Rework avatars.

Now we have a concept of an avatar at the server, realm, and scene level
and we have the groundwork for a realm store. New uesrs no longer props,
they get a default avatar. New system supports gender
{male,female,neutral} and {child,adult}.

db/schema/policies/001_rls.sql

@@ -79,6 +79,29 @@ CREATE POLICY server_props_delete ON server.props
 GRANT SELECT ON server.props TO chattyness_app;
 GRANT INSERT, UPDATE, DELETE ON server.props TO chattyness_app;
 
+-- server.avatars
+ALTER TABLE server.avatars ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY server_avatars_select ON server.avatars
+    FOR SELECT TO chattyness_app
+    USING (true);
+
+CREATE POLICY server_avatars_insert ON server.avatars
+    FOR INSERT TO chattyness_app
+    WITH CHECK (public.is_server_admin());
+
+CREATE POLICY server_avatars_update ON server.avatars
+    FOR UPDATE TO chattyness_app
+    USING (public.is_server_admin())
+    WITH CHECK (public.is_server_admin());
+
+CREATE POLICY server_avatars_delete ON server.avatars
+    FOR DELETE TO chattyness_app
+    USING (public.is_server_admin());
+
+GRANT SELECT ON server.avatars TO chattyness_app;
+GRANT INSERT, UPDATE, DELETE ON server.avatars TO chattyness_app;
+
 -- server.audio
 ALTER TABLE server.audio ENABLE ROW LEVEL SECURITY;
 
@@ -350,6 +373,12 @@ CREATE POLICY auth_active_avatars_view ON auth.active_avatars
     FOR SELECT TO chattyness_app
     USING (true);
 
+-- Allow realm moderators to update forced avatar columns on any user in their realm
+CREATE POLICY auth_active_avatars_mod ON auth.active_avatars
+    FOR UPDATE TO chattyness_app
+    USING (public.is_realm_moderator(realm_id))
+    WITH CHECK (public.is_realm_moderator(realm_id));
+
 GRANT SELECT, INSERT, UPDATE, DELETE ON auth.active_avatars TO chattyness_app;
 
 -- =============================================================================
@@ -507,6 +536,30 @@ CREATE POLICY realm_props_modify ON realm.props
 
 GRANT SELECT, INSERT, UPDATE, DELETE ON realm.props TO chattyness_app;
 
+-- realm.avatars
+ALTER TABLE realm.avatars ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY realm_avatars_select ON realm.avatars
+    FOR SELECT TO chattyness_app
+    USING (
+        public.has_realm_membership(realm_id)
+        OR public.is_server_admin()
+    );
+
+CREATE POLICY realm_avatars_modify ON realm.avatars
+    FOR ALL TO chattyness_app
+    USING (
+        EXISTS (
+            SELECT 1 FROM realm.memberships m
+            WHERE m.realm_id = realm.avatars.realm_id
+            AND m.user_id = public.current_user_id()
+            AND m.role IN ('owner', 'builder')
+        )
+        OR public.is_server_admin()
+    );
+
+GRANT SELECT, INSERT, UPDATE, DELETE ON realm.avatars TO chattyness_app;
+
 -- realm.reports
 ALTER TABLE realm.reports ENABLE ROW LEVEL SECURITY;