 0),
+	CONSTRAINT "provider_setup_providers_color_check" CHECK ("color" IN ('orange','green','blue','violet','pink','sky','amber','zinc'))
+);
+--> statement-breakpoint
+CREATE INDEX "provider_setup_entries_provider_idx" ON "ai"."provider_setup_entries" ("provider_id","section","sort_order");--> statement-breakpoint
+CREATE UNIQUE INDEX "provider_setup_providers_name_key" ON "ai"."provider_setup_providers" ("name");--> statement-breakpoint
+ALTER TABLE "ai"."provider_setup_entries" ADD CONSTRAINT "provider_setup_entries_JxI1C1Zk458j_fkey" FOREIGN KEY ("provider_id") REFERENCES "ai"."provider_setup_providers"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+--> statement-breakpoint
+-- Seed the provider cards (owner edits them on /trackers/ai/setup). Entries are added there.
+INSERT INTO "ai"."provider_setup_providers" ("name", "products", "color", "sort_order") VALUES
+	('Claude', 'claude.ai + Claude Code', 'orange', 10),
+	('ChatGPT', 'ChatGPT + Codex', 'green', 20),
+	('Gemini', 'Gemini + Gemini CLI', 'blue', 30),
+	('Grok', 'Grok + Grok Bot', 'violet', 40),
+	('Copilot', 'GitHub Copilot', 'sky', 50)
+ON CONFLICT DO NOTHING;
+--> statement-breakpoint
+-- Same privacy as the rest of schema ai: app role only (default privileges already cover new
+-- tables; granted explicitly too). Grants only run on prod (migrations as `personal`).
+DO $$
+BEGIN
+  IF current_user = 'personal' AND EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'personal_app') THEN
+    GRANT SELECT, INSERT, UPDATE, DELETE ON "ai"."provider_setup_providers", "ai"."provider_setup_entries" TO personal_app;
+    GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ai TO personal_app;
+  END IF;
+END $$;