feat: implement permission-aware search baseline

src/govoplan_search/backend/migrations/versions/__init__.py

@@ -0,0 +1 @@
+"""Search migration revisions."""

src/govoplan_search/backend/migrations/versions/a1b2c3d4e5f6_v0114_search_baseline.py

@@ -0,0 +1,119 @@
+"""Create the built-in search index.
+
+Revision ID: a1b2c3d4e5f6
+Revises:
+Create Date: 2026-07-29
+"""
+
+from __future__ import annotations
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "a1b2c3d4e5f6"
+down_revision = None
+branch_labels = ("search",)
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "search_index_documents",
+        sa.Column("id", sa.String(length=36), nullable=False),
+        sa.Column("tenant_id", sa.String(length=36), nullable=False),
+        sa.Column("module_id", sa.String(length=100), nullable=False),
+        sa.Column("resource_type", sa.String(length=100), nullable=False),
+        sa.Column("resource_id", sa.String(length=255), nullable=False),
+        sa.Column("title", sa.String(length=500), nullable=False),
+        sa.Column("summary", sa.Text(), nullable=True),
+        sa.Column("body", sa.Text(), nullable=True),
+        sa.Column("keywords", sa.JSON(), nullable=False),
+        sa.Column("search_text", sa.Text(), nullable=False),
+        sa.Column("url", sa.String(length=1500), nullable=False),
+        sa.Column("visibility", sa.String(length=20), nullable=False),
+        sa.Column("external_reference", sa.JSON(), nullable=True),
+        sa.Column("metadata", sa.JSON(), nullable=False),
+        sa.Column("content_hash", sa.String(length=64), nullable=False),
+        sa.Column("indexed_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False),
+        sa.PrimaryKeyConstraint("id", name=op.f("pk_search_index_documents")),
+        sa.UniqueConstraint(
+            "tenant_id",
+            "module_id",
+            "resource_type",
+            "resource_id",
+            name="uq_search_document_resource",
+        ),
+    )
+    op.create_index(
+        "ix_search_document_scope",
+        "search_index_documents",
+        ["tenant_id", "module_id", "resource_type"],
+        unique=False,
+    )
+    op.create_index(
+        "ix_search_document_visibility",
+        "search_index_documents",
+        ["tenant_id", "visibility"],
+        unique=False,
+    )
+    for column in ("tenant_id", "module_id", "resource_type", "resource_id"):
+        op.create_index(
+            op.f(f"ix_search_index_documents_{column}"),
+            "search_index_documents",
+            [column],
+            unique=False,
+        )
+
+    op.create_table(
+        "search_index_acl_tokens",
+        sa.Column("id", sa.String(length=36), nullable=False),
+        sa.Column("document_id", sa.String(length=36), nullable=False),
+        sa.Column("token", sa.String(length=500), nullable=False),
+        sa.ForeignKeyConstraint(
+            ["document_id"],
+            ["search_index_documents.id"],
+            name=op.f(
+                "fk_search_index_acl_tokens_document_id_search_index_documents"
+            ),
+            ondelete="CASCADE",
+        ),
+        sa.PrimaryKeyConstraint("id", name=op.f("pk_search_index_acl_tokens")),
+        sa.UniqueConstraint(
+            "document_id",
+            "token",
+            name="uq_search_index_acl_document_token",
+        ),
+    )
+    op.create_index(
+        op.f("ix_search_index_acl_tokens_document_id"),
+        "search_index_acl_tokens",
+        ["document_id"],
+        unique=False,
+    )
+    op.create_index(
+        op.f("ix_search_index_acl_tokens_token"),
+        "search_index_acl_tokens",
+        ["token"],
+        unique=False,
+    )
+    op.create_index(
+        "ix_search_index_acl_token",
+        "search_index_acl_tokens",
+        ["token", "document_id"],
+        unique=False,
+    )
+
+    if op.get_bind().dialect.name == "postgresql":
+        op.execute(
+            "CREATE INDEX ix_search_document_fts "
+            "ON search_index_documents USING gin "
+            "(to_tsvector('simple', search_text))"
+        )
+
+
+def downgrade() -> None:
+    op.drop_table("search_index_acl_tokens")
+    op.drop_table("search_index_documents")