@bygghammar/cms-platform 0.90.0-m7.9 → 0.91.0

package/src/platform/contract.ts

@@ -7,9 +7,56 @@
  *
  * Bump `PLATFORM_CONTRACT_VERSION` whenever a shared screen starts requiring
  * schema or adapter capabilities an older site would not have.
+ *
+ * ## v2 — publication rows decide what is public
+ *
+ * Saving a page version, publishing, unpublishing, scheduling a countdown
+ * reveal, trashing a page and restoring one are each a single database
+ * function call now, because each is several statements that must commit
+ * together or not at all. There is deliberately no JavaScript fallback for a
+ * database that lacks them: compensating for a half-applied publish with more
+ * un-transacted statements is the very thing that does not work. A site on v1
+ * schema cannot save a draft, so this is a contract change and not a
+ * click-time surprise.
+ *
+ * Three canonical migrations are new since the last published `0.90.0-m7.12`
+ * package, so a site upgrading from that baseline is missing all three:
+ *
+ *   - `20260904090000_…sql` — restates the `draft` default, records the
+ *     `pages.status` column semantics at that migration step, and adds two
+ *     partial `pages` indexes: one on `key` for undeleted status-published
+ *     rows, one on `status`/`updated_at` for undeleted rows.
+ *   - `20260904140000_…sql` — `page_publications`, the backfill for pages that
+ *     were already live, and the first transactional page functions.
+ *   - `20260904160000_…sql` — the rest of the transactional page lifecycle:
+ *     reveals, trash, restore and cancellation, plus two repair `UPDATE`s.
+ *
+ * The last two are the contract-v2 publication pair — they are what this
+ * version number means. All three are in `SCHEMA_MIGRATIONS`, though, so
+ * `missingMigrations` and `compareSchema` report every one that has not been
+ * applied, and applying only the pair still leaves the schema out of sync.
+ *
+ * Release order, and it is not optional:
+ *
+ *   1. Apply every missing canonical migration. Upgrading from the published
+ *      `0.90.0-m7.12` baseline, that is all three files above, in
+ *      chronological order.
+ *   2. Deploy this package, and the site pinned to contract v2 with it.
+ *   3. Verify both: `missingMigrations(applied)` — or `compareSchema(applied)`
+ *      behind the version screen — reports no missing canonical migration, and
+ *      `assertPlatformContract(2)` passes. The second compares two numbers in
+ *      the site's own code and never reads the database, so it is no substitute
+ *      for the first.
+ *   4. Let editors back in.
+ *
+ * The migrations are meant to be applied before the v2 package is deployed, and
+ * the still-running m7.12 package stays compatible with them during that
+ * ordered rollout. They are not pure DDL and not function-only: the set also
+ * carries an `ALTER … SET DEFAULT`, indexes and a column comment, a backfill
+ * `INSERT`, and two repair `UPDATE`s scoped to pages already in the trash.
  */
 
-export const PLATFORM_CONTRACT_VERSION = 1 as const;
+export const PLATFORM_CONTRACT_VERSION = 2 as const;
 
 /**
  * Canonical migration filenames, oldest first. Files live in the published
@@ -71,6 +118,10 @@ export const SCHEMA_MIGRATIONS: readonly string[] = [
   "20260818040722_1bdf1b8f-7fb0-4ae8-8ecf-73f1fadff3c2.sql",
   "20260818040808_69a5e832-57e8-4aa7-aff8-7fd7777faa7c.sql",
   "20260818040839_e6523163-bbf5-4a39-9233-91759059569a.sql",
+  "20260902090000_dc072b25-8467-46ae-aef3-0ccdf40aa7eb.sql",
+  "20260904090000_c54603f8-a155-40f8-a86c-54434aa5c0ae.sql",
+  "20260904140000_9f2a7c41-06d5-4d6b-8b4e-1c7a5d3e9b20.sql",
+  "20260904160000_0d565000-2839-4738-aacc-537d7090398f.sql",
 ];
 
