@bygghammar/cms-platform 0.11.0 → 0.13.0

package/migrations/20260729055348_418b7e36-4877-4304-831f-290ca73e56f3.sql

@@ -0,0 +1,133 @@
+
+-- Update initial admin trigger to also grant superadmin
+CREATE OR REPLACE FUNCTION public.grant_initial_admin()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path TO 'public'
+AS $$
+BEGIN
+  IF NEW.email_confirmed_at IS NOT NULL
+     AND lower(NEW.email) = 'byggis@gmail.com' THEN
+    INSERT INTO public.user_roles (user_id, role) VALUES (NEW.id, 'admin')
+      ON CONFLICT (user_id, role) DO NOTHING;
+    INSERT INTO public.user_roles (user_id, role) VALUES (NEW.id, 'superadmin')
+      ON CONFLICT (user_id, role) DO NOTHING;
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+-- Backfill superadmin for existing byggis account
+INSERT INTO public.user_roles (user_id, role)
+SELECT id, 'superadmin'::public.app_role FROM auth.users WHERE lower(email) = 'byggis@gmail.com'
+ON CONFLICT (user_id, role) DO NOTHING;
+
+-- Helper: is user staff (admin or superadmin)
+CREATE OR REPLACE FUNCTION public.is_staff(_user_id uuid)
+RETURNS boolean LANGUAGE sql STABLE SECURITY DEFINER SET search_path = public AS $$
+  SELECT EXISTS (
+    SELECT 1 FROM public.user_roles
+    WHERE user_id = _user_id AND role IN ('admin','superadmin')
+  )
+$$;
+
+-- Allow admins/superadmins to manage user_roles (superadmin), and view all roles
+CREATE POLICY "Superadmins manage user_roles" ON public.user_roles
+  FOR ALL TO authenticated
+  USING (public.has_role(auth.uid(), 'superadmin'))
+  WITH CHECK (public.has_role(auth.uid(), 'superadmin'));
+
+CREATE POLICY "Staff view all user_roles" ON public.user_roles
+  FOR SELECT TO authenticated
+  USING (public.is_staff(auth.uid()));
+
+-- ============ audit_logs ============
+CREATE TABLE public.audit_logs (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  actor_id uuid,
+  actor_email text,
+  action text NOT NULL,
+  entity text,
+  entity_id text,
+  meta jsonb NOT NULL DEFAULT '{}'::jsonb,
+  ip text,
+  user_agent text,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX audit_logs_created_at_idx ON public.audit_logs (created_at DESC);
+CREATE INDEX audit_logs_actor_idx ON public.audit_logs (actor_id);
+
+GRANT SELECT, INSERT ON public.audit_logs TO authenticated;
+GRANT ALL ON public.audit_logs TO service_role;
+ALTER TABLE public.audit_logs ENABLE ROW LEVEL SECURITY;
+CREATE POLICY "Staff view audit_logs" ON public.audit_logs
+  FOR SELECT TO authenticated USING (public.is_staff(auth.uid()));
+CREATE POLICY "Staff insert audit_logs" ON public.audit_logs
+  FOR INSERT TO authenticated WITH CHECK (public.is_staff(auth.uid()));
+
+-- ============ email_logs ============
+CREATE TABLE public.email_logs (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  to_address text NOT NULL,
+  from_address text,
+  reply_to text,
+  subject text,
+  body_preview text,
+  provider text,
+  status text NOT NULL DEFAULT 'queued',
+  error text,
+  meta jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX email_logs_created_at_idx ON public.email_logs (created_at DESC);
+
+GRANT SELECT, INSERT ON public.email_logs TO authenticated;
+GRANT ALL ON public.email_logs TO service_role;
+ALTER TABLE public.email_logs ENABLE ROW LEVEL SECURITY;
+CREATE POLICY "Staff view email_logs" ON public.email_logs
+  FOR SELECT TO authenticated USING (public.is_staff(auth.uid()));
+CREATE POLICY "Staff insert email_logs" ON public.email_logs
+  FOR INSERT TO authenticated WITH CHECK (public.is_staff(auth.uid()));
+
+-- ============ email_settings (singleton) ============
+CREATE TABLE public.email_settings (
+  id boolean PRIMARY KEY DEFAULT true CHECK (id = true),
+  primary_from_name text,
+  primary_from_email text,
+  backup_from_email text,
+  reply_to text,
+  admin_notify_to text,
+  provider text NOT NULL DEFAULT 'smtp',
+  smtp_host text,
+  smtp_port integer,
+  smtp_secure boolean NOT NULL DEFAULT true,
+  smtp_username text,
+  smtp_password_secret_name text,
+  ses_region text,
+  ses_access_key_id text,
+  ses_secret_access_key_secret_name text,
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  updated_by uuid
+);
+
+GRANT SELECT, INSERT, UPDATE ON public.email_settings TO authenticated;
+GRANT ALL ON public.email_settings TO service_role;
+ALTER TABLE public.email_settings ENABLE ROW LEVEL SECURITY;
+CREATE POLICY "Staff view email_settings" ON public.email_settings
+  FOR SELECT TO authenticated USING (public.is_staff(auth.uid()));
+CREATE POLICY "Superadmins update email_settings" ON public.email_settings
+  FOR UPDATE TO authenticated
+  USING (public.has_role(auth.uid(), 'superadmin'))
+  WITH CHECK (public.has_role(auth.uid(), 'superadmin'));
+CREATE POLICY "Superadmins insert email_settings" ON public.email_settings
+  FOR INSERT TO authenticated
+  WITH CHECK (public.has_role(auth.uid(), 'superadmin'));
+
+CREATE OR REPLACE FUNCTION public.touch_email_settings()
+RETURNS trigger LANGUAGE plpgsql SET search_path = public AS $$
+BEGIN NEW.updated_at = now(); NEW.updated_by = auth.uid(); RETURN NEW; END; $$;
+CREATE TRIGGER trg_touch_email_settings BEFORE UPDATE ON public.email_settings
+  FOR EACH ROW EXECUTE FUNCTION public.touch_email_settings();
+
+INSERT INTO public.email_settings (id) VALUES (true) ON CONFLICT DO NOTHING;

