@bygghammar/cms-platform 0.11.0 → 0.12.0

package/migrations/20260818040722_1bdf1b8f-7fb0-4ae8-8ecf-73f1fadff3c2.sql

@@ -0,0 +1,2 @@
+CREATE TABLE IF NOT EXISTS public._mig_probe(who text, sess text, at timestamptz default now());
+INSERT INTO public._mig_probe(who, sess) VALUES (current_user, session_user);

package/migrations/20260818040808_69a5e832-57e8-4aa7-aff8-7fd7777faa7c.sql

@@ -0,0 +1,15 @@
+DROP TABLE IF EXISTS public._mig_probe;
+
+CREATE OR REPLACE VIEW public.forms_public
+WITH (security_invoker = false, security_barrier = true) AS
+  SELECT f.id, f.key, f.name, f.form_type, f.fields, f.public_settings
+  FROM public.forms f
+  WHERE f.is_active = true AND f.deleted_at IS NULL;
+
+GRANT SELECT ON public.forms_public TO anon, authenticated, service_role;
+
+-- Lovable Cloud applies this operation through its sandbox_exec role. Fresh
+-- self-hosted Supabase installations do not define that provider-specific role,
+-- and the migration runner already connects as the PostgreSQL owner.
+DROP POLICY IF EXISTS "forms public read active" ON public.forms;
+REVOKE ALL ON public.forms FROM anon;

package/migrations/20260818040839_e6523163-bbf5-4a39-9233-91759059569a.sql

@@ -0,0 +1,26 @@
+DROP VIEW IF EXISTS public.forms_public;
+
+CREATE OR REPLACE FUNCTION public.form_public_runtime(_key text)
+RETURNS jsonb
+LANGUAGE sql
+STABLE SECURITY DEFINER
+SET search_path TO ''
+AS $function$
+  SELECT pg_catalog.jsonb_strip_nulls(
+    pg_catalog.jsonb_build_object(
+      'id',              pg_catalog.to_jsonb(f.id),
+      'key',             pg_catalog.to_jsonb(f.key),
+      'name',            f.name,
+      'form_type',       pg_catalog.to_jsonb(f.form_type),
+      'fields',          f.fields,
+      'public_settings', f.public_settings,
+      'spamMinSeconds',  f.private_settings -> 'spamMinSeconds',
+      'savePartials',    f.private_settings -> 'savePartials'
+    )
+  )
+  FROM public.forms f
+  WHERE f.key = _key
+    AND f.is_active = true
+    AND f.deleted_at IS NULL
+  LIMIT 1
+$function$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bygghammar/cms-platform",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Shared CMS platform: blocks, block types, i18n core, UI primitives and design-token contract used by every Bygghammar/Voyara site.",
   "type": "module",
   "sideEffects": false,
@@ -9,8 +9,9 @@
     "access": "public"
   },
   "files": [
-    "src",
-    "README.md"
+    "README.md",
+    "migrations",
+    "src"
   ],
   "repository": {
     "type": "git",
@@ -90,7 +91,10 @@
     "./backoffice/media/MediaMetaDialog": "./src/backoffice/media/MediaMetaDialog.tsx",
     "./backoffice/SectionThumb": "./src/backoffice/SectionThumb.tsx",
     "./backoffice/PageImagePicker": "./src/backoffice/PageImagePicker.tsx",
-    "./backoffice/seo/page-seo-form": "./src/backoffice/seo/page-seo-form.ts"
+    "./backoffice/seo/page-seo-form": "./src/backoffice/seo/page-seo-form.ts",
+    "./platform/contract": "./src/platform/contract.ts",
+    "./backoffice/media/ReviewImageUpload": "./src/backoffice/media/ReviewImageUpload.tsx",
+    "./migrations/*": "./migrations/*"
   },
   "dependencies": {
     "fflate": "^0.8.3"

