@bygghammar/cms-platform 0.11.0 → 0.13.0

package/migrations/20260802202702_c30cd837-744c-4641-85f1-edd3a7ebbcb6.sql

@@ -0,0 +1,16 @@
+CREATE OR REPLACE FUNCTION app.current_user_id()
+RETURNS uuid
+LANGUAGE sql
+STABLE
+SECURITY INVOKER
+SET search_path = auth, public, pg_temp
+AS $$
+  SELECT auth.uid()
+$$;
+
+REVOKE ALL ON FUNCTION app.has_role(uuid, public.app_role) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION app.is_staff(uuid) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION app.has_role(uuid, public.app_role) TO service_role;
+GRANT EXECUTE ON FUNCTION app.is_staff(uuid) TO service_role;
+
+GRANT EXECUTE ON FUNCTION app.current_user_id() TO anon, authenticated, service_role;

package/migrations/20260802202720_4418d18d-c851-42dc-9345-78fc330128ae.sql

@@ -0,0 +1,2 @@
+REVOKE ALL ON FUNCTION public.ensure_app_user() FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.ensure_app_user() TO service_role;

package/migrations/20260803132514_78ba1f53-c85b-4457-96b1-7d49c5c8b494.sql

@@ -0,0 +1,34 @@
+-- Least-privilege public read on forms.
+-- Visitors must never be able to read private_settings (notification
+-- recipients, webhook secrets, spreadsheet ids). The original migration
+-- granted only a column subset; some environments drifted to a table-wide
+-- grant. Re-assert the column list here so hosted and self-hosted match.
+REVOKE ALL ON public.forms FROM anon;
+GRANT SELECT (id, key, name, form_type, fields, public_settings, is_active, deleted_at)
+  ON public.forms TO anon;
+
+-- The public renderer needs exactly two values out of private_settings.
+-- Expose them through a security-definer function instead of widening the
+-- column grant.
+CREATE OR REPLACE FUNCTION public.form_public_runtime(_key text)
+RETURNS jsonb
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT jsonb_strip_nulls(
+    jsonb_build_object(
+      'spamMinSeconds', f.private_settings -> 'spamMinSeconds',
+      'savePartials',   f.private_settings -> 'savePartials'
+    )
+  )
+  FROM public.forms f
+  WHERE f.key = _key
+    AND f.is_active = true
+    AND f.deleted_at IS NULL
+  LIMIT 1
+$$;
+
+REVOKE ALL ON FUNCTION public.form_public_runtime(text) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.form_public_runtime(text) TO anon, authenticated, service_role;

package/migrations/20260803181201_28c8aa09-baa8-431c-8338-90b1af9c8172.sql

@@ -0,0 +1,22 @@
+CREATE OR REPLACE FUNCTION public.form_public_runtime(_key text)
+RETURNS jsonb
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = ''
+AS $$
+  SELECT pg_catalog.jsonb_strip_nulls(
+    pg_catalog.jsonb_build_object(
+      'spamMinSeconds', f.private_settings -> 'spamMinSeconds',
+      'savePartials',   f.private_settings -> 'savePartials'
+    )
+  )
+  FROM public.forms f
+  WHERE f.key = _key
+    AND f.is_active = true
+    AND f.deleted_at IS NULL
+  LIMIT 1
+$$;
+
+REVOKE ALL ON FUNCTION public.form_public_runtime(text) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.form_public_runtime(text) TO anon, authenticated, service_role;

package/migrations/20260803201518_6e8a6028-b70f-4a7d-8bc9-95c86304e7ae.sql

@@ -0,0 +1,12 @@
+-- Neutralised: this migration originally hardcoded an absolute hosted storage
+-- URL for the homepage hero poster. Absolute hosted URLs are not portable and
+-- must never reach a self-hosted database (this directory is replayed by
+-- deploy/initdb/10-schema.sh on a fresh PostgreSQL volume).
+--
+-- The portable replacement lives in db/selfhost/upgrades/0002_optimized_hero_media.sql
+-- and is applied by scripts/install-media-package.ts, which first verifies that
+-- the optimized media actually exists in the media volume.
+--
+-- Hosted behaviour is preserved: the hosted database already ran the original
+-- statement, and its rows were rewritten to site-relative /media/ paths.
+SELECT 1;

