@bygghammar/cms-platform 0.11.0 → 0.12.0

package/migrations/20260728113741_f9744b19-078b-46e5-b00f-31c84aaf71ab.sql

@@ -0,0 +1,111 @@
+
+CREATE TYPE public.app_role AS ENUM ('admin', 'editor');
+
+CREATE TABLE public.user_roles (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id uuid NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+  role public.app_role NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (user_id, role)
+);
+GRANT SELECT ON public.user_roles TO authenticated;
+GRANT ALL ON public.user_roles TO service_role;
+ALTER TABLE public.user_roles ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "Users can view their own roles"
+  ON public.user_roles
+  FOR SELECT
+  TO authenticated
+  USING (auth.uid() = user_id);
+
+CREATE OR REPLACE FUNCTION public.has_role(_user_id uuid, _role public.app_role)
+RETURNS boolean
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT EXISTS (
+    SELECT 1 FROM public.user_roles
+    WHERE user_id = _user_id AND role = _role
+  )
+$$;
+
+CREATE TABLE public.content_sections (
+  key text PRIMARY KEY,
+  data jsonb NOT NULL DEFAULT '{}'::jsonb,
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  updated_by uuid REFERENCES auth.users(id) ON DELETE SET NULL
+);
+GRANT SELECT ON public.content_sections TO anon, authenticated;
+GRANT INSERT, UPDATE, DELETE ON public.content_sections TO authenticated;
+GRANT ALL ON public.content_sections TO service_role;
+ALTER TABLE public.content_sections ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "Anyone can read content sections"
+  ON public.content_sections
+  FOR SELECT
+  TO anon, authenticated
+  USING (true);
+
+CREATE POLICY "Admins can insert content sections"
+  ON public.content_sections
+  FOR INSERT
+  TO authenticated
+  WITH CHECK (public.has_role(auth.uid(), 'admin'));
+
+CREATE POLICY "Admins can update content sections"
+  ON public.content_sections
+  FOR UPDATE
+  TO authenticated
+  USING (public.has_role(auth.uid(), 'admin'))
+  WITH CHECK (public.has_role(auth.uid(), 'admin'));
+
+CREATE POLICY "Admins can delete content sections"
+  ON public.content_sections
+  FOR DELETE
+  TO authenticated
+  USING (public.has_role(auth.uid(), 'admin'));
+
+CREATE OR REPLACE FUNCTION public.touch_content_sections()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = public
+AS $$
+BEGIN
+  NEW.updated_at = now();
+  NEW.updated_by = auth.uid();
+  RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER content_sections_touch
+  BEFORE INSERT OR UPDATE ON public.content_sections
+  FOR EACH ROW EXECUTE FUNCTION public.touch_content_sections();
+
+CREATE OR REPLACE FUNCTION public.grant_initial_admin()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+BEGIN
+  IF NEW.email_confirmed_at IS NOT NULL
+     AND lower(NEW.email) = 'byggis@gmail.com' THEN
+    INSERT INTO public.user_roles (user_id, role)
+    VALUES (NEW.id, 'admin')
+    ON CONFLICT (user_id, role) DO NOTHING;
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER on_auth_user_created_grant_admin
+  AFTER INSERT ON auth.users
+  FOR EACH ROW EXECUTE FUNCTION public.grant_initial_admin();
+
+CREATE TRIGGER on_auth_user_confirmed_grant_admin
+  AFTER UPDATE OF email_confirmed_at ON auth.users
+  FOR EACH ROW
+  WHEN (OLD.email_confirmed_at IS NULL AND NEW.email_confirmed_at IS NOT NULL)
+  EXECUTE FUNCTION public.grant_initial_admin();

package/migrations/20260728113757_4156a886-21fb-4a1f-9c12-acb7bb145102.sql

@@ -0,0 +1,5 @@
+
+REVOKE ALL ON FUNCTION public.touch_content_sections() FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.grant_initial_admin() FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.has_role(uuid, public.app_role) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.has_role(uuid, public.app_role) TO authenticated;