 export function missingMigrations(applied: readonly string[]): string[] {

package/src/runtime/server-entry.ts

@@ -31,6 +31,11 @@ export type ServerEntryOptions = {
    * enters the SSR module graph for sites that do not use it.
    */
   injections?: () => Promise<SiteCodeInjections>;
+  /**
+   * The site's backoffice path, so a site that moved it off the default still
+   * keeps tracking code out of its admin pages.
+   */
+  backofficePath?: string;
 };
 
 type ServerEntry = {
@@ -86,6 +91,7 @@ async function injectSiteCode(
   request: Request,
   response: Response,
   load: () => Promise<SiteCodeInjections>,
+  backofficePath: string | undefined,
 ): Promise<Response> {
   if (response.status >= 400) return response;
   const contentType = response.headers.get("content-type") ?? "";
@@ -94,7 +100,7 @@ async function injectSiteCode(
   try {
     const injections = await load();
     const url = new URL(request.url);
-    if (!injections.isInjectablePath(url.pathname)) return response;
+    if (!injections.isInjectablePath(url.pathname, backofficePath)) return response;
 
     const bundle = await injections.resolve(url.host);
     if (!bundle.head && !bundle.bodyStart && !bundle.bodyEnd) return response;
@@ -118,7 +124,7 @@ export function createServerEntry(options: ServerEntryOptions = {}) {
         const response = await handler.fetch(request, env, ctx);
         const normalized = await normalizeCatastrophicSsrResponse(response);
         const injected = options.injections
-          ? await injectSiteCode(request, normalized, options.injections)
+          ? await injectSiteCode(request, normalized, options.injections, options.backofficePath)
           : normalized;
         return await applyEdgeHeaders(request, injected, { compress: compressionEnabled() });
       } catch (error) {

package/src/server/content-sections-core.ts

@@ -10,6 +10,7 @@
 import type { Json } from "../i18n/json";
 import { stampManualEdits } from "../i18n/translation-meta";
 import { EDIT_LOCK_TYPES } from "../cms/edit-lock";
+import { scheduleProblemsIn } from "../cms/visibility-schedule";
 import { assertEditable } from "./edit-locks-core";
 import { assertStaff, type PlatformAuthContext } from "./guards";
 import { auditAs } from "./audit-core";
@@ -71,6 +72,21 @@ export async function saveContentSectionCore(
     sessionId: input.editSessionId,
   });
 
+  /*
+   * The editor shows schedule problems as you type, but the editor is not a
+   * boundary — this core is. A window that closes before it opens describes
+   * content that can never be visible, so it is refused here whatever sent it,
+   * with the path of the offending item so the message is actionable.
+   */
+  const problems = scheduleProblemsIn(input.data);
+  if (problems.length > 0) {
+    const first = problems[0]!;
+    throw new Error(
+      `Cannot save ${input.key}: ${first.path} — ${first.problem}` +
+        (problems.length > 1 ? ` (${problems.length - 1} more)` : ""),
+    );
+  }
+
   const { data: prevRow } = await context.supabase
     .from("content_sections")
     .select("data")

package/src/server/domains-core.ts

@@ -1,39 +1,36 @@
 /**
- * Host-agnostic logic for locale → domain mapping (`locale_domains`).
+ * Host-agnostic database logic for locale → domain mapping (`locale_domains`).
  *
  * Reads use a privileged client because the table reveals which hostname serves
- * the backoffice; writes run as the signed-in staff user. The host owns the
- * server functions, its locale union and the request headers.
+ * the backoffice; writes run as the signed-in admin, matching the table's own
+ * row-level policies. The host owns the server functions, its locale union and
+ * the request headers.
+ *
+ * The routing itself — matching, the public projection, and which hostname
+ * serves the backoffice — is pure and lives in `src/site/locale-domains.ts`,
+ * re-exported here so server callers keep one import.
  */
 
-import { assertStaff, type PlatformAuthContext } from "./guards";
+import { assertRole, type PlatformAuthContext } from "./guards";
 import { auditAs } from "./audit-core";
+import {
+  canonicalDomainProblemMessage,
+  parseCanonicalDomain,
+} from "../site/host";
+import {
+  domainChangeProblemMessage,
+  validateDomainChange,
+  type AdminDomainChange,
+  type LocaleDomainRecord,
+} from "../site/locale-domains";
+
+export * from "../site/locale-domains";
 
