@flowselections/ai-authenticatie 1.0.15 → 1.1.1

package/dist-lib/lib/modules.server.js

@@ -31,13 +31,13 @@ export async function registerModuleRow(supabase, input) {
     const key = (input.module_key ?? '').trim() || slugifyModuleKey(name);
     if (!key)
         return { ok: false, message: 'Gebruik minimaal één letter of cijfer in de naam.' };
-    const { error } = await supabase.from('modules').upsert({
-        module_key: key,
-        module_name: name,
-        description: input.description ?? null,
-        is_active: true,
-        last_seen_at: new Date().toISOString(),
-    }, { onConflict: 'module_key' });
+    // Nooit rechtstreeks naar de Shell-tabel `modules` schrijven: alleen toevoegen als die
+    // nog niet bestaat, via de beveiligde databasefunctie (alleen beheerders).
+    const { error } = await supabase.rpc('ai_register_consumers', {
+        _modules: [{ moduleKey: key, name, description: input.description ?? null }],
+        _full_list: false,
+        _source: 'handmatig',
+    });
     if (error)
         return { ok: false, message: `Registreren mislukt: ${error.message}` };
     return { ok: true, message: 'Module geregistreerd.', module_key: key };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowselections/ai-authenticatie",
-  "version": "1.0.15",
+  "version": "1.1.1",
   "flowselections": {
     "moduleId": "ai-authenticatie",
     "pages": [
@@ -14,7 +14,12 @@
         "route": "ai-authenticatie/$moduleKey",
         "title": "Module details"
       }
-    ]
+    ],
+    "schema": {
+      "file": "schema/ai-authenticatie.sql",
+      "order": 50
+    },
+    "ai": []
   },
   "private": false,
   "sideEffects": false,
@@ -26,11 +31,16 @@
       "types": "./dist-lib/index.d.ts",
       "default": "./dist-lib/index.js"
     },
-    "./styles": "./dist-lib/styles.css"
+    "./styles": "./dist-lib/styles.css",
+    "./server": {
+      "types": "./dist-lib/lib/aiRegistry.server.d.ts",
+      "default": "./dist-lib/lib/aiRegistry.server.js"
+    }
   },
   "files": [
     "dist-lib",
-    "public"
+    "public",
+    "schema"
   ],
   "publishConfig": {
     "access": "public"

