public.rbac_org_user_roles

Synced from docs/generated/erd/ — do not hand-edit.
Regenerate with bun run docs:erd (needs staging reader), then this script runs automatically.
Labels: docs/db/erd-table-labels.yml · Runbook: docs/runbooks/erd-schema-docs.md

Description

Org privilege grant — (contact_id x org_id) to an RBAC role; what is_org_admin() / is_org_staff() read — Not: organization_users (a seat, no privilege); user_roles (platform-wide) — See: docs/PLATFORM.md

Columns

Name	Type	Default	Nullable	Children	Parents	Comment
assigned_at	timestamp with time zone	now()	false
assigned_by	uuid		true		public.contacts
audience_class	text		false
contact_id	uuid		false		public.contacts
org_id	text		false		organizations
role_id	uuid		false		public.rbac_role_definitions

Viewpoints

Name	Definition
Identity, Tenancy & RBAC	Org tenancy, contacts/auth linking, seats (organization_users), and M-7 RBAC. Catalog §1. Seat holds presence only — privilege is rbac_org_user_roles, not organization_users.role_type (dropped). First review: contacts ↔ contact_auth ↔ organization_users ↔ rbac_*.

Constraints

Name	Type	Definition
rbac_org_user_roles_assigned_by_fkey	FOREIGN KEY	FOREIGN KEY (assigned_by) REFERENCES contacts(id) ON DELETE SET NULL
rbac_org_user_roles_contact_id_fkey	FOREIGN KEY	FOREIGN KEY (contact_id) REFERENCES contacts(id)
rbac_org_user_roles_org_id_fkey	FOREIGN KEY	FOREIGN KEY (org_id) REFERENCES organizations(id)
rbac_org_user_roles_pkey	PRIMARY KEY	PRIMARY KEY (org_id, contact_id)
rbac_org_user_roles_role_id_fkey	FOREIGN KEY	FOREIGN KEY (role_id) REFERENCES rbac_role_definitions(id)

Indexes

Name	Definition
idx_rbac_org_user_roles_contact	CREATE INDEX idx_rbac_org_user_roles_contact ON public.rbac_org_user_roles USING btree (contact_id)
rbac_org_user_roles_pkey	CREATE UNIQUE INDEX rbac_org_user_roles_pkey ON public.rbac_org_user_roles USING btree (org_id, contact_id)

Relations

erDiagram

"public.rbac_org_user_roles" }o--o| "public.contacts" : "FOREIGN KEY (assigned_by) REFERENCES contacts(id) ON DELETE SET NULL"
"public.rbac_org_user_roles" }o--|| "public.contacts" : "FOREIGN KEY (contact_id) REFERENCES contacts(id)"
"public.rbac_org_user_roles" }o--|| "public.organizations" : "FOREIGN KEY (org_id) REFERENCES organizations(id)"
"public.rbac_org_user_roles" }o--|| "public.rbac_role_definitions" : "FOREIGN KEY (role_id) REFERENCES rbac_role_definitions(id)"

"public.rbac_org_user_roles" {
  uuid assigned_by FK ""
  uuid contact_id FK ""
  text org_id FK ""
  uuid role_id FK ""
}
"public.contacts" {
  uuid id ""
  text primary_org_id FK ""
  text source_org_id FK ""
}
"public.organizations" {
  text association_id FK ""
  uuid default_approval_reviewer_contact_id FK "Org-level fallback reviewer for two-step send (#5698). Routing chain: the sender's own reviewer, then this, then all org admins. NULL means fall through to the admins, which is the pre-#5698 behaviour."
  text id ""
  text parent_org_id FK "#671 self-referencing hierarchy pointer. NULL = root org. Direct writes are blocked by trg_block_direct_parent_org_id_writes for every role except service_role/postgres/supabase_admin — the only write path for authenticated/interactive callers is public.reparent_organization(). Cycle-prevented by trg_prevent_org_hierarchy_cycle. #quot;Is association#quot; is derived (EXISTS a child), never stored."
}
"public.rbac_role_definitions" {
  uuid id ""
  text org_id FK ""
}

---

Generated by tbls