 /* eslint-disable @typescript-eslint/no-explicit-any */
 /** Structural subset of a Supabase-shaped client used by this core. */
 export type DomainsClient = { from: (table: string) => any };
 /* eslint-enable @typescript-eslint/no-explicit-any */
 
-export type LocaleDomainRecord = {
-  locale: string;
-  domain: string;
-  isDefault: boolean;
-  isAdminDomain: boolean;
-};
-
-/** Strip protocol, trailing slashes and casing from a stored domain. */
-export function normalizeDomain(domain: string): string {
-  return domain
-    .replace(/^https?:\/\//, "")
-    .replace(/\/+$/, "")
-    .toLowerCase();
-}
-
-/** Strip a leading `www.` and casing from a request host. */
-export function normalizeHost(host: string): string {
-  return host.replace(/^www\./, "").toLowerCase();
-}
-
 function rowToDomain(row: {
   locale: string;
   domain: string;
@@ -58,115 +55,127 @@ export async function listLocaleDomainsCore(client: DomainsClient): Promise<Loca
   return (data ?? []).map(rowToDomain);
 }
 
-/** The mapping whose domain matches `host`, ignoring protocol and `www.`. */
-export function matchDomain(
-  domains: LocaleDomainRecord[],
-  host: string,
-): LocaleDomainRecord | undefined {
-  const normalizedHost = normalizeHost(host);
-  return domains.find((d) => {
-    const normalized = normalizeDomain(d.domain);
-    return normalizedHost === normalized || normalizedHost === `www.${normalized}`;
-  });
-}
-
 /**
- * Resolve the active locale for a request host, falling back to the default
- * mapping, then to the first mapping, then to a synthetic host-based record.
+ * Refuse a change the table must not be left in after.
+ *
+ * The current rows are read here rather than accepted from the caller. A host
+ * that forgot to pass them would otherwise skip every check silently, and the
+ * checks exist for cases — two languages on aliases of one hostname, a table
+ * left with no default — that a screen can prevent but only the database can
+ * actually know about at the moment of writing.
  */
-export function resolveRequestLocale(
-  domains: LocaleDomainRecord[],
-  host: string,
-  defaultLocale: string,
-): { locale: string; domain: LocaleDomainRecord } {
-  const match = matchDomain(domains, host);
-  if (match) return { locale: match.locale, domain: match };
-
-  const fallback = domains.find((d) => d.isDefault) ??
-    domains[0] ?? {
-      locale: defaultLocale,
-      domain: host || "localhost",
-      isDefault: true,
-      isAdminDomain: true,
-    };
-  return { locale: fallback.locale, domain: fallback };
+async function assertChangeIsAllowed(
+  client: DomainsClient,
+  change: AdminDomainChange,
+  options: { siteUrlAuthoritative: boolean; invalidDomainMessage?: string },
+): Promise<void> {
+  const problem = validateDomainChange(await listLocaleDomainsCore(client), change, {
+    siteUrlAuthoritative: options.siteUrlAuthoritative,
+  });
+  if (!problem) return;
+  if (problem.reason === "invalid-domain" && options.invalidDomainMessage) {
+    throw new Error(options.invalidDomainMessage);
+  }
+  throw new Error(domainChangeProblemMessage(problem));
 }
 
