@guard-rail/core 0.9.1 → 0.10.0

package/supabase/migrations/20261028000000_require_confirmed_email.sql

@@ -0,0 +1,53 @@
+-- Identity by confirmed email only.
+--
+-- The init migration matched an invitation to a person by the `email` claim in
+-- their JWT. That claim is only as trustworthy as the project's signup
+-- settings: where an address can be registered without being confirmed, anyone
+-- could sign up as an invited admin's address and claim the invitation (or read
+-- the roster row addressed to it). This reads the address from auth.users
+-- instead, and only once Supabase has confirmed the person controls it.
+--
+-- Safe to re-run; changes no data.
+
+create or replace function guardrail.gr_confirmed_email()
+returns text
+language sql
+stable
+security definer
+set search_path = pg_temp
+as $$
+  select lower(u.email)
+    from auth.users u
+   where u.id = auth.uid()
+     and u.email_confirmed_at is not null;
+$$;
+
+revoke all on function guardrail.gr_confirmed_email() from public;
+grant execute on function guardrail.gr_confirmed_email() to authenticated;
+
+drop policy if exists "members read their own site roster" on guardrail.gr_members;
+create policy "members read their own site roster"
+  on guardrail.gr_members for select
+  to authenticated
+  using (
+    user_id = auth.uid()
+    or lower(email) = guardrail.gr_confirmed_email()
+    or guardrail.gr_has_role(site_id, array['admin', 'editor'])
+  );
+
+create or replace function guardrail.gr_claim_invite(target_site text)
+returns void
+language sql
+security definer
+set search_path = guardrail, pg_temp
+as $$
+  update guardrail.gr_members
+     set user_id = auth.uid(),
+         status  = 'active'
+   where site_id = target_site
+     and lower(email) = guardrail.gr_confirmed_email()
+     and status = 'pending';
+$$;
+
+revoke all on function guardrail.gr_claim_invite(text) from public;
+grant execute on function guardrail.gr_claim_invite(text) to authenticated;

package/supabase/migrations/20261028010000_rate_limits.sql

@@ -0,0 +1,67 @@
+-- Rate-limit counters, for the Supabase rate limiter that ships with
+-- @guard-rail/core (used automatically when the adapter has a service-role key).
+--
+-- One row per (limit, caller) bucket, fixed window. gr_rate_hit() counts an
+-- attempt and says whether it is still within the limit, in a single atomic
+-- statement, so concurrent requests can't both read "under the limit".
+--
+-- Callable by service_role only. It has to be: sign-in and "Forgot password?"
+-- happen with no session, and handing anyone (anon included) the ability to
+-- bump arbitrary counters would let them lock other people out. The table
+-- itself is unreachable through the Data API.
+
+create table if not exists guardrail.gr_rate_limits (
+  bucket       text primary key,
+  window_start timestamptz not null default now(),
+  expires_at   timestamptz not null,
+  hits         integer not null default 0
+);
+
+alter table guardrail.gr_rate_limits enable row level security;
+-- No policies on purpose: no role but the definer function (and service_role,
+-- which bypasses RLS) can read or write it.
+revoke all on guardrail.gr_rate_limits from public, anon, authenticated;
+grant select, insert, update, delete on guardrail.gr_rate_limits to service_role;
+
+create index if not exists gr_rate_limits_expires_idx on guardrail.gr_rate_limits (expires_at);
+
+create or replace function guardrail.gr_rate_hit(
+  p_name text,
+  p_key text,
+  p_limit integer,
+  p_window_seconds integer
+)
+returns table (allowed boolean, retry_after_seconds integer)
+language plpgsql
+security definer
+set search_path = guardrail, pg_temp
+as $$
+declare
+  v_bucket text := p_name || '|' || p_key;
+  v_window interval := make_interval(secs => p_window_seconds);
+  v_hits   integer;
+  v_expires timestamptz;
+begin
+  -- Start a fresh window if the old one has run out; otherwise count into it.
+  insert into guardrail.gr_rate_limits as t (bucket, window_start, expires_at, hits)
+  values (v_bucket, now(), now() + v_window, 1)
+  on conflict (bucket) do update
+     set window_start = case when t.expires_at <= now() then now() else t.window_start end,
+         expires_at   = case when t.expires_at <= now() then now() + v_window else t.expires_at end,
+         hits         = case when t.expires_at <= now() then 1 else t.hits + 1 end
+  returning t.hits, t.expires_at into v_hits, v_expires;
+
+  -- Housekeeping, on roughly 1 call in 50, so the table doesn't grow forever.
+  if random() < 0.02 then
+    delete from guardrail.gr_rate_limits where expires_at < now() - interval '1 hour';
+  end if;
+
+  return query select
+    v_hits <= p_limit,
+    case when v_hits <= p_limit then 0
+         else greatest(1, ceil(extract(epoch from (v_expires - now())))::integer) end;
+end;
+$$;
+
+revoke all on function guardrail.gr_rate_hit(text, text, integer, integer) from public, anon, authenticated;
+grant execute on function guardrail.gr_rate_hit(text, text, integer, integer) to service_role;