package/migrations/20260728113823_6e0237e1-99e3-4e1a-8a68-804b7bcdbbb8.sql

@@ -0,0 +1 @@
+REVOKE EXECUTE ON FUNCTION public.has_role(uuid, public.app_role) FROM anon;

package/migrations/20260728115305_506d92b4-129f-4d2b-961f-cf76e592677e.sql

@@ -0,0 +1,92 @@
+-- Additive: per-page localized SEO overrides + slug-change redirects.
+-- Never touches customer submission data.
+
+CREATE TABLE public.page_seo (
+  page_key text PRIMARY KEY,
+  slugs jsonb NOT NULL DEFAULT '{}'::jsonb,      -- { sv: "boka", en: "book" }
+  seo jsonb NOT NULL DEFAULT '{}'::jsonb,        -- { sv: { title, description, ogImage, ... }, en: {...} }
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  updated_by uuid
+);
+
+GRANT SELECT ON public.page_seo TO anon, authenticated;
+GRANT INSERT, UPDATE, DELETE ON public.page_seo TO authenticated;
+GRANT ALL ON public.page_seo TO service_role;
+
+ALTER TABLE public.page_seo ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "Anyone can read page_seo"
+  ON public.page_seo FOR SELECT
+  TO anon, authenticated
+  USING (true);
+
+CREATE POLICY "Admins insert page_seo"
+  ON public.page_seo FOR INSERT
+  TO authenticated
+  WITH CHECK (has_role(auth.uid(), 'admin'::app_role));
+
+CREATE POLICY "Admins update page_seo"
+  ON public.page_seo FOR UPDATE
+  TO authenticated
+  USING (has_role(auth.uid(), 'admin'::app_role))
+  WITH CHECK (has_role(auth.uid(), 'admin'::app_role));
+
+CREATE POLICY "Admins delete page_seo"
+  ON public.page_seo FOR DELETE
+  TO authenticated
+  USING (has_role(auth.uid(), 'admin'::app_role));
+
+CREATE OR REPLACE FUNCTION public.touch_page_seo()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = public
+AS $$
+BEGIN
+  NEW.updated_at = now();
+  RETURN NEW;
+END;
+$$;
+
+REVOKE EXECUTE ON FUNCTION public.touch_page_seo() FROM public, anon;
+
+CREATE TRIGGER page_seo_touch
+  BEFORE UPDATE ON public.page_seo
+  FOR EACH ROW EXECUTE FUNCTION public.touch_page_seo();
+
+-- Slug-change redirects. Append-only from the app's perspective;
+-- edits/deletes require admin. Old URLs stay resolvable forever.
+CREATE TABLE public.redirects (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  from_path text NOT NULL UNIQUE,      -- e.g. "/boka"
+  to_path text NOT NULL,               -- e.g. "/bokning" or "/en/book"
+  status smallint NOT NULL DEFAULT 301,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  created_by uuid
+);
+
+GRANT SELECT ON public.redirects TO anon, authenticated;
+GRANT INSERT, UPDATE, DELETE ON public.redirects TO authenticated;
+GRANT ALL ON public.redirects TO service_role;
+
+ALTER TABLE public.redirects ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "Anyone can read redirects"
+  ON public.redirects FOR SELECT
+  TO anon, authenticated
+  USING (true);
+
+CREATE POLICY "Admins insert redirects"
+  ON public.redirects FOR INSERT
+  TO authenticated
+  WITH CHECK (has_role(auth.uid(), 'admin'::app_role));
+
+CREATE POLICY "Admins update redirects"
+  ON public.redirects FOR UPDATE
+  TO authenticated
+  USING (has_role(auth.uid(), 'admin'::app_role))
+  WITH CHECK (has_role(auth.uid(), 'admin'::app_role));
+
+CREATE POLICY "Admins delete redirects"
+  ON public.redirects FOR DELETE
+  TO authenticated
+  USING (has_role(auth.uid(), 'admin'::app_role));

package/migrations/20260728115320_717d4447-f433-4a1d-89d2-fc8f028d4ac6.sql

@@ -0,0 +1 @@
+REVOKE EXECUTE ON FUNCTION public.touch_page_seo() FROM authenticated;

