@kontrolia/db 2.0.0 → 2.1.0

package/README.md

@@ -15,4 +15,4 @@ DATABASE_URL="postgres://postgres:postgres@localhost:5432/postgres" pnpm --filte
 ## Activar el hook
 
 - **Self-hosted**: variable de entorno de GoTrue `GOTRUE_HOOK_CUSTOM_ACCESS_TOKEN_URI=pg-functions://postgres/kontrolia_auth/custom_access_token_hook` (ver `docker/docker-compose.yml`).
-- **Supabase Cloud**: paso manual en el Dashboard → Authentication → Hooks → Custom Access Token → seleccionar `kontrolia_auth.custom_access_token_hook`. No automatizable por API pública.
+- **Supabase Cloud**: `npx create-kontrolia-auth` (o `deploy`) lo automatiza vía la Management API de Supabase, pidiendo un Personal Access Token de la cuenta. A mano: Dashboard → Authentication → Hooks → Custom Access Token → seleccionar `kontrolia_auth.custom_access_token_hook`.

package/dist/grant-platform-admin.d.ts

@@ -0,0 +1,21 @@
+export interface GrantPlatformAdminOptions {
+    /** Postgres connection string — same trust model as migrate(): whoever has
+     * this can already do anything in the database, so this bypasses the
+     * app's own is_platform_admin authorization check entirely. That's the
+     * point — it's the recovery path for when there are zero platform admins
+     * (e.g. bootstrap_first_platform_admin() didn't fire because auth.users
+     * already had rows from something else sharing the same Supabase
+     * project), which the admin-panel UI can never self-serve since its API
+     * requires an existing platform admin to call it. */
+    connectionString: string;
+    email: string;
+}
+export interface GrantPlatformAdminResult {
+    userId: string;
+    email: string;
+    /** True if this user already was a platform admin — grant is idempotent. */
+    alreadyGranted: boolean;
+}
+/** Grants platform admin directly via SQL — no HTTP layer, no JWT required. */
+export declare function grantPlatformAdmin({ connectionString, email }: GrantPlatformAdminOptions): Promise<GrantPlatformAdminResult>;
+//# sourceMappingURL=grant-platform-admin.d.ts.map

package/dist/grant-platform-admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-platform-admin.d.ts","sourceRoot":"","sources":["../src/grant-platform-admin.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,yBAAyB;IACxC;;;;;;;yDAOqD;IACrD,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,+EAA+E;AAC/E,wBAAsB,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,yBAAyB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA0BlI"}

package/dist/grant-platform-admin.js

@@ -0,0 +1,21 @@
+import { Client } from "pg";
+/** Grants platform admin directly via SQL — no HTTP layer, no JWT required. */
+export async function grantPlatformAdmin({ connectionString, email }) {
+    const client = new Client({ connectionString });
+    await client.connect();
+    try {
+        const { rows: users } = await client.query("select id, email from auth.users where lower(email) = lower($1) limit 1", [email]);
+        const user = users[0];
+        if (!user) {
+            throw new Error(`No hay ningún usuario registrado con el correo "${email}". Regístrate primero desde auth-server.`);
+        }
+        const { rows: inserted } = await client.query(`insert into kontrolia_auth.platform_admins (user_id)
+       values ($1)
+       on conflict (user_id) do nothing
+       returning user_id`, [user.id]);
+        return { userId: user.id, email: user.email, alreadyGranted: inserted.length === 0 };
+    }
+    finally {
+        await client.end();
+    }
+}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export { migrate, type MigrateOptions } from "./migrate.js";
+export { grantPlatformAdmin, type GrantPlatformAdminOptions, type GrantPlatformAdminResult } from "./grant-platform-admin.js";
 export { registerApplication, type RegisterApplicationOptions, type RegisteredApplication, type PermissionInput, } from "./register-application.js";
 export { generateApplicationApiKey, hashApplicationApiKey } from "./api-key.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,GACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,KAAK,yBAAyB,EAAE,KAAK,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC9H,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,GACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -1,3 +1,4 @@
 export { migrate } from "./migrate.js";
+export { grantPlatformAdmin } from "./grant-platform-admin.js";
 export { registerApplication, } from "./register-application.js";
 export { generateApplicationApiKey, hashApplicationApiKey } from "./api-key.js";