package/migrations/20260729055358_20b467e2-4efd-42c1-bd34-773ed6b77fc5.sql

@@ -0,0 +1,3 @@
+
+REVOKE ALL ON FUNCTION public.is_staff(uuid) FROM PUBLIC, anon;
+GRANT EXECUTE ON FUNCTION public.is_staff(uuid) TO authenticated, service_role;

package/migrations/20260729061039_306859eb-a38c-44ef-af1a-6c02a8fd84db.sql

@@ -0,0 +1,43 @@
+
+CREATE TABLE public.email_providers (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  name text NOT NULL,
+  kind text NOT NULL CHECK (kind IN ('smtp','ses','lovable','mailgun','http')),
+  is_active boolean NOT NULL DEFAULT true,
+  sort_order integer NOT NULL DEFAULT 100,
+  from_name text,
+  from_email text,
+  reply_to text,
+  config jsonb NOT NULL DEFAULT '{}'::jsonb,
+  secret_ref_name text,
+  notes text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  updated_by uuid
+);
+
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.email_providers TO authenticated;
+GRANT ALL ON public.email_providers TO service_role;
+
+ALTER TABLE public.email_providers ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "Staff view email_providers" ON public.email_providers
+  FOR SELECT TO authenticated USING (public.is_staff(auth.uid()));
+CREATE POLICY "Superadmins insert email_providers" ON public.email_providers
+  FOR INSERT TO authenticated WITH CHECK (public.has_role(auth.uid(), 'superadmin'));
+CREATE POLICY "Superadmins update email_providers" ON public.email_providers
+  FOR UPDATE TO authenticated USING (public.has_role(auth.uid(), 'superadmin'))
+  WITH CHECK (public.has_role(auth.uid(), 'superadmin'));
+CREATE POLICY "Superadmins delete email_providers" ON public.email_providers
+  FOR DELETE TO authenticated USING (public.has_role(auth.uid(), 'superadmin'));
+
+CREATE OR REPLACE FUNCTION public.touch_email_providers()
+RETURNS trigger LANGUAGE plpgsql SET search_path = public AS $$
+BEGIN NEW.updated_at = now(); NEW.updated_by = auth.uid(); RETURN NEW; END; $$;
+
+CREATE TRIGGER trg_touch_email_providers BEFORE UPDATE ON public.email_providers
+  FOR EACH ROW EXECUTE FUNCTION public.touch_email_providers();
+
+ALTER TABLE public.email_settings
+  ADD COLUMN IF NOT EXISTS default_provider_id uuid REFERENCES public.email_providers(id) ON DELETE SET NULL,
+  ADD COLUMN IF NOT EXISTS fallback_provider_id uuid REFERENCES public.email_providers(id) ON DELETE SET NULL;

package/migrations/20260730065600_54c25861-3355-4600-a72f-3d67b457ecb1.sql

@@ -0,0 +1,54 @@
+-- 1. block_templates: staff only
+DROP POLICY IF EXISTS "Anyone can read block_templates" ON public.block_templates;
+CREATE POLICY "Staff read block_templates" ON public.block_templates
+  FOR SELECT TO authenticated USING (public.is_staff(auth.uid()));
+REVOKE ALL ON public.block_templates FROM anon;
+
+-- 2. pages / page_versions / page_publications: no anonymous reads
+DROP POLICY IF EXISTS "Anyone can read pages" ON public.pages;
+CREATE POLICY "Staff read pages" ON public.pages
+  FOR SELECT TO authenticated USING (public.is_staff(auth.uid()));
+REVOKE ALL ON public.pages FROM anon;
+
+DROP POLICY IF EXISTS "Anyone can read page_versions" ON public.page_versions;
+CREATE POLICY "Staff read page_versions" ON public.page_versions
+  FOR SELECT TO authenticated USING (public.is_staff(auth.uid()));
+REVOKE ALL ON public.page_versions FROM anon;
+
+DROP POLICY IF EXISTS "Anyone can read page_publications" ON public.page_publications;
+CREATE POLICY "Staff read page_publications" ON public.page_publications
+  FOR SELECT TO authenticated USING (public.is_staff(auth.uid()));
+REVOKE ALL ON public.page_publications FROM anon;
+
+-- 3. global sections + version history: no anonymous reads
+DROP POLICY IF EXISTS "Anyone can read global_sections" ON public.global_sections;
+CREATE POLICY "Staff read global_sections" ON public.global_sections
+  FOR SELECT TO authenticated USING (public.is_staff(auth.uid()));
+REVOKE ALL ON public.global_sections FROM anon;
+
+DROP POLICY IF EXISTS "Anyone can read global_section_versions" ON public.global_section_versions;
+CREATE POLICY "Staff read global_section_versions" ON public.global_section_versions
+  FOR SELECT TO authenticated USING (public.is_staff(auth.uid()));
+REVOKE ALL ON public.global_section_versions FROM anon;
+
+-- 4. locale_domains: hide admin-domain routing from the public
+DROP POLICY IF EXISTS "Anyone can read locale domains" ON public.locale_domains;
+CREATE POLICY "Staff read locale domains" ON public.locale_domains
+  FOR SELECT TO authenticated USING (public.is_staff(auth.uid()));
+REVOKE ALL ON public.locale_domains FROM anon;
+
+-- 5. SECURITY DEFINER functions: not callable by anon/authenticated,
+--    except the role helpers required by RLS policies.
+REVOKE ALL ON FUNCTION public.grant_initial_admin() FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.touch_content_sections() FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.touch_page_seo() FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.touch_global_sections() FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.touch_locale_domains() FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.touch_pages() FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.touch_email_providers() FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.touch_email_settings() FROM PUBLIC, anon, authenticated;
+
+REVOKE ALL ON FUNCTION public.has_role(uuid, public.app_role) FROM PUBLIC, anon;
+REVOKE ALL ON FUNCTION public.is_staff(uuid) FROM PUBLIC, anon;
+GRANT EXECUTE ON FUNCTION public.has_role(uuid, public.app_role) TO authenticated, service_role;
+GRANT EXECUTE ON FUNCTION public.is_staff(uuid) TO authenticated, service_role;