+export type SaveLocaleDomainOptions = {
+  /** Host-supplied message replacing the generic rejection text. */
+  invalidDomainMessage?: string;
+  /** `SITE_URL`'s hostname, when this install has one. */
+  forcedHost?: string | null;
+};
+
+export type DeleteLocaleDomainOptions = {
+  /** `SITE_URL`'s hostname, when this install has one. */
+  forcedHost?: string | null;
+};
+
 /**
- * The domain that serves the backoffice.
+ * Whether `SITE_URL` — not the table — decides where the backoffice is.
  *
- * `forcedHost` (a self-host `SITE_URL`) is authoritative: an imported row from
- * another deployment must never send the backoffice to that other hostname.
- * Otherwise the flagged database row wins, and the request host is last resort.
+ * The value is checked exactly as it was configured, before any normalizing.
+ * Normalizing first strips the scheme, so `ftp://example.com` becomes the
+ * perfectly valid `example.com` and a `SITE_URL` nobody can serve is treated
+ * as authoritative. That is not a cosmetic mistake: authority here switches
+ * off the lockout check below, so a malformed `SITE_URL` would let an admin
+ * domain of `localhost` be saved on an install where the flag is still what
+ * routes the backoffice — and the next administrator to sign out could not
+ * get back in.
  */
-export function resolveAdminDomain(
-  domains: LocaleDomainRecord[],
-  options: { forcedHost?: string | null; requestHost?: string | null; defaultLocale: string },
-): LocaleDomainRecord {
-  const dbAdmin = domains.find((d) => d.isAdminDomain) ?? domains[0];
-
-  if (options.forcedHost) {
-    return {
-      locale: dbAdmin?.locale ?? options.defaultLocale,
-      domain: options.forcedHost,
-      isDefault: dbAdmin?.isDefault ?? true,
-      isAdminDomain: true,
-    };
-  }
-  if (dbAdmin) return dbAdmin;
-  return {
-    locale: options.defaultLocale,
-    domain: options.requestHost || "localhost",
-    isDefault: true,
-    isAdminDomain: true,
-  };
-}
-
-/** Absolute origin for a locale, or "" when the locale has no mapping. */
-export function resolveLocaleOrigin(locale: string, domains: LocaleDomainRecord[]): string {
-  const match = domains.find((d) => d.locale === locale);
-  if (!match) return "";
-  return `https://${normalizeDomain(match.domain)}`;
+function siteUrlDecides(forcedHost: string | null | undefined): boolean {
+  return parseCanonicalDomain(forcedHost ?? "").ok;
 }
 
 /**
- * Staff-only upsert of one mapping. Keeps at most one default and one admin
- * domain by clearing the flags on every other locale first.
+ * Admin-only upsert of one mapping, matching the table's row-level policies.
+ * Keeps at most one default and one admin domain by clearing the flags on
+ * every other locale afterwards.
+ *
+ * The order is deliberate. There is no transaction here, so the row being
+ * saved is written first and the flags elsewhere are cleared only once it
+ * exists: an upsert that fails then changes nothing, instead of stripping the
+ * default or the admin domain off the rows that still hold it. Every statement
+ * is checked, and the audit entry is written only after all of them succeeded,
+ * so the log never claims a change that half happened. A later migration can
+ * make this atomic; until then this is the order that fails safely.
  */
 export async function saveLocaleDomainCore(
   context: PlatformAuthContext & { supabase: DomainsClient },
   input: { locale: string; domain: string; isDefault: boolean; isAdminDomain: boolean },
-  options: { invalidDomainMessage?: string } = {},
+  options: SaveLocaleDomainOptions = {},
 ): Promise<{ ok: true }> {
-  await assertStaff(context);
+  await assertRole(context, "admin");
+
+  const parsed = parseCanonicalDomain(input.domain);
+  if (!parsed.ok) {
+    throw new Error(
+      options.invalidDomainMessage ?? canonicalDomainProblemMessage(parsed.reason),
+    );
+  }
+  const normalized = parsed.domain;
+
+  await assertChangeIsAllowed(
+    context.supabase,
+    {
+      kind: "save",
+      locale: input.locale,
+      domain: normalized,
+      isDefault: input.isDefault,
+      isAdminDomain: input.isAdminDomain,
+    },
+    {
+      siteUrlAuthoritative: siteUrlDecides(options.forcedHost),
+      invalidDomainMessage: options.invalidDomainMessage,
+    },
+  );
 
-  const normalized = normalizeDomain(input.domain);
-  if (!normalized) throw new Error(options.invalidDomainMessage ?? "Invalid domain");
+  const upserted = await context.supabase.from("locale_domains").upsert(
+    {
+      locale: input.locale,
+      domain: normalized,
+      is_default: input.isDefault,
+      is_admin_domain: input.isAdminDomain,
+    },
+    { onConflict: "locale" },
+  );
+  if (upserted.error) throw new Error(upserted.error.message);
 
   if (input.isDefault) {
-    await context.supabase
+    const cleared = await context.supabase
       .from("locale_domains")
       .update({ is_default: false })
       .neq("locale", input.locale);
+    if (cleared.error) throw new Error(cleared.error.message);
   }
   if (input.isAdminDomain) {
-    await context.supabase
+    const cleared = await context.supabase
       .from("locale_domains")
       .update({ is_admin_domain: false })
       .neq("locale", input.locale);
+    if (cleared.error) throw new Error(cleared.error.message);
   }
 