package/migrations/0021_org_owner_delete.sql

@@ -0,0 +1,31 @@
+-- Deleting an organization is irreversible and cascades through every
+-- membership/role/invitation/audit-log row for it (see the FKs in
+-- 0002/0004/0005/0006_*.sql) — permission_denied by default today, since no
+-- DELETE policy exists on kontrolia_auth.organizations at all. Reserved for
+-- the org's Owner specifically, not any Admin: is_org_admin() (0009/0020)
+-- deliberately treats Owner and Admin the same for day-to-day management,
+-- but wiping the whole organization (including its audit trail) is a
+-- different level of consequence.
+create or replace function kontrolia_auth.is_org_owner(org_id uuid)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select exists (
+    select 1
+    from kontrolia_auth.memberships m
+    join kontrolia_auth.membership_roles mr on mr.membership_id = m.id
+    join kontrolia_auth.roles r on r.id = mr.role_id
+    where m.organization_id = org_id
+      and m.user_id = auth.uid()
+      and m.status = 'active'
+      and r.slug = 'owner'
+  );
+$$;
+
+grant execute on function kontrolia_auth.is_org_owner(uuid) to authenticated;
+
+create policy "org owners can delete their organization" on kontrolia_auth.organizations
+  for delete using (kontrolia_auth.is_org_owner(id));

package/migrations/0022_application_homepage_url.sql

@@ -0,0 +1,17 @@
+-- Nothing in the schema records where a registered application is actually
+-- reachable for end users — redirect_urls is OAuth callback URIs, not a
+-- home page. Needed for an "apps you have access to" launcher (auth-server)
+-- to have somewhere to link. Nullable: not always known at registration
+-- time via the CLI wizard.
+alter table kontrolia_auth.applications add column homepage_url text;
+
+comment on column kontrolia_auth.applications.homepage_url is
+  'Where this application is reachable for end users (its actual URL, not an OAuth redirect URI) — what an "apps you can access" launcher links to.';
+
+-- No UPDATE policy existed on applications at all before this (0018 only
+-- added a SELECT policy widening catalog browsing). Scoped to the
+-- registering org's admins, not every org that merely enabled the app.
+create policy "owning org admins can update their application" on kontrolia_auth.applications
+  for update
+  using (owner_organization_id is not null and kontrolia_auth.is_org_admin(owner_organization_id))
+  with check (owner_organization_id is not null and kontrolia_auth.is_org_admin(owner_organization_id));

package/migrations/0023_fix_audit_triggers_on_org_delete.sql

@@ -0,0 +1,60 @@
+-- Deleting an organization (0021) cascades to memberships, which cascades
+-- to membership_roles — and the AFTER DELETE audit triggers on both
+-- (0013_audit_log_triggers.sql) tried to INSERT a new audit_logs row
+-- referencing that same organization_id mid-cascade, violating
+-- audit_logs_organization_id_fkey (audit_logs itself also cascades on
+-- organization delete, so by the time these triggers fire the parent
+-- organization row is gone). There's no point logging "membership removed"
+-- for a membership that's disappearing because its whole organization —
+-- audit trail included — is being wiped a moment later anyway. Guard both
+-- triggers: only log when the organization is still around, i.e. this is a
+-- real standalone removal, not a side effect of deleting the org itself.
+create or replace function kontrolia_auth.log_membership_change()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if tg_op = 'INSERT' then
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (new.organization_id, coalesce(auth.uid(), new.user_id), 'membership.created', 'membership', new.id::text, jsonb_build_object('user_id', new.user_id, 'status', new.status));
+    return new;
+  else
+    if exists (select 1 from kontrolia_auth.organizations where id = old.organization_id) then
+      insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+      values (old.organization_id, auth.uid(), 'membership.removed', 'membership', old.id::text, jsonb_build_object('user_id', old.user_id));
+    end if;
+    return old;
+  end if;
+end;
+$$;
+
+create or replace function kontrolia_auth.log_role_assignment_change()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  target_membership record;
+begin
+  select organization_id, user_id into target_membership
+  from kontrolia_auth.memberships
+  where id = coalesce(new.membership_id, old.membership_id);
+
+  if not exists (select 1 from kontrolia_auth.organizations where id = target_membership.organization_id) then
+    if tg_op = 'INSERT' then return new; else return old; end if;
+  end if;
+
+  if tg_op = 'INSERT' then
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (target_membership.organization_id, coalesce(auth.uid(), target_membership.user_id), 'role.assigned', 'membership_role', new.membership_id::text, jsonb_build_object('role_id', new.role_id));
+    return new;
+  else
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (target_membership.organization_id, auth.uid(), 'role.unassigned', 'membership_role', old.membership_id::text, jsonb_build_object('role_id', old.role_id));
+    return old;
+  end if;
+end;
+$$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontrolia/db",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "license": "MIT",
   "description": "KontrolIA Auth database layer: SQL migrations for the `kontrolia` schema (organizations, RBAC, Custom Access Token Hook) and a connection-string-agnostic migration runner.",
   "keywords": [