feat: filter member challenges by resource role

Author: jmgasper

README.md

@@ -341,6 +341,17 @@ Refer to the verification document `Verification.md`
   bypass. Any update that starts in or transitions to a completed or cancelled status cannot change
   the effective `is_test_challenge` value; omitting metadata preserves it. Normal authorization
   checks still apply.
+- Role-specific member competition searches use
+  `GET /v6/challenges?memberId={memberId}&resourceRoleId={resourceRoleUuid}`.
+  `resourceRoleId` is an exact UUID and requires `memberId`. The resource role is
+  applied before all challenge filters, global sorting, totals, and pagination;
+  omitting it preserves the existing any-resource behavior of `memberId`. This
+  public query only narrows results and never grants access: anonymous callers
+  retain anonymous visibility, and authenticated callers remain subject to
+  whitelist, group, and task rules based on the caller. For “My competitions,”
+  pass the configured Submitter resource-role UUID. Deploy migration
+  `20260813130000_add_role_to_member_access_view` before this service version,
+  because the generated Prisma client expects the view's new `roleId` column.
 - API base configuration points to v6 in dev/local and v5 in prod (for compatibility):
   - Dev: `work-manager/config/constants/development.js`.
   - Local: `work-manager/config/constants/local.js`.

docs/swagger.yaml

@@ -53,6 +53,12 @@ paths:
         - Challenges
       description: |
         Retrieve challenges in the system.
+
+        `resourceRoleId` may be combined with `memberId` to restrict the member's
+        resource-associated challenges to one UUID resource role before challenge
+        filtering, sorting, totals, and pagination. It does not grant access: results
+        remain subject to the caller's whitelist, group, and task visibility. Anonymous
+        callers receive only challenges visible to anonymous users.
       security:
         - bearer: []
       produces:
@@ -354,6 +360,12 @@ paths:
           description: Filter challenges memberId has access to
           required: false
           type: string
+        - name: resourceRoleId
+          in: query
+          description: Filter the member resource association by exact resource-role UUID. Requires memberId. This only narrows results and does not grant challenge access.
+          required: false
+          type: string
+          format: UUID
         - name: sortBy
           in: query
           description: Sort the results by the field.

packages/challenge-prisma-client/generated/edge.js

@@ -490,7 +490,8 @@ exports.Prisma.TimelineTemplatePhaseScalarFieldEnum = {
 
 exports.Prisma.MemberChallengeAccessScalarFieldEnum = {
   challengeId: 'challengeId',
-  memberId: 'memberId'
+  memberId: 'memberId',
+  roleId: 'roleId'
 };
 
 exports.Prisma.SortOrder = {
@@ -756,7 +757,8 @@ exports.Prisma.TimelineTemplatePhaseOrderByRelevanceFieldEnum = {
 
 exports.Prisma.MemberChallengeAccessOrderByRelevanceFieldEnum = {
   challengeId: 'challengeId',
-  memberId: 'memberId'
+  memberId: 'memberId',
+  roleId: 'roleId'
 };
 exports.ChallengeStatusEnum = exports.$Enums.ChallengeStatusEnum = {
   NEW: 'NEW',

packages/challenge-prisma-client/generated/index-browser.js

@@ -35004,33 +35004,39 @@ export namespace Prisma {
   export type MemberChallengeAccessMinAggregateOutputType = {
     challengeId: string | null
     memberId: string | null
+    roleId: string | null
   }
 
   export type MemberChallengeAccessMaxAggregateOutputType = {
     challengeId: string | null
     memberId: string | null
+    roleId: string | null
   }
 
   export type MemberChallengeAccessCountAggregateOutputType = {
     challengeId: number
     memberId: number
+    roleId: number
     _all: number
   }
 
 
   export type MemberChallengeAccessMinAggregateInputType = {
     challengeId?: true
     memberId?: true
+    roleId?: true
   }
 
   export type MemberChallengeAccessMaxAggregateInputType = {
     challengeId?: true
     memberId?: true
+    roleId?: true
   }
 
   export type MemberChallengeAccessCountAggregateInputType = {
     challengeId?: true
     memberId?: true
+    roleId?: true
     _all?: true
   }
 
@@ -35103,6 +35109,7 @@ export namespace Prisma {
   export type MemberChallengeAccessGroupByOutputType = {
     challengeId: string
     memberId: string
+    roleId: string
     _count: MemberChallengeAccessCountAggregateOutputType | null
     _min: MemberChallengeAccessMinAggregateOutputType | null
     _max: MemberChallengeAccessMaxAggregateOutputType | null
@@ -35125,6 +35132,7 @@ export namespace Prisma {
   export type MemberChallengeAccessSelect<ExtArgs extends $Extensions.InternalArgs = $Extensions.DefaultArgs> = $Extensions.GetSelect<{
     challengeId?: boolean
     memberId?: boolean
+    roleId?: boolean
     challenge?: boolean | ChallengeDefaultArgs<ExtArgs>
   }, ExtArgs["result"]["memberChallengeAccess"]>
 
