cloud.config_catalog

Schema: cloud
Table: cloud.config_catalog
Description: Master catalog of all known configuration keys. Each row defines one configuration variable: its code, data type, default value, and which levels of the hierarchy are allowed to override it.

Overview

• Column prefix: cck_
• Primary key: cck_key_id
• Referenced by: cloud.config_values_global, cloud.config_values_tenant, cloud.config_values_group, cloud.config_values_user

Columns

Column	Type	Null	Default	Description
cck_key_id	integer	NO	auto-increment	Internal surrogate primary key.
cck_code	varchar(100)	NO		Unique dotted code identifying the config key. Convention: category.subcategory.name (e.g. auth.password.min_length).
cck_category	varchar(100)	NO		Functional grouping for admin UI display (e.g. auth, ui, features, permissions, system, branding).
cck_label	varchar(255)	NO	''	Human-readable label shown in the admin interface.
cck_description	text	YES	NULL	Extended description of what this key controls.
cck_value_type	varchar(20)	NO		Data type of the value: bool, int, string, json.
cck_default_value	text	NO	''	System default. Used when no level provides an override. Always stored as a string; the application coerces it based on cck_value_type.
cck_allowed_values	text	YES	NULL	Validation hint. For enumerations: JSON array (e.g. ["light","dark"]). For numeric ranges: JSON object (e.g. {"min":6,"max":128}).
cck_allowed_levels	smallint	NO	15	Bitmask controlling which hierarchy levels may set an override value. See table below.
cck_is_sensitive	boolean	NO	false	When true, the resolved value is stripped from the login response and never sent to the client. Used for server-side-only keys (e.g. internal API secrets).
cck_is_active	boolean	NO	true	Soft-disable a key without deleting it. Inactive keys are ignored during resolution.
cck_sort_order	integer	NO	0	Display order within a category in the admin UI.
cck_created_at	timestamptz	NO	NOW()	Creation timestamp (UTC).
cck_updated_at	timestamptz	YES	NULL	Last modification timestamp (UTC).

cck_allowed_levels bitmask

Each bit enables a specific hierarchy level to set an override:

Bit	Value	Level
0	1	Global (system-wide, set by SuperAdmin)
1	2	Tenant (set by TenantAdmin for their tenant)
2	4	Group (set by TenantAdmin per HR group)
3	8	User (set by the user themselves or TenantAdmin)

Examples:

cck_allowed_levels	Binary	Meaning
1	0001	Global only — system policy, tenants cannot override
3	0011	Global + tenant
6	0110	Tenant + group (no global, no user)
12	1100	Group + user
14	1110	Tenant + group + user
15	1111	All levels

Constraints

• Primary key: pk_config_catalog → cck_key_id
• Unique: c_uk_cck_code → cck_code

Initial catalog entries (seed)

cck_code	Type	Default	Levels	Notes
auth.registration.enabled	bool	true	1	Whether self-registration is open. SuperAdmin only.
auth.password.min_length	int	8	3	Minimum password length. Tenant can raise but not lower.
auth.password.require_uppercase	bool	true	3
auth.password.require_digit	bool	true	3
auth.password.require_special	bool	false	3
system.maintenance_mode	bool	false	1	Puts the platform in maintenance mode. SuperAdmin only.
system.group_conflict_strategy	string	restrictive	3	How to resolve conflicts when a user matches multiple group overrides. permissive or restrictive.
features.ai_assistant	bool	false	3	Enables the embedded AI assistant for the tenant.
features.module.payroll	bool	true	3
features.module.recruitment	bool	true	3
branding.app_name	string	HR Studio	2	Display name shown in the UI header.
branding.primary_color	string	#2b5f60	6	Primary UI accent color.
ui.theme	string	light	14	Interface theme: light or dark.
ui.density	string	comfortable	12	UI density: compact, comfortable, spacious.
ui.sidebar_collapsed	bool	false	8	User preference for sidebar state.
ui.dashboard_layout	json	{}	8	User-specific dashboard widget layout (JSON).
permissions.section_visibility	json	{}	6	Role-based section visibility rules. Read by FieldMaskingService.
permissions.ai_topics	json	{}	6	Topics the AI assistant must not discuss for restricted roles.

Related tables

• cloud.config_values_global — system-wide overrides
• cloud.config_values_tenant — per-tenant overrides
• cloud.config_values_group — per-HR-group overrides
• cloud.config_values_user — per-user overrides