@kontrolia/db 2.1.3 → 2.1.5

package/dist/api-key.d.ts

@@ -1,5 +1,7 @@
 /** Generates a new plaintext application sync API key. Shown once, never stored. */
 export declare function generateApplicationApiKey(): string;
-/** sha256 hex digest — what actually gets stored in kontrolia_auth.applications.api_key_hash. */
+/** sha256 hex digest — what actually gets stored as application_api_keys.key_hash. */
 export declare function hashApplicationApiKey(plaintext: string): string;
+/** First few characters after the prefix, stored alongside the hash purely so a key list UI can show "kapp_a1b2c3…" without ever persisting (or being able to redisplay) the full secret. */
+export declare function applicationApiKeyDisplayPrefix(plaintext: string): string;
 //# sourceMappingURL=api-key.d.ts.map

package/dist/api-key.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-key.d.ts","sourceRoot":"","sources":["../src/api-key.ts"],"names":[],"mappings":"AAIA,oFAAoF;AACpF,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,iGAAiG;AACjG,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/D"}
+{"version":3,"file":"api-key.d.ts","sourceRoot":"","sources":["../src/api-key.ts"],"names":[],"mappings":"AAIA,oFAAoF;AACpF,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,sFAAsF;AACtF,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,6LAA6L;AAC7L,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAExE"}

package/dist/api-key.js

@@ -4,7 +4,11 @@ const API_KEY_PREFIX = "kapp_";
 export function generateApplicationApiKey() {
     return `${API_KEY_PREFIX}${randomBytes(24).toString("base64url")}`;
 }
-/** sha256 hex digest — what actually gets stored in kontrolia_auth.applications.api_key_hash. */
+/** sha256 hex digest — what actually gets stored as application_api_keys.key_hash. */
 export function hashApplicationApiKey(plaintext) {
     return createHash("sha256").update(plaintext).digest("hex");
 }
+/** First few characters after the prefix, stored alongside the hash purely so a key list UI can show "kapp_a1b2c3…" without ever persisting (or being able to redisplay) the full secret. */
+export function applicationApiKeyDisplayPrefix(plaintext) {
+    return plaintext.slice(0, API_KEY_PREFIX.length + 6);
+}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { migrate, type MigrateOptions } from "./migrate.js";
 export { grantPlatformAdmin, type GrantPlatformAdminOptions, type GrantPlatformAdminResult } from "./grant-platform-admin.js";
 export { registerApplication, type RegisterApplicationOptions, type RegisteredApplication, type PermissionInput, } from "./register-application.js";
-export { generateApplicationApiKey, hashApplicationApiKey } from "./api-key.js";
+export { generateApplicationApiKey, hashApplicationApiKey, applicationApiKeyDisplayPrefix } from "./api-key.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,KAAK,yBAAyB,EAAE,KAAK,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC9H,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,GACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,KAAK,yBAAyB,EAAE,KAAK,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC9H,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,eAAe,GACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,8BAA8B,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -1,4 +1,4 @@
 export { migrate } from "./migrate.js";
 export { grantPlatformAdmin } from "./grant-platform-admin.js";
 export { registerApplication, } from "./register-application.js";
-export { generateApplicationApiKey, hashApplicationApiKey } from "./api-key.js";
+export { generateApplicationApiKey, hashApplicationApiKey, applicationApiKeyDisplayPrefix } from "./api-key.js";

package/dist/migrate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../src/migrate.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,cAAc;IAC7B;;sDAEkD;IAClD,gBAAgB,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAWD;;;GAGG;AACH,wBAAsB,OAAO,CAAC,EAAE,gBAAgB,EAAE,OAAe,EAAE,EAAE,cAAc,iBAgClF"}
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../src/migrate.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,cAAc;IAC7B;;sDAEkD;IAClD,gBAAgB,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAsCD;;;GAGG;AACH,wBAAsB,OAAO,CAAC,EAAE,gBAAgB,EAAE,OAAe,EAAE,EAAE,cAAc,iBAgClF"}

package/dist/migrate.js

@@ -4,13 +4,34 @@ import { fileURLToPath } from "node:url";
 import { Client } from "pg";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const MIGRATIONS_DIR = join(__dirname, "..", "migrations");
+/**
+ * Bootstraps (and self-heals the location of) the migration-tracking
+ * table, then returns its schema-qualified name for the rest of migrate()
+ * to use. On a genuinely fresh database neither `kontrolia` nor
+ * `kontrolia_auth` exists yet — migration 0001 is what creates the former,
+ * 0020 renames it to the latter — so this table has nowhere but `public`
+ * to start out in. Once `kontrolia_auth` exists (every subsequent run,
+ * fresh or not), it belongs there instead: an install that ran migrate()
+ * before this fix shipped may still have it sitting in `public`, so this
+ * relocates it once, idempotently, rather than leaving two copies around.
+ */
 async function ensureMigrationsTable(client) {
+    const { rows: schemaRows } = await client.query(`select exists (select 1 from information_schema.schemata where schema_name = 'kontrolia_auth') as exists`);
+    const kontroliaAuthExists = schemaRows[0]?.exists ?? false;
+    if (kontroliaAuthExists) {
+        const { rows: publicRows } = await client.query(`select exists (select 1 from information_schema.tables where table_schema = 'public' and table_name = 'kontrolia_migrations') as exists`);
+        if (publicRows[0]?.exists) {
+            await client.query("alter table public.kontrolia_migrations set schema kontrolia_auth");
+        }
+    }
+    const schema = kontroliaAuthExists ? "kontrolia_auth" : "public";
     await client.query(`
-    create table if not exists kontrolia_migrations (
+    create table if not exists ${schema}.kontrolia_migrations (
       filename text primary key,
       applied_at timestamptz not null default now()
     )
   `);
+    return schema;
 }
 /**
  * Applies every .sql file under migrations/ that hasn't run yet, in
@@ -20,8 +41,8 @@ export async function migrate({ connectionString, verbose = false }) {
     const client = new Client({ connectionString });
     await client.connect();
     try {
-        await ensureMigrationsTable(client);
-        const { rows: applied } = await client.query("select filename from kontrolia_migrations");
+        const migrationsTable = `${await ensureMigrationsTable(client)}.kontrolia_migrations`;
+        const { rows: applied } = await client.query(`select filename from ${migrationsTable}`);
         const appliedSet = new Set(applied.map((r) => r.filename));
         const files = (await readdir(MIGRATIONS_DIR)).filter((f) => f.endsWith(".sql")).sort();
         for (const file of files) {
@@ -33,7 +54,7 @@ export async function migrate({ connectionString, verbose = false }) {
             await client.query("begin");
             try {
                 await client.query(sql);
-                await client.query("insert into kontrolia_migrations (filename) values ($1)", [file]);
+                await client.query(`insert into ${migrationsTable} (filename) values ($1)`, [file]);
                 await client.query("commit");
             }
             catch (error) {

