Add user identities and role read-permission migrations

- 0001: user_identities table for stable Microsoft (tid/oid) sign-in links
- 0002: idempotent data migration granting the new read permissions
  (conversations.read, contacts.read, tasks.read, contacts.view) to existing roles
- Refuse accepting invitations while impersonating a user

Author: danielehrhardt

drizzle/0001_user_identities.sql

@@ -0,0 +1,13 @@
+CREATE TABLE "user_identities" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"user_id" uuid NOT NULL,
+	"provider" text NOT NULL,
+	"subject" text NOT NULL,
+	"email" text,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"last_used_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "user_identities" ADD CONSTRAINT "user_identities_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "user_identities_subject_idx" ON "user_identities" USING btree ("provider","subject");--> statement-breakpoint
+CREATE INDEX "user_identities_user_idx" ON "user_identities" USING btree ("user_id");

drizzle/0002_role_read_permissions.sql

@@ -0,0 +1,16 @@
+-- Read permissions introduced in v1.0.0 (API key scopes, shared address book visibility).
+-- Idempotent: appends only the permissions a role doesn't have yet, keeping array order.
+UPDATE "roles" SET "permissions" = "permissions" || ARRAY(
+  SELECT p FROM unnest(ARRAY['conversations.read', 'contacts.read', 'tasks.read', 'contacts.view']) p WHERE p <> ALL("permissions")
+) WHERE "key" IN ('owner', 'admin', 'member');
+--> statement-breakpoint
+UPDATE "roles" SET "permissions" = "permissions" || ARRAY(
+  SELECT p FROM unnest(ARRAY['conversations.read']) p WHERE p <> ALL("permissions")
+) WHERE "key" = 'guest';
+--> statement-breakpoint
+-- Custom roles keep what they could read; the full shared address book stays visible to roles that manage contacts or see all inboxes.
+UPDATE "roles" SET "permissions" = "permissions" || ARRAY(
+  SELECT p FROM unnest(ARRAY['conversations.read', 'contacts.read', 'tasks.read']
+    || CASE WHEN "permissions" && ARRAY['contacts.manage', 'conversations.view_all'] THEN ARRAY['contacts.view'] ELSE ARRAY[]::text[] END) p
+  WHERE p <> ALL("permissions")
+) WHERE "key" IS NULL OR "key" NOT IN ('owner', 'admin', 'member', 'guest');