package/migrations/20260730071745_d4904314-15ff-4c58-ac66-85e7371e04b5.sql

@@ -0,0 +1,113 @@
+DO $mig$
+DECLARE
+  v_page uuid;
+  v_id uuid;
+  v_no int;
+  v_blocks jsonb;
+BEGIN
+  SELECT id INTO v_page FROM public.pages WHERE key = 'utbildningen';
+  IF v_page IS NULL THEN RAISE NOTICE 'no page'; RETURN; END IF;
+  SELECT COALESCE(MAX(version_no),0)+1 INTO v_no FROM public.page_versions WHERE page_id = v_page;
+
+  v_blocks := $json$[
+  { "id": "intro", "type": "intro", "props": {} },
+  { "id": "included", "type": "checklist", "props": {
+      "tone": "paper",
+      "eyebrow": { "sv": "Bartenderkurs i Ayia Napa, Cypern", "en": "Bartender course in Ayia Napa, Cyprus" },
+      "title": { "sv": "Vad ingår?", "en": "What's included?" },
+      "columns": [
+        { "id": "c_inc", "title": { "sv": "Detta ingår", "en": "Included" }, "entries": [
+          { "id": "i1", "text": { "sv": "4 veckors teoretisk & praktisk kvalitetsutbildning", "en": "4 weeks of theoretical & practical quality training" } },
+          { "id": "i2", "text": { "sv": "Studiematerial", "en": "Study material" } },
+          { "id": "i3", "text": { "sv": "Boende 4 veckor i Ayia Napa", "en": "Accommodation for 4 weeks in Ayia Napa" } },
+          { "id": "i4", "text": { "sv": "Flairingkurs", "en": "Flairing course" } },
+          { "id": "i5", "text": { "sv": "Betyg, diplom och referenser", "en": "Grades, diploma and references" } },
+          { "id": "i6", "text": { "sv": "Rabatter på mat och dryck under kursens gång", "en": "Discounts on food and drinks during the course" } },
+          { "id": "i7", "text": { "sv": "Möjlighet till jobb efter avklarad kurs", "en": "Job opportunities after completing the course" } }
+        ] },
+        { "id": "c_perks", "title": { "sv": "Övriga förmåner", "en": "Other benefits" }, "entries": [
+          { "id": "p1", "text": { "sv": "VIP-kort (värde 2000 SEK)", "en": "VIP card (value 2000 SEK)" } },
+          { "id": "p2", "text": { "sv": "Strandaktiviteter", "en": "Beach activities" } },
+          { "id": "p3", "text": { "sv": "Gemensamma utgångar", "en": "Group nights out" } },
+          { "id": "p4", "text": { "sv": "Avslutningsmiddag och fest", "en": "Graduation dinner and party" } }
+        ] }
+      ]
+  } },
+  { "id": "about", "type": "prose", "props": {
+      "tone": "white",
+      "layout": "two-col",
+      "eyebrow": { "sv": "Utbildningen", "en": "The education" },
+      "title": { "sv": "En internationell bartenderutbildning", "en": "An international bartender education" },
+      "lead": { "sv": "Scandinavian Bar Academy utbildar dig till en internationell bartender. Bartenderutbildningen sker på svenska men vi tar emot elever från hela Norden. En fyraveckorsutbildning med fokus på kunskap, kvalité & service. Inga förkunskaper krävs!", "en": "Scandinavian Bar Academy trains you to become an international bartender. The course is taught in Swedish, but we welcome students from all of the Nordics. Four weeks focused on knowledge, quality and service. No previous experience required!" },
+      "items": [
+        { "id": "a1", "heading": { "sv": "Teori och praktik", "en": "Theory and practice" }, "body": { "sv": "Under utbildningen går du igenom alla grundläggande moment för att bli en bartender av högsta klass. Förutom teoretisk lära om diverse spritsorter och kundpsykologi praktiserar du fysiskt både på barskolan och på en bar eller nattklubb. Under praktiken sätts dina färdigheter på prov, vilket ger dig en uppfattning om hur det är att arbeta som bartender.", "en": "During the course you cover every fundamental skill needed to become a top-class bartender. Beyond theory on spirits and customer psychology, you practise both at the bar school and in a real bar or nightclub — putting your skills to the test." } },
+        { "id": "a2", "heading": { "sv": "Legitimerad bartender", "en": "Certified bartender" }, "body": { "sv": "SBA gör dig till legitimerad bartender och med certifikatet du erhåller efter avklarad utbildning har du möjlighet att jobba världen över. Efter avklarad utbildning och praktik erbjuder vi dig jobb på Cypern om intresset finns, så att du snabbt kan påbörja din karriär.", "en": "SBA makes you a certified bartender, and the certificate you receive lets you work all over the world. After finishing the course and internship we can offer you a job in Cyprus so you can start your career right away." } },
+        { "id": "a3", "heading": { "sv": "Garanterat jobb", "en": "Guaranteed job" }, "body": { "sv": "Tack vare Scandinavian Bar Academys kontakter med barer, klubbar och restauranger samt dess högt ansedda rykte kan barskolan garantera jobb efter avklarad kurs. Jobb garanteras på Cypern, Ayia Napa, samtidigt som certifikatet värderas högt i andra länder. SBA är ensamma om att kunna erbjuda denna fördelaktiga jobbgaranti.", "en": "Thanks to SBA's network of bars, clubs and restaurants — and our reputation — we guarantee a job after completing the course. Jobs are guaranteed in Ayia Napa, Cyprus, while the certificate is highly valued elsewhere too." } },
