@guard-rail/core 0.1.0

package/dist/server/wrapper.js

@@ -0,0 +1,42 @@
+import { jsx, jsxs } from "react/jsx-runtime";
+import React, { Suspense } from "react";
+import { cookies } from "next/headers";
+import {
+  configureGuardrail,
+  getAuth,
+  getStorage,
+  resolveSiteId
+} from "../core/config";
+import { getCachedViewer } from "./session";
+import { GR_COOKIES } from "../core/defs";
+import { GRailProvider } from "../react/Provider";
+import { GRailAdmin } from "../react/Admin";
+function withGuardrail(LayoutComponent, config) {
+  configureGuardrail(config);
+  return async function GuardrailLayout(props) {
+    configureGuardrail(config);
+    const cookieStore = await cookies();
+    const viewer = await getCachedViewer();
+    const auth = getAuth();
+    const state = {
+      storage: getStorage() !== void 0,
+      auth: {
+        password: typeof auth.authenticate === "function",
+        ...auth.signInUrl ? { signInUrl: auth.signInUrl } : {}
+      },
+      isAuth: viewer !== null,
+      isEditMode: cookieStore.get(GR_COOKIES.EDIT_MODE)?.value === "true",
+      siteId: await resolveSiteId(),
+      role: viewer?.role ?? null,
+      ...viewer?.email ? { email: viewer.email } : {}
+    };
+    return /* @__PURE__ */ jsxs(GRailProvider, { state, children: [
+      /* @__PURE__ */ jsx(LayoutComponent, { ...props }),
+      /* @__PURE__ */ jsx(Suspense, { fallback: null, children: /* @__PURE__ */ jsx(GRailAdmin, { toolbarExtra: config.toolbarExtra }) })
+    ] });
+  };
+}
+export {
+  withGuardrail
+};
+//# sourceMappingURL=wrapper.js.map

package/dist/server/wrapper.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/server/wrapper.tsx"],"sourcesContent":["import React, { Suspense } from \"react\";\nimport { cookies } from \"next/headers\";\nimport {\n  configureGuardrail,\n  getAuth,\n  getStorage,\n  resolveSiteId,\n} from \"../core/config\";\nimport { getCachedViewer } from \"./session\";\nimport type { GRConfig } from \"../core/adapter-types\";\nimport { GR_COOKIES } from \"../core/defs\";\nimport { GRailProvider } from \"../react/Provider\";\nimport { GRailAdmin } from \"../react/Admin\";\nimport type { GRState } from \"../core/types\";\n\n/**\n * Wraps a root layout so every route carries Guardrail's edit state and admin\n * chrome. Stays a Server Component: the provider below is the client boundary.\n */\nexport function withGuardrail<P extends object>(\n  LayoutComponent: React.ComponentType<P>,\n  config: GRConfig,\n) {\n  // Applied at module evaluation so the config is present as soon as anything\n  // imports the layout, and again per render because Next.js does not\n  // guarantee one shared module instance across its server contexts.\n  configureGuardrail(config);\n\n  return async function GuardrailLayout(props: P) {\n    configureGuardrail(config);\n\n    const cookieStore = await cookies();\n\n    // Verified against the auth provider, not inferred from a cookie.\n    const viewer = await getCachedViewer();\n\n    const auth = getAuth();\n\n    const state: GRState = {\n      storage: getStorage() !== undefined,\n      auth: {\n        password: typeof auth.authenticate === \"function\",\n        ...(auth.signInUrl ? { signInUrl: auth.signInUrl } : {}),\n      },\n      isAuth: viewer !== null,\n      isEditMode: cookieStore.get(GR_COOKIES.EDIT_MODE)?.value === \"true\",\n      siteId: await resolveSiteId(),\n      role: viewer?.role ?? null,\n      ...(viewer?.email ? { email: viewer.email } : {}),\n    };\n\n    return (\n      <GRailProvider state={state}>\n        <LayoutComponent {...props} />\n        <Suspense fallback={null}>\n          <GRailAdmin toolbarExtra={config.toolbarExtra} />\n        </Suspense>\n      </GRailProvider>\n    );\n  };\n}\n"],"mappings":"AAoDM,SACE,KADF;AApDN,OAAO,SAAS,gBAAgB;AAChC,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAEhC,SAAS,kBAAkB;AAC3B,SAAS,qBAAqB;AAC9B,SAAS,kBAAkB;AAOpB,SAAS,cACd,iBACA,QACA;AAIA,qBAAmB,MAAM;AAEzB,SAAO,eAAe,gBAAgB,OAAU;AAC9C,uBAAmB,MAAM;AAEzB,UAAM,cAAc,MAAM,QAAQ;AAGlC,UAAM,SAAS,MAAM,gBAAgB;AAErC,UAAM,OAAO,QAAQ;AAErB,UAAM,QAAiB;AAAA,MACrB,SAAS,WAAW,MAAM;AAAA,MAC1B,MAAM;AAAA,QACJ,UAAU,OAAO,KAAK,iBAAiB;AAAA,QACvC,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,MACxD;AAAA,MACA,QAAQ,WAAW;AAAA,MACnB,YAAY,YAAY,IAAI,WAAW,SAAS,GAAG,UAAU;AAAA,MAC7D,QAAQ,MAAM,cAAc;AAAA,MAC5B,MAAM,QAAQ,QAAQ;AAAA,MACtB,GAAI,QAAQ,QAAQ,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,IACjD;AAEA,WACE,qBAAC,iBAAc,OACb;AAAA,0BAAC,mBAAiB,GAAG,OAAO;AAAA,MAC5B,oBAAC,YAAS,UAAU,MAClB,8BAAC,cAAW,cAAc,OAAO,cAAc,GACjD;AAAA,OACF;AAAA,EAEJ;AACF;","names":[]}

