Roles audit and revamp

docsgpt/storage/db/models.py

@@ -187,6 +187,23 @@ Index(
     team_resource_grants_table.c.resource_id,
 )
 
+# Per-asset sharing switches set by the owner (migration 0038). A missing row
+# means every switch is at its default; keys are validated in
+# ``docsgpt/api/user/resource_access.py``.
+resource_share_settings_table = Table(
+    "resource_share_settings",
+    metadata,
+    Column("resource_type", Text, primary_key=True),
+    Column("resource_id", UUID(as_uuid=True), primary_key=True),
+    Column("settings", JSONB, nullable=False, server_default="{}"),
+    Column("updated_by", Text),
+    Column("updated_at", DateTime(timezone=True), nullable=False, server_default=func.now()),
+    CheckConstraint(
+        "resource_type IN ('agent', 'source', 'prompt', 'tool')",
+        name="resource_share_settings_type_check",
+    ),
+)
+
 
 prompts_table = Table(
     "prompts",
@@ -218,6 +235,22 @@ user_tools_table = Table(
     Column("legacy_mongo_id", Text),
 )
 
+# A grantee's personal "In my chats" switch for a tool shared with them
+# (migration 0038). The owner's own switch stays ``user_tools.status``.
+user_tool_preferences_table = Table(
+    "user_tool_preferences",
+    metadata,
+    Column("user_id", Text, primary_key=True),
+    Column(
+        "tool_id",
+        UUID(as_uuid=True),
+        ForeignKey("user_tools.id", ondelete="CASCADE"),
+        primary_key=True,
+    ),
+    Column("in_chat", Boolean, nullable=False, server_default="false"),
+    Column("updated_at", DateTime(timezone=True), nullable=False, server_default=func.now()),
+)
+
 token_usage_table = Table(
     "token_usage",
     metadata,