@commonpub/server 2.88.0 → 2.89.0

package/dist/rbac/seed.js

@@ -0,0 +1,74 @@
+import { eq, sql } from 'drizzle-orm';
+import { roles, rolePermissions } from '@commonpub/schema';
+/**
+ * RBAC system-role seed (session 201, Phase 2). The machinery shipped in Phase 0/1
+ * but the seed + backfill were never run, so the `roles`/`role_permissions`/
+ * `user_roles` tables were empty — flipping `features.rbac` was a no-op. This seeds
+ * the five system roles, their permission sets, and backfills `user_roles` from the
+ * denormalized `users.role`.
+ *
+ * Mirrors the SQL appended to migration 0025 (the deploy path, run once via
+ * db-migrate.mjs). This TS version is for fresh installs + PGlite tests. Both are
+ * ADDITIVE / idempotent (`ON CONFLICT DO NOTHING`) so re-running never clobbers an
+ * operator's later edits to a system role's permission set.
+ */
+/** The moderator capability set granted to `staff` (NOT `admin.access`). */
+export const STAFF_PERMISSION_SET = [
+    'content.read',
+    'content.moderate',
+    'content.editorial',
+    'reports.review',
+    'contest.create',
+    'contest.manage',
+    'event.create',
+    'event.manage',
+    'audit.read',
+    'users.read',
+];
+/** The five system roles, priority mirrors the legacy roleGuard hierarchy. */
+export const SYSTEM_ROLE_SEEDS = [
+    { key: 'member', name: 'Member', description: 'Default role for every registered user.', priority: 10, permissions: [] },
+    { key: 'pro', name: 'Pro', description: 'Pro tier member.', priority: 20, permissions: [] },
+    { key: 'verified', name: 'Verified', description: 'Verified member.', priority: 30, permissions: [] },
+    {
+        key: 'staff',
+        name: 'Staff',
+        description: 'Moderator: content moderation, contests, events, and reports. No admin panel access.',
+        priority: 40,
+        permissions: STAFF_PERMISSION_SET,
+    },
+    { key: 'admin', name: 'Admin', description: 'Full administrative access.', priority: 50, permissions: ['*'] },
+];
+/**
+ * Idempotently seed the system roles + permissions and backfill `user_roles`.
+ * Safe to run repeatedly; never deletes (so operator edits survive a redeploy).
+ */
+export async function seedRbac(db) {
+    for (const seed of SYSTEM_ROLE_SEEDS) {
+        await db
+            .insert(roles)
+            .values({
+            key: seed.key,
+            name: seed.name,
+            description: seed.description,
+            isSystem: true,
+            priority: seed.priority,
+        })
+            .onConflictDoNothing({ target: roles.key });
+        const [role] = await db.select({ id: roles.id }).from(roles).where(eq(roles.key, seed.key)).limit(1);
+        if (!role || seed.permissions.length === 0)
+            continue;
+        await db
+            .insert(rolePermissions)
+            .values(seed.permissions.map((permissionKey) => ({ roleId: role.id, permissionKey })))
+            .onConflictDoNothing();
+    }
+    // Backfill: every user gets the user_roles row matching their denormalized
+    // users.role. New users are backfilled by updateUserRole / signup going forward.
+    await db.execute(sql `
+    INSERT INTO user_roles (user_id, role_id)
+    SELECT u.id, r.id FROM users u JOIN roles r ON r.key = u.role::text
+    ON CONFLICT DO NOTHING
+  `);
+}
+//# sourceMappingURL=seed.js.map

package/dist/rbac/seed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed.js","sourceRoot":"","sources":["../../src/rbac/seed.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAG3D;;;;;;;;;;;GAWG;AAEH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,cAAc;IACd,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,cAAc;IACd,cAAc;IACd,YAAY;IACZ,YAAY;CACJ,CAAC;AAUX,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAA8B;IAC1D,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yCAAyC,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;IACxH,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;IAC3F,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;IACrG;QACE,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,sFAAsF;QACnG,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,oBAAoB;KAClC;IACD,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,6BAA6B,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE;CAC9G,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAAM;IACnC,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,EAAE;aACL,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC;YACN,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;aACD,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAE9C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAErD,MAAM,EAAE;aACL,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;aACrF,mBAAmB,EAAE,CAAC;IAC3B,CAAC;IAED,2EAA2E;IAC3E,iFAAiF;IACjF,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;;;GAInB,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonpub/server",
-  "version": "2.88.0",
+  "version": "2.89.0",
   "type": "module",
   "description": "Framework-agnostic business logic for CommonPub instances",
   "license": "AGPL-3.0-or-later",
@@ -114,14 +114,14 @@
     "linkedom": "^0.18.12",
     "megalodon": "^10.3.0",
     "turndown": "^7.2.4",
-    "@commonpub/editor": "0.7.12",
+    "@commonpub/auth": "0.8.0",
+    "@commonpub/config": "0.22.1",
     "@commonpub/docs": "0.6.3",
+    "@commonpub/editor": "0.7.12",
     "@commonpub/learning": "0.5.2",
-    "@commonpub/config": "0.22.1",
-    "@commonpub/schema": "0.44.0",
-    "@commonpub/auth": "0.8.0",
+    "@commonpub/protocol": "0.13.0",
     "@commonpub/infra": "0.8.0",
-    "@commonpub/protocol": "0.13.0"
+    "@commonpub/schema": "0.45.0"
   },
   "peerDependencies": {
     "drizzle-orm": "^0.45.1"