feat(structures): add Region/Delegation/Structure schema + seed (ADR-0027 PR 1)

Schema (Prisma): three new public-schema models per ADR-0027 - Region (INSEE code PK), Delegation (dept code PK + regionCode FK), Structure (portal-internal code PK + kind discriminator + nullable unique finess/siret/codePaie + nullable delegationCode FK). Migration: hand-written, matches the style of init_audit_schema and users_directory. DDL + CHECK constraint on Structure.kind mirroring STRUCTURE_KINDS + indexes + inline seed (Region 75 Nouvelle-Aquitaine, Delegation 33 Gironde, structures 0330800013 + 0330800021 medico-social Bordeaux/Merignac + siege APF national). Seed is the minimum the 19 test-tenant personas reference; ADR-0029's cascade sync supersedes it when it ships. Catalogue (TypeScript): apps/portal-bff/src/structures/structure-kind.ts exports STRUCTURE_KINDS as const + StructureKind type union + isStructureKind type guard. Jest spec covers catalogue content, type guard, narrowing. Drift gate: extended to scan property-literal "kind: 'X'" expressions in files that import from structure-kind.ts. Three-layer defense in depth for Structure.kind = TS type union + Postgres CHECK + CI gate. 22 spec tests passing. No consumer code yet - PrismaScopeResolver that dereferences Structure.code from UserScope.value lives in ADR-0026 PR 2, which depends on this PR landing first. Reviewer heads-up: schema.prisma already has a User model (ADR-0020 user-directory cache); ADR-0026 PR 1 introduces a different User (UUID PK + Person FK). Naming collision flagged for that PR to resolve - not touched here.
2026-05-26 11:12:19 +02:00
parent 670f6303fe
commit 9695c9080b
6 changed files with 515 additions and 9 deletions
@@ -0,0 +1,117 @@
+-- Organisational hierarchy (per ADR-0027).
+--
+-- Region → Delegation → Structure. The portal's ADR-0025 scope-axis
+-- dereferences these three layers — the BFF guard
+-- `principalCoversResource` walks etablissement → delegation → region
+-- to decide whether a scope covers a resource. The schema lives in
+-- the public schema; ADR-0029 will populate the full APF inventory
+-- via the cascade sync, additively into the columns defined here.
+--
+-- Inline seed at the bottom of this file: just the codes the
+-- test tenant exercises (Région Nouvelle-Aquitaine, Délégation
+-- Gironde, two médico-social structures + the APF national siège).
+-- Superseded — not extended — by ADR-0029's cascade sync once it
+-- ships.
+
+-- CreateTable
+CREATE TABLE "regions" (
+    "code" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+
+    CONSTRAINT "regions_pkey" PRIMARY KEY ("code")
+);
+
+-- CreateTable
+CREATE TABLE "delegations" (
+    "code" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "region_code" TEXT NOT NULL,
+
+    CONSTRAINT "delegations_pkey" PRIMARY KEY ("code")
+);
+
+-- Closed-set CHECK on Structure.kind. Mirrors STRUCTURE_KINDS in
+-- apps/portal-bff/src/structures/structure-kind.ts. The CI drift gate
+-- (scripts/check-catalogue-drift.mjs) asserts the TS constant matches
+-- the values used in code; this CHECK constraint provides the
+-- equivalent guarantee at the DB layer for any code path that
+-- bypasses the type system.
+CREATE TABLE "structures" (
+    "code" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "kind" TEXT NOT NULL,
+    "finess" TEXT,
+    "siret" TEXT,
+    "code_paie" TEXT,
+    "delegation_code" TEXT,
+
+    CONSTRAINT "structures_pkey" PRIMARY KEY ("code"),
+    CONSTRAINT "structures_kind_check" CHECK (
+      "kind" IN (
+        'medico_social',
+        'antenne',
+        'dispositif',
+        'entreprise_adaptee',
+        'mouvement',
+        'administratif',
+        'siege'
+      )
+    )
+);
+
+-- CreateIndex
+CREATE INDEX "delegations_region_code_idx" ON "delegations"("region_code");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "structures_finess_key" ON "structures"("finess");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "structures_siret_key" ON "structures"("siret");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "structures_code_paie_key" ON "structures"("code_paie");
+
+-- CreateIndex
+CREATE INDEX "structures_kind_idx" ON "structures"("kind");
+
+-- CreateIndex
+CREATE INDEX "structures_delegation_code_idx" ON "structures"("delegation_code");
+
+-- AddForeignKey
+ALTER TABLE "delegations" ADD CONSTRAINT "delegations_region_code_fkey"
+    FOREIGN KEY ("region_code") REFERENCES "regions"("code")
+    ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "structures" ADD CONSTRAINT "structures_delegation_code_fkey"
+    FOREIGN KEY ("delegation_code") REFERENCES "delegations"("code")
+    ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- ------------------------------------------------------------------
+-- Test-tenant reference seed (per ADR-0027 §"Seeding posture").