package/schema/ai-authenticatie.sql

@@ -0,0 +1,124 @@
+-- AI-Authenticatie: automatische registratie van AI-gebruikende modules.
+-- Idempotent: dit bestand mag meerdere keren achter elkaar draaien.
+-- De Shell-tabel public.modules wordt NIET gewijzigd (geen kolommen/rechten/beleid);
+-- er wordt alleen een rij toegevoegd als die nog niet bestaat.
+
+-- 1. Extra kolommen op de eigen tabel ai_modules
+ALTER TABLE public.ai_modules ADD COLUMN IF NOT EXISTS declared_ai boolean NOT NULL DEFAULT false;
+ALTER TABLE public.ai_modules ADD COLUMN IF NOT EXISTS ai_source text NOT NULL DEFAULT 'handmatig';
+ALTER TABLE public.ai_modules ADD COLUMN IF NOT EXISTS last_declared_at timestamptz;
+ALTER TABLE public.ai_modules ADD COLUMN IF NOT EXISTS is_in_use boolean NOT NULL DEFAULT true;
+
+-- 2. Beheerderscontrole
+CREATE OR REPLACE FUNCTION public.ai_is_admin(_uid uuid)
+RETURNS boolean
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path = public
+AS $$
+  SELECT _uid IS NOT NULL AND (
+    public.has_role(_uid, 'ai_admin') OR public.has_role(_uid, 'admin')
+    OR public.has_role(_uid, 'superadmin') OR public.has_role(_uid, 'developer')
+  )
+$$;
+REVOKE ALL ON FUNCTION public.ai_is_admin(uuid) FROM PUBLIC, anon;
+GRANT EXECUTE ON FUNCTION public.ai_is_admin(uuid) TO authenticated, service_role;
+
+-- 3. Rechten op eigen tabellen: iedereen ingelogd leest, alleen beheerders schrijven
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.ai_modules TO authenticated;
+GRANT ALL ON public.ai_modules TO service_role;
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.ai_module_bindings TO authenticated;
+GRANT ALL ON public.ai_module_bindings TO service_role;
+ALTER TABLE public.ai_modules ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.ai_module_bindings ENABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS "Authenticated can manage ai modules" ON public.ai_modules;
+DROP POLICY IF EXISTS "ai_modules_read" ON public.ai_modules;
+DROP POLICY IF EXISTS "ai_modules_admin_write" ON public.ai_modules;
+CREATE POLICY "ai_modules_read" ON public.ai_modules FOR SELECT TO authenticated USING (true);
+CREATE POLICY "ai_modules_admin_write" ON public.ai_modules FOR ALL TO authenticated
+  USING (public.ai_is_admin(auth.uid())) WITH CHECK (public.ai_is_admin(auth.uid()));
+
+DROP POLICY IF EXISTS "authenticated full access" ON public.ai_module_bindings;
+DROP POLICY IF EXISTS "ai_module_bindings manage ai_admin" ON public.ai_module_bindings;
+DROP POLICY IF EXISTS "ai_module_bindings_read" ON public.ai_module_bindings;
+DROP POLICY IF EXISTS "ai_module_bindings_admin_write" ON public.ai_module_bindings;
+CREATE POLICY "ai_module_bindings_read" ON public.ai_module_bindings FOR SELECT TO authenticated USING (true);
+CREATE POLICY "ai_module_bindings_admin_write" ON public.ai_module_bindings FOR ALL TO authenticated
+  USING (public.ai_is_admin(auth.uid())) WITH CHECK (public.ai_is_admin(auth.uid()));
+
+-- 4. Registratie vanuit manifest (shell-setup / update dashboard / beheerscherm)
+--    _source: 'manifest' (flowselections.ai) of 'handmatig' (beheerscherm).
+--    Nooit verwijderen. "Niet meer in gebruik" alleen bij _full_list = true en een niet-lege lijst.
+CREATE OR REPLACE FUNCTION public.ai_register_consumers(
+  _modules jsonb, _full_list boolean DEFAULT false, _source text DEFAULT 'manifest'
+) RETURNS jsonb
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = public
+AS $$
+DECLARE
+  item jsonb; k text; n text; d text;
+  keys text[] := ARRAY[]::text[];
+  retired int := 0;
+  src text := CASE WHEN _source = 'handmatig' THEN 'handmatig' ELSE 'manifest' END;
+BEGIN
+  IF coalesce(auth.role(), '') <> 'service_role' AND NOT public.ai_is_admin(auth.uid()) THEN
+    RAISE EXCEPTION 'Geen rechten om AI-modules te registreren' USING ERRCODE = '42501';
+  END IF;
+  IF _modules IS NULL OR jsonb_typeof(_modules) <> 'array' THEN
+    RAISE EXCEPTION 'Ongeldige modulelijst: verwacht een lijst';
+  END IF;
+
+  FOR item IN SELECT value FROM jsonb_array_elements(_modules) LOOP
+    IF jsonb_typeof(item) <> 'object' THEN CONTINUE; END IF;
+    k := lower(trim(coalesce(item->>'moduleKey', item->>'module_key', '')));
+    IF k !~ '^[a-z0-9][a-z0-9-]{0,63}$' THEN CONTINUE; END IF;
+    n := coalesce(nullif(trim(item->>'name'), ''), nullif(trim(item->>'module_name'), ''), k);
+    d := nullif(trim(coalesce(item->>'description', '')), '');
+    keys := array_append(keys, k);
+
+    INSERT INTO public.modules (module_key, module_name, description)
+    VALUES (k, n, d) ON CONFLICT (module_key) DO NOTHING;
+
+    IF src = 'manifest' THEN
+      INSERT INTO public.ai_modules (module_key, module_name, ai_enabled, declared_ai, ai_source, last_declared_at, is_in_use)
+      VALUES (k, n, true, true, 'manifest', now(), true)
+      ON CONFLICT (module_key) DO UPDATE
+        SET declared_ai = true, last_declared_at = now(), is_in_use = true,
+            ai_source = CASE WHEN public.ai_modules.ai_source = 'runtime' THEN 'manifest' ELSE public.ai_modules.ai_source END;
+    ELSE
+      INSERT INTO public.ai_modules (module_key, module_name, ai_enabled, ai_source)
+      VALUES (k, n, false, 'handmatig')
+      ON CONFLICT (module_key) DO NOTHING;
+    END IF;
+  END LOOP;
+
+  IF src = 'manifest' AND _full_list AND array_length(keys, 1) > 0 THEN
+    UPDATE public.ai_modules
+       SET is_in_use = false, declared_ai = false
+     WHERE declared_ai = true AND NOT (module_key = ANY (keys));
+    GET DIAGNOSTICS retired = ROW_COUNT;
+  END IF;
+
+  RETURN jsonb_build_object('registered', coalesce(array_length(keys, 1), 0), 'retired', retired);
+END;
+$$;
+REVOKE ALL ON FUNCTION public.ai_register_consumers(jsonb, boolean, text) FROM PUBLIC, anon;
+GRANT EXECUTE ON FUNCTION public.ai_register_consumers(jsonb, boolean, text) TO authenticated, service_role;
+
+-- 5. Vangnet: onbekende module registreren bij de eerste AI-aanroep (alleen server)
+CREATE OR REPLACE FUNCTION public.ai_register_runtime_consumer(_module_key text)
+RETURNS boolean
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = public
+AS $$
+DECLARE k text := lower(trim(coalesce(_module_key, '')));
+BEGIN
+  IF coalesce(auth.role(), '') <> 'service_role' THEN
+    RAISE EXCEPTION 'Alleen de server mag dit aanroepen' USING ERRCODE = '42501';
+  END IF;
+  IF k !~ '^[a-z0-9][a-z0-9-]{0,63}$' THEN RETURN false; END IF;
+  INSERT INTO public.modules (module_key, module_name) VALUES (k, k) ON CONFLICT (module_key) DO NOTHING;
+  INSERT INTO public.ai_modules (module_key, module_name, ai_enabled, ai_source, is_in_use)
+  VALUES (k, k, true, 'runtime', true) ON CONFLICT (module_key) DO NOTHING;
+  RETURN FOUND;
+END;
+$$;
+REVOKE ALL ON FUNCTION public.ai_register_runtime_consumer(text) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.ai_register_runtime_consumer(text) TO service_role;