package/migrations/20260728115347_c77f5a56-19db-4117-bb60-9ad692b817ab.sql

@@ -0,0 +1,11 @@
+CREATE OR REPLACE FUNCTION public.touch_page_seo()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY INVOKER
+SET search_path = public
+AS $$
+BEGIN
+  NEW.updated_at = now();
+  RETURN NEW;
+END;
+$$;

package/migrations/20260728132052_b692dcfe-a944-4a19-afd0-187f7600feb8.sql

@@ -0,0 +1,63 @@
+CREATE TABLE public.locale_domains (
+  locale text NOT NULL PRIMARY KEY,
+  domain text NOT NULL,
+  is_default boolean NOT NULL DEFAULT false,
+  is_admin_domain boolean NOT NULL DEFAULT false,
+  created_at timestamp with time zone NOT NULL DEFAULT now(),
+  updated_at timestamp with time zone NOT NULL DEFAULT now()
+);
+
+GRANT SELECT ON public.locale_domains TO anon;
+GRANT SELECT ON public.locale_domains TO authenticated;
+GRANT ALL ON public.locale_domains TO service_role;
+
+ALTER TABLE public.locale_domains ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "Anyone can read locale domains"
+  ON public.locale_domains
+  FOR SELECT
+  TO anon, authenticated
+  USING (true);
+
+CREATE POLICY "Only admins can insert locale domains"
+  ON public.locale_domains
+  FOR INSERT
+  TO authenticated
+  WITH CHECK (public.has_role(auth.uid(), 'admin'::public.app_role));
+
+CREATE POLICY "Only admins can update locale domains"
+  ON public.locale_domains
+  FOR UPDATE
+  TO authenticated
+  USING (public.has_role(auth.uid(), 'admin'::public.app_role))
+  WITH CHECK (public.has_role(auth.uid(), 'admin'::public.app_role));
+
+CREATE POLICY "Only admins can delete locale domains"
+  ON public.locale_domains
+  FOR DELETE
+  TO authenticated
+  USING (public.has_role(auth.uid(), 'admin'::public.app_role));
+
+CREATE OR REPLACE FUNCTION public.touch_locale_domains()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path TO 'public'
+AS $$
+BEGIN
+  NEW.updated_at = now();
+  RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER update_locale_domains_updated_at
+  BEFORE UPDATE ON public.locale_domains
+  FOR EACH ROW
+  EXECUTE FUNCTION public.touch_locale_domains();
+
+INSERT INTO public.locale_domains (locale, domain, is_default, is_admin_domain)
+VALUES ('sv', 'www.dev.barskola.nu', true, true)
+ON CONFLICT (locale) DO UPDATE SET
+  domain = EXCLUDED.domain,
+  is_default = EXCLUDED.is_default,
+  is_admin_domain = EXCLUDED.is_admin_domain,
+  updated_at = now();