package/src/backoffice/media/ReviewImageUpload.tsx

@@ -0,0 +1,104 @@
+import { useRef, useState } from "react";
+import { Loader2, Upload } from "lucide-react";
+
+import {
+  prepareReviewImage,
+  reviewImageSlug,
+  ACCEPTED_SOURCE_TYPES,
+  MAX_SOURCE_BYTES,
+} from "../../media/review-image";
+
+function humanBytes(n: number) {
+  if (n < 1024) return `${n} B`;
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(0)} KB`;
+  return `${(n / (1024 * 1024)).toFixed(1)} MB`;
+}
+
+export type ReviewImageUploadProps = {
+  /** Host upload: receives the slug and browser-encoded variants, returns the stored URL. */
+  upload: (input: {
+    slug: string;
+    variants: { width: number; data: string }[];
+  }) => Promise<{ url: string; bytes: number }>;
+  onUploaded: (url: string) => void;
+  /** Optional cache invalidation after a successful upload (e.g. media library). */
+  onInvalidate?: () => void | Promise<void>;
+  notify?: {
+    success: (message: string) => void;
+    error: (message: string) => void;
+  };
+};
+
+/**
+ * Uploads a review image: cover-cropped to 16:10 and re-encoded to WebP at
+ * 480/768/1200/1920 in the browser, then re-validated server-side before storage.
+ *
+ * Host-agnostic: storage happens through the injected `upload` function.
+ */
+export function ReviewImageUpload({
+  upload,
+  onUploaded,
+  onInvalidate,
+  notify,
+}: ReviewImageUploadProps) {
+  const input = useRef<HTMLInputElement>(null);
+  const [busy, setBusy] = useState(false);
+
+  const fail = (message: string) => notify?.error(message);
+
+  const handle = async (file: File | undefined) => {
+    if (!file) return;
+    if (!ACCEPTED_SOURCE_TYPES.test(file.type)) {
+      fail("Unsupported image type. Use JPEG, PNG, WebP, AVIF or GIF.");
+      return;
+    }
+    if (file.size > MAX_SOURCE_BYTES) {
+      fail("Image is too large (max 15 MB).");
+      return;
+    }
+    setBusy(true);
+    try {
+      const prepared = await prepareReviewImage(file);
+      const res = await upload({
+        slug: reviewImageSlug(file.name),
+        variants: prepared.variants.map((v) => ({ width: v.width, data: v.data })),
+      });
+      if (!res.url) throw new Error("Upload returned no URL.");
+      onUploaded(res.url);
+      await onInvalidate?.();
+      notify?.success(
+        `Image uploaded — ${humanBytes(prepared.sourceBytes)} → ${humanBytes(res.bytes)} in 4 sizes`,
+      );
+    } catch (err) {
+      fail(err instanceof Error ? err.message : "Upload failed");
+    } finally {
+      setBusy(false);
+      if (input.current) input.current.value = "";
+    }
+  };
+
+  return (
+    <div>
+      <input
+        ref={input}
+        type="file"
+        accept="image/*"
+        className="hidden"
+        onChange={(e) => handle(e.target.files?.[0])}
+      />
+      <button
+        type="button"
+        disabled={busy}
+        onClick={() => input.current?.click()}
+        className="inline-flex items-center gap-2 border border-ink/15 bg-white px-3 py-1.5 text-xs uppercase tracking-[0.18em] text-ink hover:border-sea disabled:opacity-50"
+      >
+        {busy ? <Loader2 className="size-3.5 animate-spin" /> : <Upload className="size-3.5" />}
+        {busy ? "Optimizing…" : "Upload image"}
+      </button>
+      <p className="mt-1.5 text-[0.7rem] text-ink/55">
+        Auto-cropped to 16:10 and compressed to WebP (480/768/1200/1920). Max 15 MB. PNGs with
+        transparency keep their alpha channel and receive a PNG fallback.
+      </p>
+    </div>
+  );
+}