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "@guard-rail/core",
+  "version": "0.1.0",
+  "description": "Lightweight inline content editing for developer-owned Next.js sites.",
+  "license": "ISC",
+  "type": "module",
+  "sideEffects": false,
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./adapters/supabase": {
+      "types": "./dist/adapters/supabase/index.d.ts",
+      "default": "./dist/adapters/supabase/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "supabase"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "prepare": "npm run build",
+    "prepublishOnly": "npm run build"
+  },
+  "peerDependencies": {
+    "@supabase/ssr": "^0.8.0",
+    "@supabase/supabase-js": "^2.0.0",
+    "next": ">=15",
+    "react": ">=19"
+  },
+  "peerDependenciesMeta": {
+    "@supabase/ssr": {
+      "optional": true
+    },
+    "@supabase/supabase-js": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@supabase/ssr": "^0.8.0",
+    "@supabase/supabase-js": "^2.93.3",
+    "@types/node": "^25.1.0",
+    "@types/react": "^19.2.10",
+    "next": "16.1.6",
+    "react": "^19.2.4",
+    "tsup": "^8.5.1",
+    "typescript": "^5.9.3"
+  }
+}

package/supabase/migrations/20260911000000_guardrail_init.sql

@@ -0,0 +1,288 @@
+-- Guardrail: initial schema
+--
+-- Run with the Supabase CLI (`supabase db push`) once this file is copied
+-- into your own project's supabase/migrations/ — not hand-pasted into the SQL
+-- editor. Applied once and tracked by the CLI, so unlike the old hand-run
+-- schema.sql this does not need to be idempotent or re-runnable.
+--
+-- REQUIRED MANUAL STEP: add "guardrail" under Settings > API > Exposed
+-- schemas in the Supabase dashboard. PostgREST only serves schemas on that
+-- list, and no migration can add itself to it — skipping this step makes
+-- every table below invisible to the client with a "not found in schema
+-- cache" error that looks identical to a missing table.
+--
+-- Authorization is enforced in two independent places: Guardrail rejects
+-- mutations from a caller without the right role, and RLS rejects rows that
+-- do not belong to a site the caller is a member of. Neither alone is
+-- sufficient — keep both.
+
+create schema if not exists guardrail;
+grant usage on schema guardrail to anon, authenticated;
+
+/* ------------------------------------------------------------- members --- */
+
+create table guardrail.gr_members (
+  site_id     text not null,
+  email       text not null,
+  user_id     uuid references auth.users (id) on delete set null,
+  role        text not null check (role in ('admin', 'editor')),
+  status      text not null default 'pending' check (status in ('active', 'pending')),
+  invited_at  timestamptz not null default now(),
+  primary key (site_id, email)
+);
+
+create index gr_members_user_idx on guardrail.gr_members (site_id, user_id);
+
+alter table guardrail.gr_members enable row level security;
+
+-- Anon has no legitimate reason to read team membership, so it gets no grant
+-- at all here (unlike gr_content, which anonymous visitors must be able to
+-- read to render the site).
+grant select, insert, update, delete on guardrail.gr_members to authenticated;
+
+-- Does the current user hold one of these roles on this site? SECURITY
+-- DEFINER so the membership policies below can call it without recursing
+-- into gr_members' own RLS. Restricted to `authenticated` — every caller of
+-- this function is already inside a `to authenticated` policy.