package/migrations/20260803201535_32a9a213-cb92-4035-b8cd-8211ca34af68.sql

@@ -0,0 +1,12 @@
+-- Neutralised: this migration originally hardcoded an absolute hosted storage
+-- URL for the homepage hero poster. Absolute hosted URLs are not portable and
+-- must never reach a self-hosted database (this directory is replayed by
+-- deploy/initdb/10-schema.sh on a fresh PostgreSQL volume).
+--
+-- The portable replacement lives in db/selfhost/upgrades/0002_optimized_hero_media.sql
+-- and is applied by scripts/install-media-package.ts, which first verifies that
+-- the optimized media actually exists in the media volume.
+--
+-- Hosted behaviour is preserved: the hosted database already ran the original
+-- statement, and its rows were rewritten to site-relative /media/ paths.
+SELECT 1;

package/migrations/20260811103505_29df753d-14fa-4a05-8fea-f4207785fba3.sql

@@ -0,0 +1,35 @@
+-- These policies and triggers were introduced by earlier migrations. Reassert
+-- their final definitions idempotently so a fresh database can replay the
+-- complete Lovable migration history without failing on duplicate objects.
+DROP POLICY IF EXISTS "Admins can read media" ON storage.objects;
+CREATE POLICY "Admins can read media"
+ON storage.objects FOR SELECT TO authenticated
+USING (bucket_id = 'media' AND public.has_role(auth.uid(), 'admin'));
+
+DROP POLICY IF EXISTS "Admins can upload media" ON storage.objects;
+CREATE POLICY "Admins can upload media"
+ON storage.objects FOR INSERT TO authenticated
+WITH CHECK (bucket_id = 'media' AND public.has_role(auth.uid(), 'admin'));
+
+DROP POLICY IF EXISTS "Admins can update media" ON storage.objects;
+CREATE POLICY "Admins can update media"
+ON storage.objects FOR UPDATE TO authenticated
+USING (bucket_id = 'media' AND public.has_role(auth.uid(), 'admin'))
+WITH CHECK (bucket_id = 'media' AND public.has_role(auth.uid(), 'admin'));
+
+DROP POLICY IF EXISTS "Admins can delete media" ON storage.objects;
+CREATE POLICY "Admins can delete media"
+ON storage.objects FOR DELETE TO authenticated
+USING (bucket_id = 'media' AND public.has_role(auth.uid(), 'admin'));
+
+DROP TRIGGER IF EXISTS on_auth_user_created_grant_admin ON auth.users;
+CREATE TRIGGER on_auth_user_created_grant_admin
+  AFTER INSERT ON auth.users
+  FOR EACH ROW EXECUTE FUNCTION public.grant_initial_admin();
+
+DROP TRIGGER IF EXISTS on_auth_user_confirmed_grant_admin ON auth.users;
+CREATE TRIGGER on_auth_user_confirmed_grant_admin
+  AFTER UPDATE OF email_confirmed_at ON auth.users
+  FOR EACH ROW
+  WHEN (OLD.email_confirmed_at IS NULL AND NEW.email_confirmed_at IS NOT NULL)
+  EXECUTE FUNCTION public.grant_initial_admin();

package/migrations/20260811112455_217c4028-f587-4c98-9e4f-9e6c452ab761.sql

@@ -0,0 +1,20 @@
+UPDATE public.page_seo SET seo = jsonb_set(seo, '{title,sv}', to_jsonb(v.title)) FROM (VALUES
+ ('home','Nordens största partykryssning och festkryssning | Voyara'),
+ ('artister','Artister på vinterns hetaste partykryssning · Voyara'),
+ ('hytter','Hytter ombord · Voyara partykryssning'),
+ ('mat-och-dryck','Mat och dryck på Voyara · Partykryssning'),
+ ('tallinn','Tallinn · Voyara partykryssning'),
+ ('sakerhet','Säkerhet och en trygg miljö · Voyara'),
+ ('galleri','Galleri · Voyara partykryssning'),
+ ('faq','FAQ · Voyara partykryssning'),
+ ('boka','Boka nu · Voyara partykryssning'),
+ ('samarbete','Samarbete · Voyara partykryssning'),
+ ('ambassador','Bli ambassadör · Voyara partykryssning'),
+ ('kontakt','Kontakta oss · Voyara'),
+ ('intresse','Intresseanmälan · Voyara partykryssning')
+) AS v(page_key, title) WHERE public.page_seo.page_key = v.page_key;
+
+UPDATE public.page_seo SET seo = jsonb_set(seo, '{description,sv}', to_jsonb(v.descr)) FROM (VALUES
+ ('home','Välkommen till en festkryssning och partykryssning utöver det vanliga. Artister, DJ:s och shower varje kväll — studenter och alla är välkomna.'),
+ ('artister','Välkommen till partykryssningen med de hetaste artisterna. Ett unikt nöjeskoncept i två dagar med uppträdanden båda kvällarna.')
+) AS v(page_key, descr) WHERE public.page_seo.page_key = v.page_key;