+        { "id": "a4", "heading": { "sv": "Praktik", "en": "Internship" }, "body": { "sv": "För att optimera bartenderutbildningen får alla elever praktik. Detta för att kombinera de teoretiska lärdomarna med den praktiska hetluften. Praktiken bidrar till en större förståelse för hur livet som bartender är, samtidigt som du får en högre beredskap till jobb efter utförd kurs. SBA är unika genom att erbjuda exklusiva praktikplatser på flertalet skandinaviska barer och nattklubbar.", "en": "Every student gets an internship, combining theory with the real thing. It gives you a deeper understanding of life as a bartender and makes you job-ready. SBA is unique in offering exclusive placements at several Scandinavian bars and nightclubs." } },
+        { "id": "a5", "heading": { "sv": "Bartenderutbildning på Cypern", "en": "Bartender training in Cyprus" }, "body": { "sv": "Genom att utbilda dig i Ayia Napa på Cypern får du ta del av en tropisk miljö med sol och bad. Här studerar du under en palm med utsikt över kristallblått vatten och tränar flairing på några av Europas finaste stränder. Mjuk finkornig sand, omtyckta restauranger och fantastisk service kännetecknar Cypern. I Ayia Napa erbjuder SBA allt från event och temakvällar till dagsutflykter.", "en": "Studying in Ayia Napa means sun, sea and a tropical setting. Study under a palm tree overlooking crystal-blue water and practise flairing on some of Europe's finest beaches. SBA arranges everything from events and theme nights to day trips." } },
+        { "id": "a6", "heading": { "sv": "Boende", "en": "Accommodation" }, "body": { "sv": "Boendet som ingår i utbildningen är Hotell Efi i Ayia Napa — ett populärt hotell bland skandinaviska ungdomar med gångavstånd till allt du behöver. På hotellområdet finns en stor pool med solterrass, loungebar och parasoller samt en snackbar öppen dygnet runt. Rummen har enklare kök, rymlig toalett med dusch/badkar samt balkong eller terrass.", "en": "Accommodation is at Hotel Efi in Ayia Napa — popular with Scandinavian students and within walking distance of everything. The hotel has a large pool with sun terrace, lounge bar and a 24-hour snack bar. Rooms include a kitchenette, spacious bathroom and balcony or terrace." } }
+      ]
+  } },
+  { "id": "features", "type": "features", "props": {} },
+  { "id": "curriculum", "type": "prose", "props": {
+      "tone": "paper",
+      "layout": "two-col",
+      "eyebrow": { "sv": "Kursinnehåll", "en": "Curriculum" },
+      "title": { "sv": "Vad lär man sig på SBA?", "en": "What do you learn at SBA?" },
+      "items": [
+        { "id": "k1", "heading": { "sv": "Utrustningen", "en": "The equipment" }, "body": { "sv": "Du lär dig att hantera en bartenders alla verktyg.", "en": "You learn to handle every tool a bartender uses." } },
+        { "id": "k2", "heading": { "sv": "Baruppställning", "en": "Bar setup" }, "body": { "sv": "Du får lära dig att ställa upp baren inför ett arbetspass.", "en": "You learn how to set up the bar before a shift." } },
+        { "id": "k3", "heading": { "sv": "Alkohollära", "en": "Spirits knowledge" }, "body": { "sv": "Här får du lära dig om de olika spritsorterna en bartender arbetar med. Vi går igenom historien bakom produktionen och smaksättningen av olika spritsorter.", "en": "Learn about the spirits a bartender works with, including the history of their production and flavouring." } },
+        { "id": "k4", "heading": { "sv": "Hygien", "en": "Hygiene" }, "body": { "sv": "Personlig hygien och renlighet är en självklar förutsättning för att arbeta som bartender. Vi går igenom hur du på bästa sätt förbereder dig inför ditt arbetspass.", "en": "Personal hygiene and cleanliness are essential. We go through how to best prepare for your shift." } },
+        { "id": "k5", "heading": { "sv": "Etikett", "en": "Etiquette" }, "body": { "sv": "Att ha respekt för sin arbetsplats är en viktig del av att vara bartender — här lär du dig om etikett bakom baren.", "en": "Respect for your workplace matters. Here you learn etiquette behind the bar." } },
+        { "id": "k6", "heading": { "sv": "Dekoration", "en": "Garnishing" }, "body": { "sv": "Du får lära dig hur du dekorerar olika cocktails och drinkar på olika sätt.", "en": "Learn how to garnish cocktails and drinks in different ways." } },
+        { "id": "k7", "heading": { "sv": "Mixologi", "en": "Mixology" }, "body": { "sv": "Här lär du dig att blanda drinkar. Denna del av utbildningen lär dig principerna för mixologi och hur du bygger en drink i lager och nivåer. Du kommer att lära dig över 100 av de populäraste och vanligaste cocktailsen.", "en": "Learn to mix drinks — the principles of mixology and how to build a drink in layers. You will learn over 100 of the most popular cocktails." } },
+        { "id": "k8", "heading": { "sv": "Speed Mixing/Pouring", "en": "Speed mixing/pouring" }, "body": { "sv": "I den här delen lär du dig att förbereda ett flertal drinkar snabbt och exakt utan att behöva använda mätmått.", "en": "Learn to prepare multiple drinks quickly and accurately without using a jigger." } },
+        { "id": "k9", "heading": { "sv": "Kundservice", "en": "Customer service" }, "body": { "sv": "Du lär dig att ge effektiv, tillmötesgående och framförallt trevlig service. En nöjd kund kommer tillbaka, ger dricks och sprider ett gott ord om din bar. Vi går även igenom hur man hanterar berusade gäster.", "en": "Learn to give efficient, welcoming and genuinely pleasant service. We also cover how to handle intoxicated guests." } },
+        { "id": "k10", "heading": { "sv": "Flairing", "en": "Flairing" }, "body": { "sv": "Vi lär dig hur working flair går till — att showa i baren samtidigt som du blandar drinkar. Det finns möjlighet att gå extra flairlektioner.", "en": "Learn working flair — performing while you mix. Extra flair lessons are available." } },