package/migrations/20260728183318_05b05a47-ba05-4a66-ab8f-69f2688fea84.sql

@@ -0,0 +1,209 @@
+
+-- =========================================================
+-- PAGES
+-- =========================================================
+CREATE TABLE public.pages (
+  id uuid NOT NULL DEFAULT gen_random_uuid() PRIMARY KEY,
+  key text NOT NULL UNIQUE,
+  name text NOT NULL,
+  is_system boolean NOT NULL DEFAULT false,
+  status text NOT NULL DEFAULT 'draft',
+  current_version_id uuid,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  updated_by uuid
+);
+GRANT SELECT ON public.pages TO anon;
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.pages TO authenticated;
+GRANT ALL ON public.pages TO service_role;
+ALTER TABLE public.pages ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "Anyone can read pages" ON public.pages FOR SELECT USING (true);
+CREATE POLICY "Admins insert pages" ON public.pages FOR INSERT TO authenticated
+  WITH CHECK (has_role(auth.uid(),'admin'::app_role));
+CREATE POLICY "Admins update pages" ON public.pages FOR UPDATE TO authenticated
+  USING (has_role(auth.uid(),'admin'::app_role))
+  WITH CHECK (has_role(auth.uid(),'admin'::app_role));
+CREATE POLICY "Admins delete pages" ON public.pages FOR DELETE TO authenticated
+  USING (has_role(auth.uid(),'admin'::app_role) AND is_system = false);
+
+-- =========================================================
+-- PAGE VERSIONS
+-- =========================================================
+CREATE TABLE public.page_versions (
+  id uuid NOT NULL DEFAULT gen_random_uuid() PRIMARY KEY,
+  page_id uuid NOT NULL REFERENCES public.pages(id) ON DELETE CASCADE,
+  version_no integer NOT NULL,
+  blocks jsonb NOT NULL DEFAULT '[]'::jsonb,
+  note text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  created_by uuid,
+  UNIQUE (page_id, version_no)
+);
+GRANT SELECT ON public.page_versions TO anon;
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.page_versions TO authenticated;
+GRANT ALL ON public.page_versions TO service_role;
+ALTER TABLE public.page_versions ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "Anyone can read page_versions" ON public.page_versions FOR SELECT USING (true);
+CREATE POLICY "Admins insert page_versions" ON public.page_versions FOR INSERT TO authenticated
+  WITH CHECK (has_role(auth.uid(),'admin'::app_role));
+CREATE POLICY "Admins update page_versions" ON public.page_versions FOR UPDATE TO authenticated
+  USING (has_role(auth.uid(),'admin'::app_role))
+  WITH CHECK (has_role(auth.uid(),'admin'::app_role));
+CREATE POLICY "Admins delete page_versions" ON public.page_versions FOR DELETE TO authenticated
+  USING (has_role(auth.uid(),'admin'::app_role));
+
+ALTER TABLE public.pages
+  ADD CONSTRAINT pages_current_version_fk
+  FOREIGN KEY (current_version_id) REFERENCES public.page_versions(id) ON DELETE SET NULL;
+
+-- =========================================================
+-- PAGE PUBLICATIONS
+-- =========================================================
+CREATE TABLE public.page_publications (
+  id uuid NOT NULL DEFAULT gen_random_uuid() PRIMARY KEY,
+  page_id uuid NOT NULL REFERENCES public.pages(id) ON DELETE CASCADE,
+  version_id uuid NOT NULL REFERENCES public.page_versions(id) ON DELETE CASCADE,
+  publish_at timestamptz NOT NULL DEFAULT now(),
+  unpublish_at timestamptz,
+  is_active boolean NOT NULL DEFAULT true,
+  published_at timestamptz NOT NULL DEFAULT now(),
+  published_by uuid,
+  note text
+);
+CREATE INDEX page_publications_active_idx ON public.page_publications(page_id) WHERE is_active;
+GRANT SELECT ON public.page_publications TO anon;
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.page_publications TO authenticated;
+GRANT ALL ON public.page_publications TO service_role;
+ALTER TABLE public.page_publications ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "Anyone can read page_publications" ON public.page_publications FOR SELECT USING (true);
+CREATE POLICY "Admins manage page_publications" ON public.page_publications FOR ALL TO authenticated
+  USING (has_role(auth.uid(),'admin'::app_role))
+  WITH CHECK (has_role(auth.uid(),'admin'::app_role));
+
+-- =========================================================
+-- GLOBAL SECTIONS
+-- =========================================================
+CREATE TABLE public.global_sections (
+  id uuid NOT NULL DEFAULT gen_random_uuid() PRIMARY KEY,
+  key text NOT NULL UNIQUE,
+  name text NOT NULL,
+  current_version_id uuid,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  updated_by uuid
+);
+GRANT SELECT ON public.global_sections TO anon;
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.global_sections TO authenticated;
+GRANT ALL ON public.global_sections TO service_role;
+ALTER TABLE public.global_sections ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "Anyone can read global_sections" ON public.global_sections FOR SELECT USING (true);