+create function guardrail.gr_has_role(target_site text, roles text[])
+returns boolean
+language sql
+stable
+security definer
+set search_path = guardrail, pg_temp
+as $$
+  select exists (
+    select 1 from guardrail.gr_members m
+    where m.site_id = target_site
+      and m.user_id = auth.uid()
+      and m.status  = 'active'
+      and m.role    = any(roles)
+  );
+$$;
+
+revoke all on function guardrail.gr_has_role(text, text[]) from public;
+grant execute on function guardrail.gr_has_role(text, text[]) to authenticated;
+
+-- Members may read their own site's roster; an invited address may read the
+-- row addressed to it so the invitation can be found and claimed.
+create policy "members read their own site roster"
+  on guardrail.gr_members for select
+  to authenticated
+  using (
+    user_id = auth.uid()
+    or lower(email) = lower(coalesce(auth.jwt() ->> 'email', ''))
+    or guardrail.gr_has_role(site_id, array['admin', 'editor'])
+  );
+
+-- Mutations are admin-only, with no self-service exception.
+--
+-- A policy permissive enough to let someone write the row matching their own
+-- email is permissive enough to let them insert themselves as an admin on
+-- any site, straight through PostgREST. Claiming an invitation therefore goes
+-- through gr_claim_invite() below, which cannot change a role.
+create policy "admins manage the roster"
+  on guardrail.gr_members for all
+  to authenticated
+  using (guardrail.gr_has_role(site_id, array['admin']))
+  with check (guardrail.gr_has_role(site_id, array['admin']));
+
+-- Binds a pending invitation to the caller. Sets only user_id and status; the
+-- invited role is never writable by the invitee.
+create function guardrail.gr_claim_invite(target_site text)
+returns void
+language sql
+security definer
+set search_path = guardrail, pg_temp
+as $$
+  update guardrail.gr_members
+     set user_id = auth.uid(),
+         status  = 'active'
+   where site_id = target_site
+     and lower(email) = lower(coalesce(auth.jwt() ->> 'email', ''))
+     and status = 'pending';
+$$;
+
+revoke all on function guardrail.gr_claim_invite(text) from public;
+grant execute on function guardrail.gr_claim_invite(text) to authenticated;
+
+/* ------------------------------------------------------------- content --- */
+
+create table guardrail.gr_content (
+  id          uuid primary key default gen_random_uuid(),
+  site_id     text not null,
+  path_key    text not null,
+  type        text not null,
+  value       jsonb not null,
+  updated_at  timestamptz not null default now(),
+  unique (path_key, site_id)
+);
+
+create index gr_content_site_path_idx on guardrail.gr_content (site_id, path_key);
+
+alter table guardrail.gr_content enable row level security;
+
+grant select on guardrail.gr_content to anon, authenticated;
+grant insert, update, delete on guardrail.gr_content to authenticated;
+
+-- Anyone may read published content: this is what anonymous visitors render.
+create policy "content is publicly readable"
+  on guardrail.gr_content for select
+  using (true);
+
+-- Writes require an active admin or editor membership *on that site*. This is
+-- what stops a signed-in user from editing a site they were never added to.
+create policy "editors write their own sites"
+  on guardrail.gr_content for insert
+  to authenticated
+  with check (guardrail.gr_has_role(site_id, array['admin', 'editor']));
+
+create policy "editors update their own sites"
+  on guardrail.gr_content for update
+  to authenticated
+  using (guardrail.gr_has_role(site_id, array['admin', 'editor']))
+  with check (guardrail.gr_has_role(site_id, array['admin', 'editor']));
+
+-- Deletes only happen when a repeater item is removed, to clean up its
+-- now-orphaned fields (see gr_repeater_items below).
+create policy "editors delete their own sites"
+  on guardrail.gr_content for delete
+  to authenticated
+  using (guardrail.gr_has_role(site_id, array['admin', 'editor']));
+
+/* ------------------------------------------------------------ repeaters --- */
+-- Manifest for <GRepeater>: identity and order only. An item's own fields are
+-- ordinary gr_content rows namespaced "<repeater_id>.<item_id>.<field>" — this
+-- table does not know or care what fields an item has, since that is defined
+-- entirely by the developer's template component, not by a schema here.
+
+create table guardrail.gr_repeater_items (
+  site_id      text not null,
+  repeater_id  text not null,
+  item_id      text not null,
+  -- Present only for a routed repeater (each item has its own page, e.g. a
+  -- product or a post). A plain row of cards on one page leaves this null.
+  slug         text,
+  sort_order   integer not null,
+  created_at   timestamptz not null default now(),
+  primary key (site_id, repeater_id, item_id)
+);
+
+-- Slugs are the URL segment for a routed item, so they must be unique within
+-- a repeater — but only enforced where a slug exists, since non-routed items
+-- never set one.