@@ -35133,9 +35141,10 @@ export namespace Prisma {
   export type MemberChallengeAccessSelectScalar = {
     challengeId?: boolean
     memberId?: boolean
+    roleId?: boolean
   }
 
-  export type MemberChallengeAccessOmit<ExtArgs extends $Extensions.InternalArgs = $Extensions.DefaultArgs> = $Extensions.GetOmit<"challengeId" | "memberId", ExtArgs["result"]["memberChallengeAccess"]>
+  export type MemberChallengeAccessOmit<ExtArgs extends $Extensions.InternalArgs = $Extensions.DefaultArgs> = $Extensions.GetOmit<"challengeId" | "memberId" | "roleId", ExtArgs["result"]["memberChallengeAccess"]>
   export type MemberChallengeAccessInclude<ExtArgs extends $Extensions.InternalArgs = $Extensions.DefaultArgs> = {
     challenge?: boolean | ChallengeDefaultArgs<ExtArgs>
   }
@@ -35148,6 +35157,7 @@ export namespace Prisma {
     scalars: $Extensions.GetPayloadResult<{
       challengeId: string
       memberId: string
+      roleId: string
     }, ExtArgs["result"]["memberChallengeAccess"]>
     composites: {}
   }
@@ -35394,6 +35404,7 @@ export namespace Prisma {
   interface MemberChallengeAccessFieldRefs {
     readonly challengeId: FieldRef<"MemberChallengeAccess", 'String'>
     readonly memberId: FieldRef<"MemberChallengeAccess", 'String'>
+    readonly roleId: FieldRef<"MemberChallengeAccess", 'String'>
   }
 
 
@@ -36017,7 +36028,8 @@ export namespace Prisma {
 
   export const MemberChallengeAccessScalarFieldEnum: {
     challengeId: 'challengeId',
-    memberId: 'memberId'
+    memberId: 'memberId',
+    roleId: 'roleId'
   };
 
   export type MemberChallengeAccessScalarFieldEnum = (typeof MemberChallengeAccessScalarFieldEnum)[keyof typeof MemberChallengeAccessScalarFieldEnum]
@@ -36373,7 +36385,8 @@ export namespace Prisma {
 
   export const MemberChallengeAccessOrderByRelevanceFieldEnum: {
     challengeId: 'challengeId',
-    memberId: 'memberId'
+    memberId: 'memberId',
+    roleId: 'roleId'
   };
 
   export type MemberChallengeAccessOrderByRelevanceFieldEnum = (typeof MemberChallengeAccessOrderByRelevanceFieldEnum)[keyof typeof MemberChallengeAccessOrderByRelevanceFieldEnum]
@@ -38952,19 +38965,22 @@ export namespace Prisma {
     NOT?: MemberChallengeAccessWhereInput | MemberChallengeAccessWhereInput[]
     challengeId?: StringFilter<"MemberChallengeAccess"> | string
     memberId?: StringFilter<"MemberChallengeAccess"> | string
+    roleId?: StringFilter<"MemberChallengeAccess"> | string
     challenge?: XOR<ChallengeScalarRelationFilter, ChallengeWhereInput>
   }
 
   export type MemberChallengeAccessOrderByWithRelationInput = {
     challengeId?: SortOrder
     memberId?: SortOrder
+    roleId?: SortOrder
     challenge?: ChallengeOrderByWithRelationInput
     _relevance?: MemberChallengeAccessOrderByRelevanceInput
   }
 
   export type MemberChallengeAccessOrderByWithAggregationInput = {
     challengeId?: SortOrder
     memberId?: SortOrder
+    roleId?: SortOrder
     _count?: MemberChallengeAccessCountOrderByAggregateInput
     _max?: MemberChallengeAccessMaxOrderByAggregateInput
     _min?: MemberChallengeAccessMinOrderByAggregateInput
@@ -38976,6 +38992,7 @@ export namespace Prisma {
     NOT?: MemberChallengeAccessScalarWhereWithAggregatesInput | MemberChallengeAccessScalarWhereWithAggregatesInput[]
     challengeId?: StringWithAggregatesFilter<"MemberChallengeAccess"> | string
     memberId?: StringWithAggregatesFilter<"MemberChallengeAccess"> | string
+    roleId?: StringWithAggregatesFilter<"MemberChallengeAccess"> | string
   }
 
   export type ChallengeCreateInput = {
@@ -43727,16 +43744,19 @@ export namespace Prisma {
   export type MemberChallengeAccessCountOrderByAggregateInput = {
     challengeId?: SortOrder
     memberId?: SortOrder
+    roleId?: SortOrder
   }
 
