@fayz-ai/plugin-marketing 0.13.7 → 0.13.8

package/dist/index.js

@@ -6515,12 +6515,41 @@ GRANT SELECT ON public.v_marketing_lead_attribution TO authenticated;
 COMMENT ON VIEW public.v_marketing_lead_attribution IS
   'Cada lead com seus tr\xEAs n\xEDveis: canal (COMO), origem (ONDE) e campanha (QUAL esfor\xE7o, com custo). A origem resolve o canal \u2014 o lead n\xE3o o carrega (marketing/005).';
 `;
+var MIGRATION_006_THE_CAMPAIGN_ENGINE_IS_SERVER_ONLY = `-- 006_the_campaign_engine_is_server_only.sql
+--
+-- \`marketing_campaign_run\`, \`marketing_resolve_audience\` and
+-- \`marketing_has_consent\` are SECURITY DEFINER and look a campaign or a tenant
+-- up by id without asking who is calling. Granted to \`authenticated\`, any
+-- logged-in user of any tenant could fire another tenant's campaign or list
+-- its audience by guessing a uuid.
+--
+-- No screen, edge function or agent tool calls them: the only caller is
+-- \`marketing_run_due\` on the minute tick (via \`event_runner_tick\`, as postgres)
+-- and the functions themselves. So the fix is to take the door away, not to
+-- guard it. A future "send now" button gets a tenant-checked wrapper.
+--
+-- \`REVOKE ... FROM PUBLIC\` alone is not enough here: the pool's default
+-- privileges grant EXECUTE to \`authenticated\` on every new function in public.
+
+REVOKE ALL ON FUNCTION public.marketing_campaign_run(uuid, integer) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.marketing_campaign_run(uuid, integer) TO service_role;
+
+REVOKE ALL ON FUNCTION public.marketing_resolve_audience(uuid) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.marketing_resolve_audience(uuid) TO service_role;
+
+REVOKE ALL ON FUNCTION public.marketing_has_consent(uuid, uuid, text) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.marketing_has_consent(uuid, uuid, text) TO service_role;
+
+REVOKE ALL ON FUNCTION public.marketing_run_due(integer) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.marketing_run_due(integer) TO service_role;
+`;
 var MIGRATIONS = [
   { id: "000_baseline", sql: MIGRATION_000_BASELINE },
   { id: "001_the_landing_page_names_the_site", sql: MIGRATION_001_THE_LANDING_PAGE_NAMES_THE_SITE },
   { id: "003_a_porta_publica_e_a_pagina", sql: MIGRATION_003_A_PORTA_PUBLICA_E_A_PAGINA },
   { id: "004_a_campanha_aponta_para_um_recorte", sql: MIGRATION_004_A_CAMPANHA_APONTA_PARA_UM_RECORTE },
-  { id: "005_a_atribuicao_do_lead_atravessa_a_origem_ate_o_canal", sql: MIGRATION_005_A_ATRIBUICAO_DO_LEAD_ATRAVESSA_A_ORIGEM_ATE_O_CANAL }
+  { id: "005_a_atribuicao_do_lead_atravessa_a_origem_ate_o_canal", sql: MIGRATION_005_A_ATRIBUICAO_DO_LEAD_ATRAVESSA_A_ORIGEM_ATE_O_CANAL },
+  { id: "006_the_campaign_engine_is_server_only", sql: MIGRATION_006_THE_CAMPAIGN_ENGINE_IS_SERVER_ONLY }
 ];
 
 // src/integrations/ranklayer/settings.ts