+create unique index gr_repeater_items_slug_idx
+  on guardrail.gr_repeater_items (site_id, repeater_id, slug)
+  where slug is not null;
+
+create index gr_repeater_items_order_idx
+  on guardrail.gr_repeater_items (site_id, repeater_id, sort_order);
+
+alter table guardrail.gr_repeater_items enable row level security;
+
+grant select on guardrail.gr_repeater_items to anon, authenticated;
+grant insert, update, delete on guardrail.gr_repeater_items to authenticated;
+
+-- Anyone may enumerate items: this is what renders the page for anonymous
+-- visitors, same reasoning as gr_content's public read policy.
+create policy "repeater items are publicly readable"
+  on guardrail.gr_repeater_items for select
+  using (true);
+
+create policy "editors manage repeater items"
+  on guardrail.gr_repeater_items for all
+  to authenticated
+  using (guardrail.gr_has_role(site_id, array['admin', 'editor']))
+  with check (guardrail.gr_has_role(site_id, array['admin', 'editor']));
+
+/* -------------------------------------------------------------- storage --- */
+-- Editable images live in public buckets named 'gr-*'. 'gr-media' is created
+-- here as the default. Any other 'gr-' name passed to supabaseStorage({
+-- bucket }) is created on first upload by gr_ensure_bucket() below, so
+-- choosing a bucket never means writing a migration for it.
+--
+-- Public means anyone can *fetch* a file by URL, which a website needs.
+-- Listing and uploading still go through the policies below. The size and
+-- type limits are enforced by Storage itself, backing up the server action.
+
+insert into storage.buckets (id, name, public, file_size_limit, allowed_mime_types)
+values (
+  'gr-media',
+  'gr-media',
+  true,
+  10485760,
+  array['image/png', 'image/jpeg', 'image/webp', 'image/gif', 'image/avif']
+);
+
+-- Objects live under '<site_id>/…', so the first folder names the site and
+-- membership on that site decides who may upload or browse. Scoped to the
+-- 'gr-' prefix, not one bucket name, so any bucket a developer names via
+-- supabaseStorage({ bucket }) is covered without another migration.
+create policy "gr editors upload media"
+  on storage.objects for insert
+  to authenticated
+  with check (
+    bucket_id like 'gr-%'
+    and guardrail.gr_has_role((storage.foldername(name))[1], array['admin', 'editor'])
+  );
+
+create policy "gr editors browse media"
+  on storage.objects for select
+  to authenticated
+  using (
+    bucket_id like 'gr-%'
+    and guardrail.gr_has_role((storage.foldername(name))[1], array['admin', 'editor'])
+  );
+
+-- Creates a Guardrail media bucket on demand. Restricted to 'gr-' names so it
+-- can never touch other buckets, and to active editors so it cannot be called
+-- anonymously. Limits mirror the default bucket above.
+create function guardrail.gr_ensure_bucket(target_bucket text)
+returns void
+language plpgsql
+security definer
+set search_path = guardrail, pg_temp
+as $$
+begin
+  if target_bucket !~ '^gr-[a-z0-9][a-z0-9-]{0,50}$' then
+    raise exception 'Guardrail bucket names must start with gr- and use a-z, 0-9, hyphens: %',
+      target_bucket;
+  end if;
+
+  if not exists (
+    select 1 from guardrail.gr_members
+    where user_id = auth.uid()
+      and status  = 'active'
+      and role in ('admin', 'editor')
+  ) then
+    raise exception 'Only Guardrail editors can create media buckets';
+  end if;
+
+  insert into storage.buckets (id, name, public, file_size_limit, allowed_mime_types)
+  values (
+    target_bucket,
+    target_bucket,
+    true,
+    10485760,
+    array['image/png', 'image/jpeg', 'image/webp', 'image/gif', 'image/avif']
+  )
+  on conflict (id) do nothing;
+end;
+$$;
+
+revoke all on function guardrail.gr_ensure_bucket(text) from public;
+grant execute on function guardrail.gr_ensure_bucket(text) to authenticated;
+
+/* ----------------------------------------------------------- bootstrap --- */
+-- A site with no members has nobody who can add members, and there is
+-- deliberately no in-app way to grant yourself a role. Seed the first admin
+-- here, replacing both values:
+--
+--   insert into guardrail.gr_members (site_id, email, user_id, role, status)
+--   select 'your-site-id', u.email, u.id, 'admin', 'active'
+--     from auth.users u
+--    where u.email = 'you@example.com'
+--   on conflict (site_id, email) do update
+--      set role = 'admin', status = 'active', user_id = excluded.user_id;
+
+/* ------------------------------------------------------------- refresh --- */
+notify pgrst, 'reload schema';