package/migrations/20260811114438_6687d67d-bad3-4803-9638-8b7670d2e5d4.sql

@@ -0,0 +1,86 @@
+begin;
+
+with p as (select id from public.pages where key = 'home'),
+cur as (
+  select v.blocks from public.page_versions v
+  join public.pages pg on pg.current_version_id = v.id
+  where pg.key = 'home'
+),
+tiles as (
+  select jsonb_build_object(
+    'id', 'blk-link-tiles-home',
+    'type', 'linkTiles',
+    'name', 'Boka / Elevkårer / Ambassadör',
+    'props', jsonb_build_object(
+      'tone', 'white',
+      'columns', 3,
+      'gap', 'md',
+      'aspect', 'portrait',
+      'overlay', 'brand',
+      'labelAlign', 'left',
+      'rounded', false,
+      'items', jsonb_build_array(
+        jsonb_build_object(
+          'id', 'tile-boka',
+          'image', 'https://ybnqylupuisyhuldqrgt.supabase.co/storage/v1/object/public/media/boka-nu.jpg',
+          'label', jsonb_build_object('sv', 'Boka nu'),
+          'alt', jsonb_build_object('sv', 'Publik framför scenen på Voyara partykryssning'),
+          'href', '/boka'
+        ),
+        jsonb_build_object(
+          'id', 'tile-elevkarer',
+          'image', 'https://ybnqylupuisyhuldqrgt.supabase.co/storage/v1/object/public/media/artister-scen.jpg',
+          'label', jsonb_build_object('sv', 'För elevkårer'),
+          'alt', jsonb_build_object('sv', 'Artist på scen ombord'),
+          'href', '/samarbete'
+        ),
+        jsonb_build_object(
+          'id', 'tile-ambassador',
+          'image', 'https://ybnqylupuisyhuldqrgt.supabase.co/storage/v1/object/public/media/voyara-publik.jpg',
+          'label', jsonb_build_object('sv', 'Bli ambassadör'),
+          'alt', jsonb_build_object('sv', 'Gäster som festar ombord'),
+          'href', '/ambassador'
+        )
+      )
+    )
+  ) as blk
+),
+newblocks as (
+  select (
+    select coalesce(jsonb_agg(x.b order by x.idx), '[]'::jsonb)
+    from (
+      select b, idx::numeric as idx from cur, lateral jsonb_array_elements(cur.blocks) with ordinality t(b, idx)
+      where b->>'type' <> 'linkTiles'
+      union all
+      select (select blk from tiles),
+             coalesce((
+               select max(idx) + 0.5 from cur, lateral jsonb_array_elements(cur.blocks) with ordinality t(b, idx)
+               where b->>'type' = 'courseList'
+             ), 999)
+    ) x
+  ) as blocks
+),
+ins as (
+  insert into public.page_versions (page_id, version_no, blocks, note, created_by_email)
+  select p.id,
+         coalesce((select max(version_no) from public.page_versions pv where pv.page_id = p.id), 0) + 1,
+         (select blocks from newblocks),
+         'Add link tiles row (Boka / Elevkårer / Ambassadör)',
+         'system'
+  from p
+  returning id, page_id
+),
+deact as (
+  update public.page_publications pp set is_active = false
+  where pp.page_id = (select id from p) and pp.is_active
+  returning 1
+),
+pub as (
+  insert into public.page_publications (page_id, version_id, note)
+  select page_id, id, 'Add link tiles row' from ins
+  returning page_id, version_id
+)
+update public.pages pg set current_version_id = pub.version_id, updated_at = now()
+from pub where pg.id = pub.page_id;
+
+commit;

package/migrations/20260811130318_7cb95e95-9baa-40af-8f3f-de1d4e09cec4.sql

@@ -0,0 +1 @@
+UPDATE page_versions v SET blocks = (SELECT jsonb_agg(CASE WHEN b->>'type'='linkTiles' THEN jsonb_set(b, '{props,labelAlign}', '"center"') ELSE b END) FROM jsonb_array_elements(v.blocks) b) FROM pages p WHERE v.id=p.current_version_id AND p.key='home';

package/migrations/20260811220548_80d99ec2-bd4b-475d-a627-9408bb60ce56.sql

@@ -0,0 +1 @@
+UPDATE public.locale_domains SET domain = 'byggis.voyara.se', updated_at = now() WHERE domain = 'www.dev.barskola.nu';

package/migrations/20260811222519_6b040f56-4de3-49e0-92e4-d9deec5ead6a.sql

@@ -0,0 +1,3 @@
+UPDATE public.page_versions
+SET blocks = replace(blocks::text, 'booking.summerinvasion.se', 'booking.voyara.se')::jsonb
+WHERE blocks::text LIKE '%booking.summerinvasion.se%';