+CREATE POLICY "Admins manage global_sections" ON public.global_sections FOR ALL TO authenticated
+  USING (has_role(auth.uid(),'admin'::app_role))
+  WITH CHECK (has_role(auth.uid(),'admin'::app_role));
+
+CREATE TABLE public.global_section_versions (
+  id uuid NOT NULL DEFAULT gen_random_uuid() PRIMARY KEY,
+  section_id uuid NOT NULL REFERENCES public.global_sections(id) ON DELETE CASCADE,
+  version_no integer NOT NULL,
+  blocks jsonb NOT NULL DEFAULT '[]'::jsonb,
+  note text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  created_by uuid,
+  UNIQUE (section_id, version_no)
+);
+GRANT SELECT ON public.global_section_versions TO anon;
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.global_section_versions TO authenticated;
+GRANT ALL ON public.global_section_versions TO service_role;
+ALTER TABLE public.global_section_versions ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "Anyone can read global_section_versions" ON public.global_section_versions FOR SELECT USING (true);
+CREATE POLICY "Admins manage global_section_versions" ON public.global_section_versions FOR ALL TO authenticated
+  USING (has_role(auth.uid(),'admin'::app_role))
+  WITH CHECK (has_role(auth.uid(),'admin'::app_role));
+
+ALTER TABLE public.global_sections
+  ADD CONSTRAINT global_sections_current_version_fk
+  FOREIGN KEY (current_version_id) REFERENCES public.global_section_versions(id) ON DELETE SET NULL;
+
+-- =========================================================
+-- updated_at triggers
+-- =========================================================
+CREATE OR REPLACE FUNCTION public.touch_pages() RETURNS trigger
+LANGUAGE plpgsql SET search_path = public AS $$
+BEGIN NEW.updated_at = now(); NEW.updated_by = auth.uid(); RETURN NEW; END; $$;
+CREATE TRIGGER touch_pages_upd BEFORE UPDATE ON public.pages
+  FOR EACH ROW EXECUTE FUNCTION public.touch_pages();
+
+CREATE OR REPLACE FUNCTION public.touch_global_sections() RETURNS trigger
+LANGUAGE plpgsql SET search_path = public AS $$
+BEGIN NEW.updated_at = now(); NEW.updated_by = auth.uid(); RETURN NEW; END; $$;
+CREATE TRIGGER touch_global_sections_upd BEFORE UPDATE ON public.global_sections
+  FOR EACH ROW EXECUTE FUNCTION public.touch_global_sections();
+
+-- =========================================================
+-- Seed built-in system pages with an initial empty version each
+-- =========================================================
+DO $$
+DECLARE
+  page_rec RECORD;
+  new_page_id uuid;
+  new_version_id uuid;
+  seed_pages jsonb := '[
+    {"key":"home","name":"Home","blocks":[
+      {"id":"hero","type":"hero","props":{}},
+      {"id":"stats","type":"stats","props":{}},
+      {"id":"intro","type":"intro","props":{}},
+      {"id":"features","type":"features","props":{}},
+      {"id":"destinations","type":"destinations","props":{}},
+      {"id":"packages","type":"packages","props":{}},
+      {"id":"gallery","type":"gallery","props":{}},
+      {"id":"testimonials","type":"testimonials","props":{}},
+      {"id":"cta","type":"contactCta","props":{}}
+    ]},
+    {"key":"utbildningen","name":"Utbildningen","blocks":[
+      {"id":"intro","type":"intro","props":{}},
+      {"id":"features","type":"features","props":{}}
+    ]},
+    {"key":"destinationer","name":"Destinationer","blocks":[
+      {"id":"destinations","type":"destinations","props":{}}
+    ]},
+    {"key":"datum","name":"Datum","blocks":[
+      {"id":"packages","type":"packages","props":{}}
+    ]},
+    {"key":"om","name":"Om","blocks":[
+      {"id":"intro","type":"intro","props":{}},
+      {"id":"stats","type":"stats","props":{}},
+      {"id":"gallery","type":"gallery","props":{}}
+    ]},
+    {"key":"kontakt","name":"Kontakt","blocks":[
+      {"id":"cta","type":"contactCta","props":{}}
+    ]}
+  ]'::jsonb;
+  item jsonb;
+BEGIN
+  FOR item IN SELECT * FROM jsonb_array_elements(seed_pages) LOOP
+    INSERT INTO public.pages(key,name,is_system,status)
+    VALUES (item->>'key', item->>'name', true, 'published')
+    ON CONFLICT (key) DO NOTHING
+    RETURNING id INTO new_page_id;
+
+    IF new_page_id IS NULL THEN
+      SELECT id INTO new_page_id FROM public.pages WHERE key = item->>'key';
+    END IF;
+
+    IF NOT EXISTS (SELECT 1 FROM public.page_versions WHERE page_id = new_page_id) THEN
+      INSERT INTO public.page_versions(page_id, version_no, blocks, note)
+      VALUES (new_page_id, 1, item->'blocks', 'Initial seed')
+      RETURNING id INTO new_version_id;
+
+      UPDATE public.pages SET current_version_id = new_version_id WHERE id = new_page_id;
+
+      INSERT INTO public.page_publications(page_id, version_id, is_active, note)
+      VALUES (new_page_id, new_version_id, true, 'Initial publish');
+    END IF;
+  END LOOP;
+END $$;