+        { "id": "k11", "heading": { "sv": "Praktik", "en": "Internship" }, "body": { "sv": "Du praktiserar på någon av partymetropolen Ayia Napas många barer och nattklubbar. Vi samarbetar enbart med de bästa och största ställena. När du börjar din praktik får du träffa alla som jobbar där, gå igenom regler och sortiment, och du tilldelas en handledare som du arbetar sida vid sida med.", "en": "You intern at one of Ayia Napa's many bars and nightclubs. We only work with the best venues. You meet the team, go through the rules and range, and are assigned a supervisor to work alongside." } },
+        { "id": "k12", "heading": { "sv": "Serveringstillstånd", "en": "Licensing law" }, "body": { "sv": "Vi går igenom de olika regler och lagar som gäller i Sverige vid alkoholservering. Du får lära dig att servera alkohol med medvetenhet.", "en": "We cover the rules and laws for serving alcohol in Sweden, so you serve responsibly." } },
+        { "id": "k13", "heading": { "sv": "Prov", "en": "Exams" }, "body": { "sv": "Under kursen har vi flera delprov som spelar in på ditt slutbetyg — allt för att se till att du är i fas och har vad som krävs för att bli bartender.", "en": "Several tests during the course count towards your final grade, making sure you are on track to become a bartender." } }
+      ]
+  } },
+  { "id": "memories", "type": "prose", "props": {
+      "tone": "white",
+      "layout": "single",
+      "eyebrow": { "sv": "Mer än en utbildning", "en": "More than a course" },
+      "title": { "sv": "Minnen för livet", "en": "Memories for life" },
+      "lead": { "sv": "SBA är mycket mer än bara en utbildning. Det är ett äventyr som berikar dig med minnen för livet.", "en": "SBA is much more than a course. It is an adventure that leaves you with memories for life." },
+      "items": [
+        { "id": "m1", "heading": { "sv": "Vänner för livet", "en": "Friends for life" }, "body": { "sv": "Under utbildningens gång träffar du mängder av olika personer. Du lär känna turister under praktiken men också personalen som jobbar på barerna och nattklubbarna på orten. Du knyter vänskapsband för livet — en bidragande anledning till att majoriteten av våra elever väljer att stanna kvar i Ayia Napa efter utbildningen.", "en": "You meet a huge range of people during the course — guests during your internship and the crews working the bars and clubs in town. You build friendships for life, which is why most of our students choose to stay in Ayia Napa afterwards." } },
+        { "id": "m2", "heading": { "sv": "Upplevelser i Ayia Napa", "en": "Experiences in Ayia Napa" }, "body": { "sv": "Under din vistelse får du möjlighet att ta del av många upplevelser: havsgrottor, stränder i världsklass, event som barrundor och partybåt och mycket mer.", "en": "During your stay you get to experience sea caves, world-class beaches, events such as bar crawls and party boats, and much more." } }
+      ]
+  } },
+  { "id": "vip", "type": "checklist", "props": {
+      "tone": "paper",
+      "eyebrow": { "sv": "Ingår kostnadsfritt", "en": "Included free of charge" },
+      "title": { "sv": "VIP-kort", "en": "VIP card" },
+      "note": { "sv": "Under din bartenderutbildning får du ett exklusivt och kostnadsfritt VIP-kort som ger dig rabatter och förmåner runt om i Ayia Napa — allt för att minimera dina kostnader under utbildningen.", "en": "During your training you receive an exclusive, free VIP card giving you discounts and perks around Ayia Napa — keeping your costs down while you study." },
+      "columns": [
+        { "id": "vipc", "title": { "sv": "Exempel på rabatter", "en": "Examples of discounts" }, "entries": [
+          { "id": "v1", "text": { "sv": "Gratis inträde hos vår samarbetspartner Blue Moon Bar (värde 100 SEK per kväll)", "en": "Free entry at our partner Blue Moon Bar (value 100 SEK per night)" } },
+          { "id": "v2", "text": { "sv": "Gratis inträde hos vår samarbetspartner Aqua Club (värde 70 SEK per kväll)", "en": "Free entry at our partner Aqua Club (value 70 SEK per night)" } },
+          { "id": "v3", "text": { "sv": "Ca 70 % rabatt på dryck", "en": "Approx. 70% off drinks" } },
+          { "id": "v4", "text": { "sv": "Ca 20 SEK per drink", "en": "Approx. 20 SEK per drink" } },
+          { "id": "v5", "text": { "sv": "Ca 10 SEK per shot", "en": "Approx. 10 SEK per shot" } },
+          { "id": "v6", "text": { "sv": "10–30 % rabatt på utvalda restauranger", "en": "10–30% off selected restaurants" } },
+          { "id": "v7", "text": { "sv": "50–70 % rabatt på event", "en": "50–70% off events" } }
+        ] }
+      ]
+  } },
+  { "id": "cta", "type": "contactCta", "props": {} }
+]$json$::jsonb;
+
+  INSERT INTO public.page_versions (page_id, version_no, blocks, note)
+  VALUES (v_page, v_no, v_blocks, 'Imported full content from barskola.nu/utbildningen')
+  RETURNING id INTO v_id;
+
+  UPDATE public.pages SET current_version_id = v_id, status = 'published', updated_at = now() WHERE id = v_page;
+  UPDATE public.page_publications SET is_active = false WHERE page_id = v_page AND is_active = true;
+  INSERT INTO public.page_publications (page_id, version_id, is_active, note)
+  VALUES (v_page, v_id, true, 'Full education page content');
+END
+$mig$;