+--
+-- Region Nouvelle-Aquitaine + Délégation Gironde + the structures
+-- referenced by the 19 personas in notes/test-tenant-role-assignments.md:
+--   - 0330800013 (APF Bordeaux, FINESS = code)
+--   - 0330800021 (Complexe Mérignac, FINESS = code)
+--   - 'siege' (APF national headquarters)
+--
+-- Cascade-sync (ADR-0029) supersedes this seed entirely when it
+-- ships — the cleanup migration responsible for that truncates and
+-- repopulates from cascade's authoritative inventory.
+-- ------------------------------------------------------------------
+
+INSERT INTO "regions" ("code", "name") VALUES
+    ('75', 'Nouvelle-Aquitaine');
+
+INSERT INTO "delegations" ("code", "name", "region_code") VALUES
+    ('33', 'Gironde', '75');
+
+INSERT INTO "structures" ("code", "name", "kind", "finess", "delegation_code") VALUES
+    ('0330800013', 'APF Bordeaux', 'medico_social', '0330800013', '33'),
+    ('0330800021', 'Complexe Mérignac', 'medico_social', '0330800021', '33');
+
+-- Siège has no delegation parent and no FINESS/SIRET/codePaie (those
+-- columns stay NULL — the unique indexes tolerate multiple NULLs).
+INSERT INTO "structures" ("code", "name", "kind") VALUES
+    ('siege', 'Siège APF France handicap', 'siege');
@@ -100,6 +100,94 @@ model User {
  @@index([username])
 }

+// ============================================================
+// Organisational hierarchy (per ADR-0027)
+// ============================================================
+//
+// Region → Delegation → Structure. The portal's scope-axis
+// dereferences these three layers — the BFF guard
+// `principalCoversResource` walks etablissement → delegation →
+// region to decide whether a scope covers a resource (per
+// ADR-0025).
+//
+// Population in v1: a small inline seed in the
+// `add_org_hierarchy` migration (the codes the test tenant
+// exercises). The full APF inventory ships with ADR-0029's
+// cascade sync, which writes additively into these columns —
+// no schema churn at sync time.
+
+model Region {
+  // INSEE region code (2 digits — '75' Nouvelle-Aquitaine,
+  // '11' Île-de-France). Externally meaningful and stable
+  // across reorgs; doubles as primary key.
+  code String @id
+  name String
+
+  delegations Delegation[]
+
+  @@map("regions")
+  @@schema("public")
+}
+
+model Delegation {
+  // French department code (2-3 chars — '33' Gironde, '2A',
+  // '971'). Same rationale as Region.code.
+  code String @id
+  name String
+
+  regionCode String @map("region_code")
+  region     Region @relation(fields: [regionCode], references: [code])
+
+  structures Structure[]
+
+  @@map("delegations")
+  @@schema("public")
+  @@index([regionCode])
+}
+
+model Structure {
+  // Portal-internal stable code, externally meaningful. For
+  // medico-social structures: code = FINESS (9 digits). For
+  // non-medico-social: APF-internal slug ('siege',
+  // 'apf-bdx-merignac', 'ea-toulouse', …). Opaque at the type
+  // level; matching is string equality, not parsing.
+  code String @id
+  name String
+
+  // Closed set, drift-gated. Legal values are tracked in
+  // `apps/portal-bff/src/structures/structure-kind.ts` and
+  // mirrored by a Postgres CHECK constraint on this column
+  // (see the migration). `scripts/check-catalogue-drift.mjs`
+  // asserts the TS constant matches the values used in code.
+  kind String
+
+  // FINESS (9 digits). NULL for non-medico-social structures.
+  // Unique when present. Cascade's StructureSourceFiness is
+  // the long-term authoritative carrier; the portal denormalises
+  // it inline here for v1 scope-axis checks. ADR-0029's sync
+  // owns the write path.
