feat(admin): manage server updates and local configuration

services/api/internal/auth/pgstore.go

@@ -40,7 +40,7 @@ func (s *PgStore) WithTx(ctx context.Context, fn func(Store) error) error {
 
 const userColumns = `id, username, display_name, password_hash, role, locale, ui_prefs, must_change_password,
 	must_change_credentials, is_blocked, token_version, failed_login_count, locked_until, created_at, last_login_at,
-	reviews_uploads`
+	reviews_uploads, manages_updates`
 
 func scanUser(row pgx.Row) (User, error) {
 	var (
@@ -50,7 +50,7 @@ func scanUser(row pgx.Row) (User, error) {
 	)
 	err := row.Scan(&u.ID, &u.Username, &u.DisplayName, &u.PasswordHash, &role, &u.Locale, &prefs,
 		&u.MustChangePassword, &u.MustChangeCredentials, &u.IsBlocked, &u.TokenVersion, &u.FailedLoginCount,
-		&u.LockedUntil, &u.CreatedAt, &u.LastLoginAt, &u.ReviewsUploads)
+		&u.LockedUntil, &u.CreatedAt, &u.LastLoginAt, &u.ReviewsUploads, &u.ManagesUpdates)
 	if errors.Is(err, pgx.ErrNoRows) {
 		return User{}, ErrNotFound
 	}
@@ -82,10 +82,10 @@ func (s *PgStore) CreateUser(ctx context.Context, u User, createdBy *uuid.UUID)
 	}
 	_, err = s.q.Exec(ctx, `
 		INSERT INTO users (id, username, display_name, password_hash, role, locale, ui_prefs,
-			must_change_password, must_change_credentials, created_by, created_at, updated_at, reviews_uploads)
-		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $11, $12)`,
+			must_change_password, must_change_credentials, created_by, created_at, updated_at, reviews_uploads, manages_updates)
+		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $11, $12, $13)`,
 		u.ID, u.Username, u.DisplayName, u.PasswordHash, string(u.Role), u.Locale, prefs,
-		u.MustChangePassword, u.MustChangeCredentials, createdBy, u.CreatedAt, u.ReviewsUploads)
+		u.MustChangePassword, u.MustChangeCredentials, createdBy, u.CreatedAt, u.ReviewsUploads, u.ManagesUpdates)
 	if isUniqueViolation(err) {
 		return ErrUsernameTaken
 	}
@@ -347,10 +347,11 @@ func (s *PgStore) UpdateUser(ctx context.Context, id uuid.UUID, upd UserUpdate)
 			role = COALESCE($4::user_role, role),
 			is_blocked = COALESCE($5, is_blocked),
 			reviews_uploads = COALESCE($7, reviews_uploads),
+			manages_updates = COALESCE($9, manages_updates),
 			token_version = token_version + CASE WHEN $6 THEN 1 ELSE 0 END,
 			updated_at = now()
 		WHERE id = $1
-		RETURNING `+userColumns, id, setName, name, role, upd.IsBlocked, upd.RevokeTokens, upd.ReviewsUploads, upd.Username))
+		RETURNING `+userColumns, id, setName, name, role, upd.IsBlocked, upd.RevokeTokens, upd.ReviewsUploads, upd.Username, upd.ManagesUpdates))
 	if isUniqueViolation(err) {
 		return User{}, ErrUsernameTaken
 	}