package/migrations/20260730071914_48163aa3-830e-4dcc-bdd4-c35be282ab87.sql

@@ -0,0 +1,22 @@
+CREATE OR REPLACE FUNCTION public.has_role(_user_id uuid, _role app_role)
+RETURNS boolean
+LANGUAGE sql
+STABLE SECURITY DEFINER
+SET search_path TO 'public'
+AS $function$
+  SELECT EXISTS (
+    SELECT 1 FROM public.user_roles
+    WHERE user_id = _user_id
+      AND (
+        role = _role
+        -- superadmin implies every non-superadmin role
+        OR (role = 'superadmin'::app_role AND _role <> 'superadmin'::app_role)
+      )
+  )
+$function$;
+
+REVOKE ALL ON FUNCTION public.has_role(uuid, app_role) FROM PUBLIC, anon;
+GRANT EXECUTE ON FUNCTION public.has_role(uuid, app_role) TO authenticated, service_role;
+
+REVOKE ALL ON FUNCTION public.is_staff(uuid) FROM PUBLIC, anon;
+GRANT EXECUTE ON FUNCTION public.is_staff(uuid) TO authenticated, service_role;

package/migrations/20260730085949_bcfc3270-ea80-4617-86a3-2555ed34a280.sql

@@ -0,0 +1,24 @@
+WITH m(cid, url) AS (VALUES
+  ('c2026-05','https://booking.barskola.nu/bokning-steg-2?ps=BARSKOLA2026-08-10&adults=1'),
+  ('c2026-06','https://booking.barskola.nu/bokning-steg-2?ps=BARSKOLA2026-09-07&adults=1'),
+  ('c2026-07','https://booking.barskola.nu/bokning-steg-2?ps=BARSKOLA-PMI2026-10-05&adults=1'),
+  ('c2027-01','https://booking.barskola.nu/bokning-steg-2?ps=BARSKOLA2027-04-12&adults=1'),
+  ('c2027-02','https://booking.barskola.nu/bokning-steg-2?ps=BARSKOLA2027-05-10&adults=1'),
+  ('c2027-03','https://booking.barskola.nu/bokning-steg-2?ps=BARSKOLA2027-06-21&adults=1'),
+  ('c2027-04','https://booking.barskola.nu/bokning-steg-2?ps=BARSKOLA2027-07-19&adults=1'),
+  ('c2027-05','https://booking.barskola.nu/bokning-steg-2?ps=BARSKOLA2027-08-16&adults=1'),
+  ('c2027-06','https://booking.barskola.nu/bokning-steg-2?ps=BARSKOLA2027-09-13&adults=1')
+),
+fixed AS (
+  SELECT jsonb_agg(
+    CASE WHEN m.url IS NOT NULL THEN jsonb_set(item, '{bookUrl}', to_jsonb(m.url)) ELSE item END
+    ORDER BY ord
+  ) AS items
+  FROM content_sections cs,
+       LATERAL jsonb_array_elements(cs.data->'items') WITH ORDINALITY AS t(item, ord)
+       LEFT JOIN m ON m.cid = t.item->>'id'
+  WHERE cs.key = 'packages'
+)
+UPDATE content_sections cs
+SET data = jsonb_set(cs.data, '{items}', (SELECT items FROM fixed))
+WHERE cs.key = 'packages';