-  const { error } = await context.supabase.from("locale_domains").upsert(
-    {
-      locale: input.locale,
-      domain: normalized,
-      is_default: input.isDefault,
-      is_admin_domain: input.isAdminDomain,
-    },
-    { onConflict: "locale" },
-  );
-  if (error) throw new Error(error.message);
-
   await auditAs(context as never, {
     action: "domain.save",
     entity: "locale_domains",
@@ -181,12 +190,20 @@ export async function saveLocaleDomainCore(
   return { ok: true };
 }
 
-/** Staff-only delete of one mapping. */
+/** Admin-only delete of one mapping. */
 export async function deleteLocaleDomainCore(
   context: PlatformAuthContext & { supabase: DomainsClient },
   locale: string,
+  options: DeleteLocaleDomainOptions = {},
 ): Promise<{ ok: true }> {
-  await assertStaff(context);
+  await assertRole(context, "admin");
+
+  await assertChangeIsAllowed(
+    context.supabase,
+    { kind: "delete", locale },
+    { siteUrlAuthoritative: siteUrlDecides(options.forcedHost) },
+  );
+
   const { error } = await context.supabase.from("locale_domains").delete().eq("locale", locale);
   if (error) throw new Error(error.message);
   await auditAs(context as never, {

package/src/server/forms-delivery-core.ts

@@ -15,6 +15,12 @@
 import type { FormFieldDef } from "../forms/field-sets";
 import { sendViaProvider } from "./email-send-core";
 import { logEmail } from "./email-log-core";
+import { appendGoogleSheetRow, DEFAULT_WORKSHEET } from "./google-sheets-core";
+import {
+  GOOGLE_SA_EMAIL_ENV,
+  GOOGLE_SA_KEY_ENV,
+  hasGoogleServiceAccount,
+} from "./google-service-account";
 
 /* eslint-disable @typescript-eslint/no-explicit-any */
 /** Structural subset of a Supabase-shaped privileged client. */
@@ -398,24 +404,33 @@ export async function sendAutoreplyCore(
   );
 }
 
-const GATEWAY = "https://connector-gateway.lovable.dev/google_sheets/v4";
+/**
+ * Legacy connector gateway.
+ *
+ * Kept only so installations configured before service-account delivery keep
+ * working untouched; it is never used when a Google service account is
+ * present, and it is the path to remove once every site has migrated.
+ */
+const LEGACY_GATEWAY = "https://connector-gateway.lovable.dev/google_sheets/v4";
 
-/** Append one submission row to a Google Sheet via the connector gateway. */
-export async function appendToSheetCore(opts: {
+async function appendViaLegacyGateway(opts: {
   sheetId: string;
   tab: string;
   values: string[];
 }): Promise<DeliveryResult> {
-  const lovableKey = process.env['LOVABLE_API_KEY'];
-  const connKey = process.env['GOOGLE_SHEETS_API_KEY'];
-  if (!opts.sheetId) return { ok: false, error: "No Google Sheet configured." };
-  if (!lovableKey || !connKey)
-    return { ok: false, error: "Google Sheets is not connected for this project." };
+  const lovableKey = process.env["LOVABLE_API_KEY"];
+  const connKey = process.env["GOOGLE_SHEETS_API_KEY"];
+  if (!lovableKey || !connKey) {
+    return {
+      ok: false,
+      error: `Google Sheets is not configured. Set ${GOOGLE_SA_EMAIL_ENV} and ${GOOGLE_SA_KEY_ENV} on the server, then share the spreadsheet with that address.`,
+    };
+  }
 
