@acornly/adapter-supabase 0.1.0 → 0.2.1

package/supabase/migrations/20261011080000_acornly_delete_node_grants.sql

@@ -0,0 +1,10 @@
+-- Only signed-in callers (and the service role) may run `acornly_delete_node`,
+-- as the threads migration meant.
+--
+-- That migration revoked it from `public` and granted it to `authenticated`
+-- and `service_role`, but Supabase's default privileges give `anon` its own
+-- grant on every function created in `public`, and revoking from `public`
+-- leaves that grant in place. A visitor could not delete anything with it,
+-- since only a note's creator may and every note has one, but the function
+-- should refuse them before it looks a note up.
+revoke execute on function public.acornly_delete_node(text, integer, text) from anon;

package/supabase/migrations/20261011150000_acornly_parent_ids.sql

@@ -0,0 +1,53 @@
+-- A reply's target may name its parent under `urn:acornly:annotation:` as well as
+-- `urn:contexthive:annotation:` (docs/design/acornly-rename.md, phase 3). Without this, a reply
+-- written by a version of core that uses the new prefix is refused (CH001: thread fields on a note
+-- that targets a page).
+--
+-- create or replace keeps the function's owner and grants.
+create or replace function acornly_private.parent_id_of(source text)
+returns text
+language plpgsql
+stable
+set search_path = ''
+as $$
+declare
+  prefix text;
+  encoded text;
+  decoded text;
+begin
+  prefix := case
+    when lower(left(source, 23)) = 'urn:acornly:annotation:' then 'urn:acornly:annotation:'
+    when lower(left(source, 27)) = 'urn:contexthive:annotation:' then 'urn:contexthive:annotation:'
+  end;
+  if prefix is null then
+    return null;
+  end if;
+  encoded := substr(source, length(prefix) + 1);
+  if encoded !~ '^([^%]|%[0-9A-Fa-f]{2})*$' then
+    raise exception 'target % is badly escaped', source using errcode = 'CH001';
+  end if;
+  begin
+    select convert_from(
+             coalesce(
+               string_agg(
+                 case when m[1] is not null
+                   then decode(substr(m[1], 2), 'hex')
+                   else convert_to(m[2], 'UTF8')
+                 end,
+                 ''::bytea order by n
+               ),
+               ''::bytea
+             ),
+             'UTF8'
+           )
+      into decoded
+      from regexp_matches(encoded, '(%[0-9A-Fa-f]{2})|([^%]+)', 'g') with ordinality as t (m, n);
+  exception when character_not_in_repertoire or untranslatable_character then
+    raise exception 'target % is badly escaped', source using errcode = 'CH001';
+  end;
+  if decoded = '' then
+    raise exception 'target % names an empty id', source using errcode = 'CH001';
+  end if;
+  return decoded;
+end
+$$;