package/migrations/20260730095256_c977c30e-b285-4041-8804-c0bd72b6d9b3.sql

@@ -0,0 +1,13 @@
+UPDATE public.page_versions v
+SET blocks = (
+  SELECT jsonb_agg(
+    CASE
+      WHEN b->>'type' = 'courseList' AND (b->'props'->'note') IS NULL
+      THEN jsonb_set(b, '{props,note}', '{"sv":"Alla kurser inkluderar boende, utbildningsmaterial, examen och SBA-diplom. Flyg tillkommer.","en":"All courses include accommodation, course materials, the exam and the SBA diploma. Flights are not included."}'::jsonb)
+      ELSE b
+    END ORDER BY ord
+  )
+  FROM jsonb_array_elements(v.blocks) WITH ORDINALITY AS t(b, ord)
+)
+FROM public.pages p
+WHERE p.key = 'boka' AND v.page_id = p.id;

package/migrations/20260730100057_e341b887-eb0e-4a74-850e-0ee5ffb70d7a.sql

@@ -0,0 +1,38 @@
+CREATE TABLE public.media_focus (
+  path text PRIMARY KEY,
+  focal_x smallint NOT NULL DEFAULT 50 CHECK (focal_x >= 0 AND focal_x <= 100),
+  focal_y smallint NOT NULL DEFAULT 50 CHECK (focal_y >= 0 AND focal_y <= 100),
+  created_at timestamp with time zone NOT NULL DEFAULT now(),
+  updated_at timestamp with time zone NOT NULL DEFAULT now(),
+  updated_by uuid
+);
+
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.media_focus TO authenticated;
+GRANT ALL ON public.media_focus TO service_role;
+
+ALTER TABLE public.media_focus ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "Staff read media_focus" ON public.media_focus
+  FOR SELECT TO authenticated USING (public.is_staff(auth.uid()));
+CREATE POLICY "Staff insert media_focus" ON public.media_focus
+  FOR INSERT TO authenticated WITH CHECK (public.is_staff(auth.uid()));
+CREATE POLICY "Staff update media_focus" ON public.media_focus
+  FOR UPDATE TO authenticated USING (public.is_staff(auth.uid())) WITH CHECK (public.is_staff(auth.uid()));
+CREATE POLICY "Staff delete media_focus" ON public.media_focus
+  FOR DELETE TO authenticated USING (public.is_staff(auth.uid()));
+
+CREATE OR REPLACE FUNCTION public.touch_media_focus()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path = public
+AS $$
+BEGIN
+  NEW.updated_at = now();
+  NEW.updated_by = auth.uid();
+  RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER touch_media_focus_before_update
+BEFORE UPDATE ON public.media_focus
+FOR EACH ROW EXECUTE FUNCTION public.touch_media_focus();

package/migrations/20260730103703_d5c4e1b7-1e2c-4dd0-be4e-185c159ade69.sql

@@ -0,0 +1,62 @@
+CREATE TABLE public.site_injections (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  name text NOT NULL DEFAULT 'Untitled',
+  scope_type text NOT NULL DEFAULT 'global',
+  scope_value text NOT NULL DEFAULT '',
+  enabled boolean NOT NULL DEFAULT false,
+  head_html text NOT NULL DEFAULT '',
+  body_start_html text NOT NULL DEFAULT '',
+  body_end_html text NOT NULL DEFAULT '',
+  gtm_id text NOT NULL DEFAULT '',
+  ga4_id text NOT NULL DEFAULT '',
+  meta_pixel_id text NOT NULL DEFAULT '',
+  tiktok_pixel_id text NOT NULL DEFAULT '',
+  extra_meta jsonb NOT NULL DEFAULT '[]'::jsonb,
+  sort_order integer NOT NULL DEFAULT 100,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  updated_by uuid,
+  CONSTRAINT site_injections_scope_type_check
+    CHECK (scope_type IN ('global', 'locale', 'domain'))
+);
+
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.site_injections TO authenticated;
+GRANT ALL ON public.site_injections TO service_role;
+
+ALTER TABLE public.site_injections ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "Staff read site_injections"
+  ON public.site_injections FOR SELECT TO authenticated
+  USING (is_staff(auth.uid()));
+
+CREATE POLICY "Admins insert site_injections"
+  ON public.site_injections FOR INSERT TO authenticated
+  WITH CHECK (has_role(auth.uid(), 'admin'::app_role));
+
+CREATE POLICY "Admins update site_injections"
+  ON public.site_injections FOR UPDATE TO authenticated
+  USING (has_role(auth.uid(), 'admin'::app_role))
+  WITH CHECK (has_role(auth.uid(), 'admin'::app_role));
+
+CREATE POLICY "Admins delete site_injections"
+  ON public.site_injections FOR DELETE TO authenticated
+  USING (has_role(auth.uid(), 'admin'::app_role));
+
+CREATE OR REPLACE FUNCTION public.touch_site_injections()
+RETURNS trigger
+LANGUAGE plpgsql
+SET search_path TO 'public'
+AS $$
+BEGIN
+  NEW.updated_at = now();
+  NEW.updated_by = auth.uid();
+  RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER touch_site_injections
+BEFORE UPDATE ON public.site_injections
+FOR EACH ROW EXECUTE FUNCTION public.touch_site_injections();
+
+INSERT INTO public.site_injections (name, scope_type, scope_value, enabled, sort_order)
+VALUES ('All sites', 'global', '', false, 10);