package/migrations/20260728193035_84b68d27-c3f3-4516-a3a9-15fc6f476163.sql

@@ -0,0 +1,17 @@
+
+CREATE POLICY "Admins can read media"
+ON storage.objects FOR SELECT TO authenticated
+USING (bucket_id = 'media' AND public.has_role(auth.uid(), 'admin'));
+
+CREATE POLICY "Admins can upload media"
+ON storage.objects FOR INSERT TO authenticated
+WITH CHECK (bucket_id = 'media' AND public.has_role(auth.uid(), 'admin'));
+
+CREATE POLICY "Admins can update media"
+ON storage.objects FOR UPDATE TO authenticated
+USING (bucket_id = 'media' AND public.has_role(auth.uid(), 'admin'))
+WITH CHECK (bucket_id = 'media' AND public.has_role(auth.uid(), 'admin'));
+
+CREATE POLICY "Admins can delete media"
+ON storage.objects FOR DELETE TO authenticated
+USING (bucket_id = 'media' AND public.has_role(auth.uid(), 'admin'));

package/migrations/20260728193707_8438ee2d-d589-4048-86e2-464fd209af80.sql

@@ -0,0 +1,37 @@
+
+CREATE TABLE public.block_templates (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  name text NOT NULL,
+  description text,
+  block_type text NOT NULL,
+  block jsonb NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  created_by uuid
+);
+
+GRANT SELECT ON public.block_templates TO anon, authenticated;
+GRANT INSERT, UPDATE, DELETE ON public.block_templates TO authenticated;
+GRANT ALL ON public.block_templates TO service_role;
+
+ALTER TABLE public.block_templates ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "Anyone can read block_templates"
+  ON public.block_templates FOR SELECT USING (true);
+
+CREATE POLICY "Admins insert block_templates"
+  ON public.block_templates FOR INSERT TO authenticated
+  WITH CHECK (public.has_role(auth.uid(), 'admin'));
+
+CREATE POLICY "Admins update block_templates"
+  ON public.block_templates FOR UPDATE TO authenticated
+  USING (public.has_role(auth.uid(), 'admin'))
+  WITH CHECK (public.has_role(auth.uid(), 'admin'));
+
+CREATE POLICY "Admins delete block_templates"
+  ON public.block_templates FOR DELETE TO authenticated
+  USING (public.has_role(auth.uid(), 'admin'));
+
+CREATE TRIGGER touch_block_templates_updated_at
+  BEFORE UPDATE ON public.block_templates
+  FOR EACH ROW EXECUTE FUNCTION public.touch_pages();

package/migrations/20260729055312_08862d7e-0279-4d4f-8709-a59b9f068c55.sql

@@ -0,0 +1,5 @@
+
+-- 1. Extend role enum
+ALTER TYPE public.app_role ADD VALUE IF NOT EXISTS 'superadmin';
+ALTER TYPE public.app_role ADD VALUE IF NOT EXISTS 'seo';
+ALTER TYPE public.app_role ADD VALUE IF NOT EXISTS 'user';