   export type MemberChallengeAccessMaxOrderByAggregateInput = {
     challengeId?: SortOrder
     memberId?: SortOrder
+    roleId?: SortOrder
   }
 
   export type MemberChallengeAccessMinOrderByAggregateInput = {
     challengeId?: SortOrder
     memberId?: SortOrder
+    roleId?: SortOrder
   }
 
   export type ChallengeCreatecurrentPhaseNamesInput = {
@@ -46459,6 +46479,7 @@ export namespace Prisma {
     NOT?: MemberChallengeAccessWhereInput | MemberChallengeAccessWhereInput[]
     challengeId?: StringFilter<"MemberChallengeAccess"> | string
     memberId?: StringFilter<"MemberChallengeAccess"> | string
+    roleId?: StringFilter<"MemberChallengeAccess"> | string
     challenge?: XOR<ChallengeScalarRelationFilter, ChallengeWhereInput>
   }
 
@@ -47079,6 +47100,7 @@ export namespace Prisma {
     NOT?: MemberChallengeAccessScalarWhereInput | MemberChallengeAccessScalarWhereInput[]
     challengeId?: StringFilter<"MemberChallengeAccess"> | string
     memberId?: StringFilter<"MemberChallengeAccess"> | string
+    roleId?: StringFilter<"MemberChallengeAccess"> | string
   }
 
   export type ChallengeUserWhitelistUpsertWithWhereUniqueWithoutChallengeInput = {
@@ -53589,18 +53611,22 @@ export namespace Prisma {
 
   export type MemberChallengeAccessUpdateWithoutChallengeInput = {
     memberId?: StringFieldUpdateOperationsInput | string
+    roleId?: StringFieldUpdateOperationsInput | string
   }
 
   export type MemberChallengeAccessUncheckedUpdateWithoutChallengeInput = {
     memberId?: StringFieldUpdateOperationsInput | string
+    roleId?: StringFieldUpdateOperationsInput | string
   }
 
   export type MemberChallengeAccessUpdateManyMutationInput = {
     memberId?: StringFieldUpdateOperationsInput | string
+    roleId?: StringFieldUpdateOperationsInput | string
   }
 
   export type MemberChallengeAccessUncheckedUpdateManyWithoutChallengeInput = {
     memberId?: StringFieldUpdateOperationsInput | string
+    roleId?: StringFieldUpdateOperationsInput | string
   }
 
   export type ChallengeUserWhitelistUpdateWithoutChallengeInput = {

packages/challenge-prisma-client/generated/index.d.ts

@@ -1,5 +1,5 @@
 {
-  "name": "prisma-client-020e5b8aa8d9fb593e6af6a930afe7395f722f2688f5daee44b26029e9b8b643",
+  "name": "prisma-client-8f4b20580a6790c6032449023d392c74c8300c799da19bf2adf24a32fa5f9abf",
   "main": "index.js",
   "types": "index.d.ts",
   "browser": "default.js",

packages/challenge-prisma-client/generated/index.js

@@ -202,6 +202,7 @@ model ChallengeUserWhitelist {
 view MemberChallengeAccess {
   challengeId String
   memberId    String
+  roleId      String
 
   challenge Challenge @relation(fields: [challengeId], references: [id])
 

packages/challenge-prisma-client/generated/package.json

@@ -0,0 +1,33 @@
+-- Expose the resource role so member-scoped challenge searches can narrow the
+-- candidate challenge set before applying challenge filters and pagination.
+DROP VIEW IF EXISTS "challenges"."MemberChallengeAccess";
+
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM information_schema.tables
+    WHERE table_schema = 'resources'
+      AND table_name = 'Resource'
+  ) THEN
+    EXECUTE format(
+      'CREATE VIEW %I.%I AS
+          SELECT DISTINCT r."challengeId", r."memberId", r."roleId"
+          FROM resources."Resource" r
+          WHERE r."challengeId" IS NOT NULL
+            AND r."memberId" IS NOT NULL
+            AND r."roleId" IS NOT NULL',
+      current_schema(), 'MemberChallengeAccess'
+    );
+  ELSE
+    EXECUTE format(
+      'CREATE VIEW %I.%I AS
+          SELECT CAST(NULL AS TEXT) AS "challengeId",
+                 CAST(NULL AS TEXT) AS "memberId",
+                 CAST(NULL AS TEXT) AS "roleId"
+          WHERE FALSE',
+      current_schema(), 'MemberChallengeAccess'
+    );
+  END IF;
+END;
+$$;

packages/challenge-prisma-client/generated/schema.prisma

@@ -202,6 +202,7 @@ model ChallengeUserWhitelist {
 view MemberChallengeAccess {
   challengeId String
   memberId    String
+  roleId      String
 
   challenge Challenge @relation(fields: [challengeId], references: [id])