-  const tab = opts.tab?.trim() || "Sheet1";
+  const tab = opts.tab?.trim() || DEFAULT_WORKSHEET;
   const range = `${tab}!A:Z`;
   const res = await fetch(
-    `${GATEWAY}/spreadsheets/${opts.sheetId}/values/${range}:append?valueInputOption=USER_ENTERED&insertDataOption=INSERT_ROWS`,
+    `${LEGACY_GATEWAY}/spreadsheets/${opts.sheetId}/values/${range}:append?valueInputOption=USER_ENTERED&insertDataOption=INSERT_ROWS`,
     {
       method: "POST",
       headers: {
@@ -434,6 +449,42 @@ export async function appendToSheetCore(opts: {
   return { ok: true };
 }
 
+/**
+ * Append one submission row to a Google Sheet.
+ *
+ * Uses the server's Google service account when one is configured — the sheet
+ * stays private and is simply shared with the account — and falls back to the
+ * legacy connector gateway for installations that have not migrated yet.
+ *
+ * Never throws: the submission is already stored and must never be lost
+ * because a spreadsheet was unreachable.
+ */
+export async function appendToSheetCore(opts: {
+  sheetId: string;
+  tab: string;
+  values: string[];
+}): Promise<DeliveryResult> {
+  if (!opts.sheetId) return { ok: false, error: "No Google Sheet configured." };
+
+  try {
+    if (hasGoogleServiceAccount()) {
+      const res = await appendGoogleSheetRow({
+        spreadsheetId: opts.sheetId,
+        tab: opts.tab,
+        values: opts.values,
+      });
+      if (res.ok) return { ok: true };
+      console.error(`[forms] sheets append failed [${res.code}]: ${res.error}`);
+      return { ok: false, error: res.error };
+    }
+    return await appendViaLegacyGateway(opts);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`[forms] sheets append threw: ${message}`);
+    return { ok: false, error: `Google Sheets delivery failed: ${message.slice(0, 300)}` };
+  }
+}
+
 /**
  * POST one submission to an external endpoint (CRM, Zapier, Make…).
  * Signed with an optional shared secret so the receiver can verify origin.

package/src/server/forms-submissions-core.ts

@@ -49,6 +49,11 @@ import {
   type PublicForm,
 } from "../forms/field-sets";
 import { assertStaff } from "./guards";
+import {
+  normalizeWorksheet,
+  testGoogleSheetConnection,
+  type SheetsTestResult,
+} from "./google-sheets-core";
 
 /* eslint-disable @typescript-eslint/no-explicit-any */
 
@@ -1403,3 +1408,45 @@ export type FormVersionRow = {
   created_at: string;
   created_by_email: string | null;
 };
+
+/**
+ * Verify a form's Google Sheets configuration without writing a row.
+ *
+ * Resolves the form's settings exactly the way the submit path does — same
+ * per-form override, same defaults, same worksheet fallback — so a green test
+ * is a statement about real submissions rather than about whatever the editor
+ * happens to have typed into the form since.
+ *
+ * Never returns a credential: the only Google identity in the result is the
+ * service account's email address, which the editor needs in order to share
+ * the spreadsheet.
+ */
+export async function testSheetConnectionCore(
+  context: FormsContext,
+  admin: FormsDb,
+  input: { formKey?: string; spreadsheetId?: string; tab?: string },
+): Promise<SheetsTestResult & { spreadsheetId: string; tab: string }> {
+  await assertStaff(context);
+
+  let spreadsheetId = (input.spreadsheetId ?? "").trim();
+  let tab = (input.tab ?? "").trim();
+
+  // Unsaved edits win, so the editor can test before saving; anything left
+  // blank falls back to what the submit path would use.
+  if (input.formKey && (!spreadsheetId || !tab)) {
+    const { data: form } = await admin
+      .from("forms")
+      .select("*")
+      .eq("key", input.formKey)
+      .maybeSingle();
+    if (form) {
+      const eff = effectiveSettings(form, await loadDefaults(admin));
+      if (!spreadsheetId) spreadsheetId = eff.sheetId;
+      if (!tab) tab = eff.sheetTab;
+    }
+  }
+  tab = normalizeWorksheet(tab);
+
+  const result = await testGoogleSheetConnection({ spreadsheetId, tab });
+  return { ...result, spreadsheetId, tab };
+}