Add more secure RLS policies on the sales table

[djhi]

Problem

The RLS policies on the sales table are very permissive. Any authenticated users can give themselves the administrator privilege.

Solution

• Add stricter policies:
  • Only admins can add new users
  • Only admins can delete users
  • Nobody can update sales directly
• Fix supabase functions so that simple users can only update their non security related data

How To Test

• Use the dev console to copy a user token and the api key from a postgrest call as a simple authenticated user
• Use a tool such as Bruno to send an authenticated POST request to the users endpoint (http://127.0.0.1:54321/functions/v1/users), trying to set the administrator and/or disabled columns to true. It should ignore security related changes. Example request body:

{
  "sales_id": 2,
  "first_name": "Toto",
  "last_name": "Totooooo",
  "email": "[email protected]",
  "administrator": true       ,
  "disabled": true
}

• Use a tool such as Bruno to send an authenticated POST request to the users endpoint (http://127.0.0.1:54321/functions/v1/users), trying to update another user (change the sales_id). It should fail with a 401.
• As this user, verify you can still update your own data either with Bruno or the admin UI
• As an admin, verify you can still update any user and change their security related options (admin, disabled)
• Check that no one can make PATCH requests to the sales endpoint (e.g. http://127.0.0.1:54321/rest/v1/sales?id=eq.2) using Bruno.

[fzaninotto]

It seems the ability to change the avatar for a sale is broken. Not sure if it's related to this change though.

Apart from that, my tests are OK.

[fzaninotto]

needs rebase