+  finess String? @unique
+
+  // SIRET (14 chars: 9 SIREN + 5 NIC). NULL when the structure
+  // is not SIRENE-registered (most antennes, dispositifs).
+  // Unique when present.
+  siret String? @unique
+
+  // Pléiades payroll code (6 chars). NULL in v1 — populated by
+  // ADR-0029's Pléiades sync once it ships.
+  codePaie String? @unique @map("code_paie")
+
+  // Parent delegation. NULL for structures not attached to one
+  // (siège, mouvement national, …).
+  delegationCode String?     @map("delegation_code")
+  delegation     Delegation? @relation(fields: [delegationCode], references: [code])
+
+  @@map("structures")
+  @@schema("public")
+  @@index([kind])
+  @@index([delegationCode])
+}
+
 model AuditEvent {
  id          String        @id @default(uuid()) @db.Uuid
  createdAt   DateTime      @default(now()) @map("created_at") @db.Timestamptz(6)
@@ -0,0 +1,45 @@
+import { isStructureKind, STRUCTURE_KINDS, type StructureKind } from './structure-kind';
+
+describe('STRUCTURE_KINDS', () => {
+  it('contains the seven cascade-aligned kinds per ADR-0027', () => {
+    expect(STRUCTURE_KINDS).toEqual([
+      'medico_social',
+      'antenne',
+      'dispositif',
+      'entreprise_adaptee',
+      'mouvement',
+      'administratif',
+      'siege',
+    ]);
+  });
+
+  it('has no duplicate entries', () => {
+    expect(new Set(STRUCTURE_KINDS).size).toBe(STRUCTURE_KINDS.length);
+  });
+});
+
+describe('isStructureKind', () => {
+  it('returns true for every catalogue value', () => {
+    for (const kind of STRUCTURE_KINDS) {
+      expect(isStructureKind(kind)).toBe(true);
+    }
+  });
+
+  it('returns false for values outside the catalogue', () => {
+    // common typos / cascade kinds not adopted by the portal
+    expect(isStructureKind('medical_social')).toBe(false);
+    expect(isStructureKind('sanitaire')).toBe(false); // cascade has it, portal doesn't ship it in v1
+    expect(isStructureKind('autre')).toBe(false); // escape hatch deliberately excluded
+    expect(isStructureKind('')).toBe(false);
+    expect(isStructureKind('Medico_Social')).toBe(false); // case-sensitive
+  });
+
+  it('narrows the type at the call site', () => {
+    const candidate: string = 'medico_social';
+    if (!isStructureKind(candidate)) {
+      throw new Error('unreachable — candidate is a known kind');
+    }
+    const narrowed: StructureKind = candidate;
+    expect(narrowed).toBe('medico_social');
+  });
+});
@@ -0,0 +1,36 @@
+/**
+ * Closed-set catalogue for `Structure.kind` per
+ * [ADR-0027 §"Confirmation"](../../../../../docs/decisions/0027-portal-side-organisational-hierarchy.md).
+ *
+ * Three enforcement layers stack here (defense-in-depth, same posture
+ * as ADR-0025's `Privilege` / `FunctionalRole` catalogues):
+ *
+ *   1. TypeScript type union `StructureKind` — compile-time check at
+ *      every assignment / function call that uses the typed reference.
+ *   2. Postgres `CHECK` constraint in the `add_org_hierarchy` migration
+ *      — runtime enforcement at INSERT / UPDATE time, defends against
+ *      any code path that bypasses the type system (raw SQL, casts,
+ *      future API endpoints with untrusted input).
+ *   3. `scripts/check-catalogue-drift.mjs` — CI gate asserting every
+ *      `kind: 'X'` literal in files that import this module is in the
+ *      catalogue.
+ *
+ * Cascade's `Structure.type` discriminator is the source of the
+ * vocabulary; the portal preserves cascade's spelling so the future
+ * cascade sync (ADR-0029) writes additively without translation.
+ */
+export const STRUCTURE_KINDS = [
+  'medico_social',
+  'antenne',
+  'dispositif',
+  'entreprise_adaptee',
+  'mouvement',
+  'administratif',
+  'siege',
+] as const;
+
+export type StructureKind = (typeof STRUCTURE_KINDS)[number];
+
+export function isStructureKind(value: string): value is StructureKind {
+  return (STRUCTURE_KINDS as readonly string[]).includes(value);
+}