package/supabase/migrations/20261011170000_acornly_pdf_document_keys.sql

@@ -0,0 +1,185 @@
+-- Notes on PDFs are listed by the file's key (#403).
+--
+-- A note on a PDF carries `ext.documentKey`, `urn:x-pdf:<fingerprint>` (see
+-- `pdfDocumentKey` in @acornly/core), and `target.source` keeps the URL it was
+-- made on, so the same file opened from another URL shows its notes. The
+-- `document` column now holds that key, as `documentKeyOf` reads it: the key
+-- when it is a valid PDF key, else `target.source`. Notes stored before keep
+-- their source as their document.
+--
+-- The key is set when a note is made and never changes: an update that leaves
+-- it out, or names another, gets the stored one back, and a note's
+-- `target.source` stays as before. A reply's document is still its target
+-- (whatever key it carries), and its parent is still read from it. Notes stored
+-- before with a key already in their annotation move to it below.
+
+-- `documentKeyOf` for a stored annotation. The trigger runs as its caller, so
+-- every role that writes notes may call it, as the other helpers it uses.
+create or replace function acornly_private.document_of(a jsonb)
+returns text
+language sql
+immutable
+set search_path = ''
+as $$
+  select case
+    when jsonb_typeof(a #> '{ext,documentKey}') = 'string'
+      and (a #>> '{ext,documentKey}') ~ '^urn:x-pdf:[0-9a-f]{2,128}$'
+      and (a #>> '{target,source}') !~* '^urn:(acornly|contexthive):annotation:'
+      then a #>> '{ext,documentKey}'
+    else a #>> '{target,source}'
+  end
+$$;
+
+revoke all on function acornly_private.document_of(jsonb) from public;
+grant execute on function acornly_private.document_of(jsonb)
+  to anon, authenticated, service_role;
+
+-- The write trigger on notes, from 20261010070000_acornly_names.sql with the
+-- document key.
+create or replace function acornly_private.prepare_annotation()
+returns trigger
+language plpgsql
+set search_path = ''
+as $$
+declare
+  a jsonb := new.annotation;
+  audience_kind text := a #>> '{ext,audience,kind}';
+  -- The site's own server code writing on a user's behalf.
+  trusted boolean := acornly_private.trusted_caller();
+begin
+  if jsonb_typeof(a -> 'id') is distinct from 'string'
+    or jsonb_typeof(a #> '{ext,scope}') is distinct from 'string'
+    or jsonb_typeof(a #> '{target,source}') is distinct from 'string'
+    or jsonb_typeof(a -> 'modified') is distinct from 'string'
+    -- ISO 8601 only, so no `infinity`, `now` or other special values.
+    or (a ->> 'modified') !~ '^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}(:?\d{2})?)$'
+    or coalesce(jsonb_typeof(a #> '{ext,threadRoot}'), 'null') not in ('string', 'null')
+  then
+    raise exception 'id, ext.scope and target.source must be strings, modified an ISO 8601 time, and ext.threadRoot a string or null'
+      using errcode = '23514';
+  end if;
+  if coalesce(jsonb_typeof(a #> '{ext,depth}'), 'null') not in ('number', 'null')
+    or coalesce(jsonb_typeof(a #> '{ext,parentRev}'), 'null') not in ('number', 'null')
+    or coalesce(jsonb_typeof(a #> '{ext,deleted}'), 'null') not in ('boolean', 'null')
+  then
+    raise exception 'ext.depth and ext.parentRev must be numbers and ext.deleted a boolean'
+      using errcode = '23514';
+  end if;
+
+  if tg_op = 'INSERT' then
+    if not trusted then
+      -- Clients cannot write this column; the author is always the caller.
+      new.creator_id := auth.uid();
+      if new.creator_id is null then
+        raise exception 'sign in to write notes' using errcode = '42501';
+      end if;
+    elsif new.creator_id is null then
+      raise exception 'creator_id is required' using errcode = '23502';
+    end if;
+    new.rev := 1;
+  else
+    new.creator_id := old.creator_id;
+    new.rev := old.rev + 1;
+    -- A note's document key never changes: the stored one, or none, stays.
+    a := case
+      when old.annotation #> '{ext,documentKey}' is null then a #- '{ext,documentKey}'
+      else jsonb_set(a, '{ext,documentKey}', old.annotation #> '{ext,documentKey}')
+    end;
+  end if;
+
+  if audience_kind is null or audience_kind not in ('private', 'public') then
+    raise exception 'audience "%" is not supported here; use private or public', audience_kind
+      using errcode = '23514';
+  end if;
+
+  new.id := a ->> 'id';
+  new.scope := a #>> '{ext,scope}';
+  new.document := acornly_private.document_of(a);
+  new.audience := audience_kind;
+  new.thread_root_id := a #>> '{ext,threadRoot}';
+  -- The document never changes, so neither does the parent; notes stored
+  -- before this migration keep theirs (none) when edited.
+  new.parent_id := case
+    when tg_op = 'UPDATE' then old.parent_id
+    else acornly_private.parent_id_of(a #>> '{target,source}')
+  end;
+  new.modified := (a ->> 'modified')::timestamptz;
+  new.annotation := jsonb_set(a, '{ext,rev}', to_jsonb(new.rev));
+
+  if tg_op = 'INSERT' then
+    if acornly_private.is_deleted(a) then
+      raise exception 'a new annotation cannot be deleted' using errcode = 'CH001';
+    end if;
+    if new.parent_id is null then
+      if new.thread_root_id is not null
+        or a #> '{ext,depth}' is not null
+        or a #> '{ext,parentRev}' is not null
+      then
+        raise exception 'annotation % has thread fields but targets a page', new.id
+          using errcode = 'CH001';
+      end if;
+    else
+      perform acornly_private.check_child(
+        new.parent_id, a, new.scope, new.thread_root_id, new.audience
+      );
+    end if;
+    return new;
+  end if;
+
+  if new.id is distinct from old.id then
+    raise exception 'id cannot change' using errcode = '23514';
+  end if;
+  -- `acornly_delete_node` writing a placeholder.
+  if acornly_private.in_delete_node() then
+    return new;
+  end if;
+  if acornly_private.is_deleted(a) is distinct from acornly_private.is_deleted(old.annotation) then
+    raise exception 'annotation % is deleted or restored only by deleteNode', new.id
+      using errcode = 'CH001';
+  end if;
+  if acornly_private.is_deleted(old.annotation) then
+    raise exception 'annotation % is deleted', new.id using errcode = 'CH001';
+  end if;
+  if new.scope is distinct from old.scope
+    or new.document is distinct from old.document
+    or new.thread_root_id is distinct from old.thread_root_id
+    or a #> '{ext,depth}' is distinct from old.annotation #> '{ext,depth}'
+    or a #> '{ext,parentRev}' is distinct from old.annotation #> '{ext,parentRev}'
+    or (old.parent_id is not null and a -> 'target' is distinct from old.annotation -> 'target')
+    -- The document no longer says whether the source moved: a note on a PDF keeps its URL too.
+    or a #> '{target,source}' is distinct from old.annotation #> '{target,source}'
+  then
+    raise exception 'annotation % cannot move: id, scope, target.source and threadRoot cannot change',
+      new.id using errcode = 'CH001';
+  end if;
+  if a #> '{creator,id}' is distinct from old.annotation #> '{creator,id}'
+    and acornly_private.has_children(new.id)
+  then
+    raise exception 'annotation % has replies; its author stays', new.id using errcode = 'CH001';
+  end if;
+  -- An unchanged or narrower audience is fine even if the parent was narrowed
+  -- meanwhile. A wider one is checked against the parent, locked so a
+  -- concurrent narrowing cannot slip past; a reply from before threads nested
+  -- is checked against its root.
+  if new.thread_root_id is not null
+    and not acornly_private.audience_within(new.audience, old.audience)
+    and not acornly_private.audience_within(
+      new.audience,
+      acornly_private.locked_audience(coalesce(old.parent_id, old.thread_root_id))
+    )
+  then
+    raise exception 'annotation % cannot widen its parent''s audience', new.id
+      using errcode = 'CH002';
+  end if;
+  return new;
+end
+$$;
+
+-- Notes stored before this migration with a PDF key in their annotation (written
+-- after core gave notes keys) move to it. The write trigger would refuse the
+-- move, so it is off for this one statement.
+alter table public.acornly_annotations disable trigger acornly_annotations_prepare;
+update public.acornly_annotations
+   set document = acornly_private.document_of(annotation)
+ where document is distinct from acornly_private.document_of(annotation);
+alter table public.acornly_annotations enable trigger acornly_annotations_prepare;