package/supabase/migrations/20261028020000_member_and_bucket_guards.sql

@@ -0,0 +1,96 @@
+-- Two guards that used to live only in application code.
+--
+-- Safe to re-run; changes no data.
+
+/* ------------------------------------------------------ last admin --- */
+-- "A site must keep at least one admin" was enforced by the Server Action, but
+-- an admin talking to the Data API directly could delete or demote the last one
+-- and leave the site with nobody able to manage it. This enforces it where the
+-- data is. It applies to signed-in users only: service_role, the SQL editor and
+-- migrations (no auth.uid()) can still do whatever maintenance they need.
+create or replace function guardrail.gr_keep_one_admin()
+returns trigger
+language plpgsql
+security definer
+set search_path = guardrail, pg_temp
+as $$
+begin
+  if auth.uid() is null then
+    return coalesce(new, old);
+  end if;
+
+  if old.role = 'admin' and old.status = 'active'
+     and (
+       tg_op = 'DELETE'
+       or new.role <> 'admin'
+       or new.status <> 'active'
+       or new.site_id is distinct from old.site_id
+     )
+     and not exists (
+       select 1
+         from guardrail.gr_members m
+        where m.site_id = old.site_id
+          and m.role    = 'admin'
+          and m.status  = 'active'
+          and m.email  <> old.email
+     )
+  then
+    raise exception 'A site must keep at least one active admin.'
+      using errcode = '23514';
+  end if;
+
+  return coalesce(new, old);
+end;
+$$;
+
+revoke all on function guardrail.gr_keep_one_admin() from public;
+
+drop trigger if exists gr_keep_one_admin on guardrail.gr_members;
+create trigger gr_keep_one_admin
+  before update or delete on guardrail.gr_members
+  for each row execute function guardrail.gr_keep_one_admin();
+
+/* ------------------------------------------------------ bucket cap --- */
+-- Any editor can call gr_ensure_bucket(), which meant they could create 'gr-'
+-- buckets without limit. Existing buckets are untouched and still resolve; only
+-- creating a new one past the cap is refused.
+create or replace function guardrail.gr_ensure_bucket(target_bucket text)
+returns void
+language plpgsql
+security definer
+set search_path = guardrail, pg_temp
+as $$
+begin
+  if target_bucket !~ '^gr-[a-z0-9][a-z0-9-]{0,50}$' then
+    raise exception 'Guardrail bucket names must start with gr- and use a-z, 0-9, hyphens: %',
+      target_bucket;
+  end if;
+
+  if not exists (
+    select 1 from guardrail.gr_members
+    where user_id = auth.uid()
+      and status  = 'active'
+      and role in ('admin', 'editor')
+  ) then
+    raise exception 'Only Guardrail editors can create media buckets';
+  end if;
+
+  if not exists (select 1 from storage.buckets where id = target_bucket)
+     and (select count(*) from storage.buckets where id like 'gr-%') >= 50 then
+    raise exception 'This project already has the maximum number of Guardrail media buckets (50).';
+  end if;
+
+  insert into storage.buckets (id, name, public, file_size_limit, allowed_mime_types)
+  values (
+    target_bucket,
+    target_bucket,
+    true,
+    10485760,
+    array['image/png', 'image/jpeg', 'image/webp', 'image/gif', 'image/avif']
+  )
+  on conflict (id) do nothing;
+end;
+$$;
+
+revoke all on function guardrail.gr_ensure_bucket(text) from public;
+grant execute on function guardrail.gr_ensure_bucket(text) to authenticated;

package/scripts/postinstall.mjs

@@ -1,48 +0,0 @@
-// Plain, already-final JS — deliberately NOT part of the tsup build. A
-// postinstall script has to exist the instant npm/pnpm/yarn extracts the
-// package, with no dependency on a build step having run yet, which would
-// otherwise race tsup during this very monorepo's own installs (lifecycle
-// script ordering between "postinstall" and "prepare" isn't a guarantee
-// worth relying on).
-//
-// Runs after `npm install @guard-rail/core` in a consuming project — just
-// onboarding guidance, easy to miss otherwise among the rest of an install's
-// output.
-//
-// Deliberately silent in two cases:
-// - CI: this is guidance for a human at a keyboard, not something that
-//   belongs in build logs.
-// - Running inside this very monorepo: pnpm runs a workspace package's own
-//   lifecycle scripts too (already visible via the "prepare" build step on
-//   every `pnpm install`), which would otherwise print this on every
-//   contributor's install of this repo, not just a real consumer's. Resolved
-//   through the pnpm workspace symlink, this file's own real path sits under
-//   packages/guardrail/ — never inside a node_modules/ — which a real
-//   consumer's install always does.
-import { fileURLToPath } from "node:url";
-
-const isRealInstall = fileURLToPath(import.meta.url).includes("node_modules");
-
-if (isRealInstall && !process.env.CI) {
-  console.log(`
-Guardrail installed. Next steps:
-
-1. Set up the database (skip both if this Supabase project already has
-   Guardrail applied for another site — see "Many sites, one Supabase
-   project" in the README):
-     - pnpm exec guardrail-init-db --push
-     - If that project is hosted (not local Docker), also add "guardrail"
-       under Settings > API > Exposed schemas in the Supabase dashboard —
-       config.toml only covers local dev.
-
-2. Wrap your root layout with withGuardrail and mark fields with <GRail>.
-   Full guide: https://www.npmjs.com/package/@guard-rail/core
-
-3. Once SUPABASE_URL / SUPABASE_ANON_KEY are set, seed yourself as the
-   first admin on a site (needs the service_role key, not the anon key —
-   Settings > API in the dashboard; pass it inline, don't store it):
-
-     SERVICE_KEY=... pnpm exec guardrail-seed-user \\
-       --email=you@example.com --password=... --site-id=my-site
-`);
-}