package/migrations/20260730105635_3557b7da-919e-48db-8c92-8221d68d3cf9.sql

@@ -0,0 +1,29 @@
+CREATE TABLE public.media_trash (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  original_path text NOT NULL,
+  paths jsonb NOT NULL DEFAULT '[]'::jsonb,
+  trash_prefix text NOT NULL,
+  size_bytes bigint NOT NULL DEFAULT 0,
+  content_type text,
+  deleted_by uuid,
+  deleted_by_email text,
+  usage_snapshot jsonb NOT NULL DEFAULT '[]'::jsonb,
+  created_at timestamp with time zone NOT NULL DEFAULT now(),
+  deleted_at timestamp with time zone NOT NULL DEFAULT now()
+);
+
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.media_trash TO authenticated;
+GRANT ALL ON public.media_trash TO service_role;
+
+ALTER TABLE public.media_trash ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "Staff read media_trash" ON public.media_trash
+  FOR SELECT TO authenticated USING (is_staff(auth.uid()));
+
+CREATE POLICY "Staff insert media_trash" ON public.media_trash
+  FOR INSERT TO authenticated WITH CHECK (is_staff(auth.uid()));
+
+CREATE POLICY "Superadmins delete media_trash" ON public.media_trash
+  FOR DELETE TO authenticated USING (has_role(auth.uid(), 'superadmin'::app_role));
+
+CREATE INDEX media_trash_deleted_at_idx ON public.media_trash (deleted_at DESC);

package/migrations/20260730120308_12ff8cfb-43f9-4070-abde-61531ad3b75f.sql

@@ -0,0 +1,73 @@
+
+DO $$
+DECLARE
+  v_page_id uuid := '35fe1548-05fc-4e62-8323-c9f608574eb7';
+  v_cur uuid;
+  v_blocks jsonb;
+  b1 jsonb; b2 jsonb;
+  gs1 uuid; gs2 uuid; gv1 uuid; gv2 uuid;
+  new_blocks jsonb := '[]'::jsonb;
+  el jsonb;
+  next_no int;
+  new_ver uuid;
+BEGIN
+  SELECT current_version_id INTO v_cur FROM public.pages WHERE id = v_page_id;
+  SELECT blocks INTO v_blocks FROM public.page_versions WHERE id = v_cur;
+
+  SELECT b INTO b1 FROM jsonb_array_elements(v_blocks) t(b) WHERE b->>'id' = 'mediaSplit_8lyj9ip';
+  SELECT b INTO b2 FROM jsonb_array_elements(v_blocks) t(b) WHERE b->>'id' = 'mediaSplit_c66vhm7';
+  -- One-off content back-fill against rows that only exist in the live
+  -- database. On a fresh self-hosted install there is nothing to convert, so
+  -- it must be a no-op instead of aborting the whole initialisation.
+  IF b1 IS NULL OR b2 IS NULL THEN
+    RAISE NOTICE 'skipping global-section extraction: source blocks not present';
+    RETURN;
+  END IF;
+
+  INSERT INTO public.global_sections (key, name)
+  VALUES ('bartender-utbildning-utomlands', 'Bartender utbildning utomlands')
+  ON CONFLICT (key) DO UPDATE SET name = EXCLUDED.name
+  RETURNING id INTO gs1;
+
+  INSERT INTO public.global_sections (key, name)
+  VALUES ('utbildningen-mer-an-ett-diplom', 'Utbildningen som ger dig mer än ett diplom')
+  ON CONFLICT (key) DO UPDATE SET name = EXCLUDED.name
+  RETURNING id INTO gs2;
+
+  INSERT INTO public.global_section_versions (section_id, version_no, blocks, note)
+  VALUES (gs1, COALESCE((SELECT max(version_no) FROM public.global_section_versions WHERE section_id = gs1), 0) + 1,
+          jsonb_build_array(b1), 'Copied from homepage')
+  RETURNING id INTO gv1;
+
+  INSERT INTO public.global_section_versions (section_id, version_no, blocks, note)
+  VALUES (gs2, COALESCE((SELECT max(version_no) FROM public.global_section_versions WHERE section_id = gs2), 0) + 1,
+          jsonb_build_array(b2), 'Copied from homepage')
+  RETURNING id INTO gv2;
+
+  UPDATE public.global_sections SET current_version_id = gv1 WHERE id = gs1;
+  UPDATE public.global_sections SET current_version_id = gv2 WHERE id = gs2;
+
+  FOR el IN SELECT b FROM jsonb_array_elements(v_blocks) t(b) LOOP
+    IF el->>'id' = 'mediaSplit_8lyj9ip' THEN
+      new_blocks := new_blocks || jsonb_build_array(jsonb_build_object(
+        'id', 'globalRef_bartender_utomlands', 'type', 'globalRef',
+        'props', jsonb_build_object('sectionKey', 'bartender-utbildning-utomlands')));
+    ELSIF el->>'id' = 'mediaSplit_c66vhm7' THEN
+      new_blocks := new_blocks || jsonb_build_array(jsonb_build_object(
+        'id', 'globalRef_mer_an_ett_diplom', 'type', 'globalRef',
+        'props', jsonb_build_object('sectionKey', 'utbildningen-mer-an-ett-diplom')));
+    ELSE
+      new_blocks := new_blocks || jsonb_build_array(el);
+    END IF;
+  END LOOP;
+
+  SELECT COALESCE(max(version_no), 0) + 1 INTO next_no FROM public.page_versions WHERE page_id = v_page_id;
+  INSERT INTO public.page_versions (page_id, version_no, blocks, note)
+  VALUES (v_page_id, next_no, new_blocks, 'Extracted two media split blocks into global sections')
+  RETURNING id INTO new_ver;
+
+  UPDATE public.pages SET current_version_id = new_ver WHERE id = v_page_id;
+  UPDATE public.page_publications SET is_active = false WHERE page_id = v_page_id AND is_active;
+  INSERT INTO public.page_publications (page_id, version_id, is_active, note)
+  VALUES (v_page_id, new_ver, true, 'Global section extraction');
+END $$;