977c69c3de
Project deletion cascaded through saved keywords, rank tracking, and audits, and the endpoint had no role check (Codex security finding). Instead of gating a destructive delete, remove it: archiving stamps archived_at, hides the project everywhere (lists, project context, rank-check cron), and preserves all data. Archived projects can be restored from the Manage projects page. The restore input is named archivedProjectId because the global ensureUserMiddleware resolves any projectId in input data against active projects and would 404 before the handler runs.
3 lines
354 B
SQL
3 lines
354 B
SQL
DROP INDEX `projects_one_default_per_organization_idx`;--> statement-breakpoint
|
|
ALTER TABLE `projects` ADD `archived_at` text;--> statement-breakpoint
|
|
CREATE UNIQUE INDEX `projects_one_default_per_organization_idx` ON `projects` (`organization_id`) WHERE "projects"."name" = 'Default' AND "projects"."domain" IS NULL AND "projects"."archived_at" IS NULL; |