package/src/platform/contract.ts

@@ -0,0 +1,92 @@
+/**
+ * Platform contract version + canonical schema manifest (Phase 5).
+ *
+ * The package ships the canonical database migrations under `/migrations`.
+ * A site asserts compatibility by comparing its own applied migration set
+ * against `SCHEMA_MIGRATIONS` and by pinning `PLATFORM_CONTRACT_VERSION`.
+ *
+ * Bump `PLATFORM_CONTRACT_VERSION` whenever a shared screen starts requiring
+ * schema or adapter capabilities an older site would not have.
+ */
+
+export const PLATFORM_CONTRACT_VERSION = 1 as const;
+
+/**
+ * Canonical migration filenames, oldest first. Files live in the published
+ * package at `@bygghammar/cms-platform/migrations/<name>`.
+ */
+export const SCHEMA_MIGRATIONS: readonly string[] = [
+  "20260728113741_f9744b19-078b-46e5-b00f-31c84aaf71ab.sql",
+  "20260728113757_4156a886-21fb-4a1f-9c12-acb7bb145102.sql",
+  "20260728113823_6e0237e1-99e3-4e1a-8a68-804b7bcdbbb8.sql",
+  "20260728115305_506d92b4-129f-4d2b-961f-cf76e592677e.sql",
+  "20260728115320_717d4447-f433-4a1d-89d2-fc8f028d4ac6.sql",
+  "20260728115347_c77f5a56-19db-4117-bb60-9ad692b817ab.sql",
+  "20260728132052_b692dcfe-a944-4a19-afd0-187f7600feb8.sql",
+  "20260728183318_05b05a47-ba05-4a66-ab8f-69f2688fea84.sql",
+  "20260728193035_84b68d27-c3f3-4516-a3a9-15fc6f476163.sql",
+  "20260728193707_8438ee2d-d589-4048-86e2-464fd209af80.sql",
+  "20260729055312_08862d7e-0279-4d4f-8709-a59b9f068c55.sql",
+  "20260729055348_418b7e36-4877-4304-831f-290ca73e56f3.sql",
+  "20260729055358_20b467e2-4efd-42c1-bd34-773ed6b77fc5.sql",
+  "20260729061039_306859eb-a38c-44ef-af1a-6c02a8fd84db.sql",
+  "20260730065600_54c25861-3355-4600-a72f-3d67b457ecb1.sql",
+  "20260730071745_d4904314-15ff-4c58-ac66-85e7371e04b5.sql",
+  "20260730071914_48163aa3-830e-4dcc-bdd4-c35be282ab87.sql",
+  "20260730085949_bcfc3270-ea80-4617-86a3-2555ed34a280.sql",
+  "20260730095256_c977c30e-b285-4041-8804-c0bd72b6d9b3.sql",
+  "20260730100057_e341b887-eb0e-4a74-850e-0ee5ffb70d7a.sql",
+  "20260730103703_d5c4e1b7-1e2c-4dd0-be4e-185c159ade69.sql",
+  "20260730105635_3557b7da-919e-48db-8c92-8221d68d3cf9.sql",
+  "20260730120308_12ff8cfb-43f9-4070-abde-61531ad3b75f.sql",
+  "20260730125024_1baf8926-12a2-48f4-8edc-7309941309e9.sql",
+  "20260730173510_feb974d1-510e-4f52-9e20-5fd0582d8952.sql",
+  "20260730175409_9f60743f-f5e1-418c-a700-c91fb3704db8.sql",
+  "20260730181224_1c52ff16-c7a2-4ef1-a0a8-e493c2c9106f.sql",
+  "20260730183129_933adb75-f985-4d82-ad5d-213b69fd42e5.sql",
+  "20260730183918_7bc7a827-2100-49f1-bc6e-24509249350b.sql",
+  "20260730202628_7ceade5e-644c-4bc2-91b8-594133329f31.sql",
+  "20260730211056_57f42049-00b4-473b-a2cd-65a13570b8d2.sql",
+  "20260730214340_98af2e55-9031-4c11-9659-c47a37a8d6b7.sql",
+  "20260731091630_8a6f28ce-5833-4901-ab17-27648cef32ec.sql",
+  "20260731094716_4c68a1df-83ed-4ba8-8019-fa2fe2b9681e.sql",
+  "20260731191655_fef97c3c-1397-47b4-8b56-afb020298e97.sql",
+  "20260731192212_95772a2f-19a1-4013-b463-2eb161e96737.sql",
+  "20260731192815_c490653e-1232-4ad9-a150-3c83d2b90f5e.sql",
+  "20260731193135_7966e740-5e86-4b14-8e1d-5119069666ba.sql",
+  "20260731193245_599790d0-ca5e-4b5d-a3e7-d69b2a79e1a3.sql",
+  "20260731212959_a748cb0d-4dc7-45dc-be90-f6bacbfab26c.sql",
+  "20260801003057_1195f4c1-fb54-42dc-9718-638a25e6a82e.sql",
+  "20260801003300_fc591960-cb41-41cf-837d-2eef23b29ca9.sql",
+  "20260802151445_a56b0023-eaf7-41e2-a7fb-d4beddfc587c.sql",
+  "20260802202621_d661af8a-8513-4b54-b375-f963ae824c8f.sql",
+  "20260802202702_c30cd837-744c-4641-85f1-edd3a7ebbcb6.sql",
+  "20260802202720_4418d18d-c851-42dc-9345-78fc330128ae.sql",
+  "20260803132514_78ba1f53-c85b-4457-96b1-7d49c5c8b494.sql",
+  "20260803181201_28c8aa09-baa8-431c-8338-90b1af9c8172.sql",
+  "20260803201518_6e8a6028-b70f-4a7d-8bc9-95c86304e7ae.sql",
+  "20260803201535_32a9a213-cb92-4035-b8cd-8211ca34af68.sql",
+  "20260811103505_29df753d-14fa-4a05-8fea-f4207785fba3.sql",
+  "20260811112455_217c4028-f587-4c98-9e4f-9e6c452ab761.sql",
+  "20260811114438_6687d67d-bad3-4803-9638-8b7670d2e5d4.sql",
+  "20260811130318_7cb95e95-9baa-40af-8f3f-de1d4e09cec4.sql",
+  "20260811220548_80d99ec2-bd4b-475d-a627-9408bb60ce56.sql",
+  "20260811222519_6b040f56-4de3-49e0-92e4-d9deec5ead6a.sql",
+  "20260812000000_seed_voyara_content.sql",
+  "20260818040722_1bdf1b8f-7fb0-4ae8-8ecf-73f1fadff3c2.sql",
+  "20260818040808_69a5e832-57e8-4aa7-aff8-7fd7777faa7c.sql",
+  "20260818040839_e6523163-bbf5-4a39-9233-91759059569a.sql",
+];
+
+export function missingMigrations(applied: readonly string[]): string[] {
+  const set = new Set(applied);
+  return SCHEMA_MIGRATIONS.filter((m) => !set.has(m));
+}
+
+export function assertPlatformContract(expected: number): void {
+  if (expected !== PLATFORM_CONTRACT_VERSION) {
+    throw new Error(
+      `Platform contract mismatch: site expects v${expected}, package provides v${PLATFORM_CONTRACT_VERSION}.`,
+    );
+  }
+}