package/dist/register-application.d.ts

@@ -14,14 +14,6 @@ export interface RegisterApplicationOptions {
 export interface RegisteredApplication {
     applicationId: string;
     permissionKeys: string[];
-    /**
-     * The plaintext sync API key (see POST /api/applications/sync on
-     * auth-server) — only present the first time this slug is registered.
-     * Only the hash is stored; there is no way to recover it later, so the
-     * caller must surface it to the operator immediately. `null` means the
-     * application already existed and its key (if any) was left untouched.
-     */
-    apiKey: string | null;
 }
 /**
  * Inserts an application and its permission catalog directly against
@@ -30,7 +22,15 @@ export interface RegisteredApplication {
  * go through a platform-admin path), so this is that path: a direct,
  * service-role-equivalent write, the same way migrate() bypasses RLS to
  * apply schema changes. Safe to re-run — the slug and permission key are
- * both upserted, and re-running never rotates an existing api_key_hash.
+ * both upserted.
+ *
+ * Does NOT generate a sync API key — migration 0040 moved keys off
+ * `applications` onto the org-scoped `application_api_keys` table, and at
+ * the point this runs (typically during install, before any organization
+ * necessarily exists or has enabled the app) there's no organization to
+ * scope one to. Generate the first key afterward from admin-panel
+ * (Aplicaciones → tu app → API Keys), once at least one organization has
+ * enabled the application.
  */
 export declare function registerApplication(options: RegisterApplicationOptions): Promise<RegisteredApplication>;
 //# sourceMappingURL=register-application.d.ts.map

package/dist/register-application.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register-application.d.ts","sourceRoot":"","sources":["../src/register-application.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,4DAA4D;IAC5D,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,aAAa,GAAG,SAAS,GAAG,YAAY,CAAC;IACtD,WAAW,EAAE,eAAe,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAkC7G"}
+{"version":3,"file":"register-application.d.ts","sourceRoot":"","sources":["../src/register-application.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,4DAA4D;IAC5D,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,aAAa,GAAG,SAAS,GAAG,YAAY,CAAC;IACtD,WAAW,EAAE,eAAe,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAgC7G"}

package/dist/register-application.js

@@ -1,5 +1,4 @@
 import { Client } from "pg";
-import { generateApplicationApiKey, hashApplicationApiKey } from "./api-key.js";
 /**
  * Inserts an application and its permission catalog directly against
  * Postgres. kontrolia_auth.applications/permissions have no insert policy for
@@ -7,17 +6,24 @@ import { generateApplicationApiKey, hashApplicationApiKey } from "./api-key.js";
  * go through a platform-admin path), so this is that path: a direct,
  * service-role-equivalent write, the same way migrate() bypasses RLS to
  * apply schema changes. Safe to re-run — the slug and permission key are
- * both upserted, and re-running never rotates an existing api_key_hash.
+ * both upserted.
+ *
+ * Does NOT generate a sync API key — migration 0040 moved keys off
+ * `applications` onto the org-scoped `application_api_keys` table, and at
+ * the point this runs (typically during install, before any organization
+ * necessarily exists or has enabled the app) there's no organization to
+ * scope one to. Generate the first key afterward from admin-panel
+ * (Aplicaciones → tu app → API Keys), once at least one organization has
+ * enabled the application.
  */
 export async function registerApplication(options) {
     const client = new Client({ connectionString: options.connectionString });
     await client.connect();
     try {
-        const candidateApiKey = generateApplicationApiKey();
-        const { rows: [application], } = await client.query(`insert into kontrolia_auth.applications (name, slug, environment, api_key_hash)
-       values ($1, $2, $3, $4)
+        const { rows: [application], } = await client.query(`insert into kontrolia_auth.applications (name, slug, environment)
+       values ($1, $2, $3)
        on conflict (slug) do update set name = excluded.name, environment = excluded.environment
-       returning id, (xmax = 0) as inserted`, [options.name, options.slug, options.environment, hashApplicationApiKey(candidateApiKey)]);
+       returning id`, [options.name, options.slug, options.environment]);
         if (!application)
             throw new Error(`Failed to upsert application "${options.slug}"`);
         const permissionKeys = [];
@@ -28,7 +34,7 @@ export async function registerApplication(options) {
          on conflict (key) do update set description = excluded.description`, [application.id, permission.resource, permission.action, key, permission.description ?? null]);
             permissionKeys.push(key);
         }
-        return { applicationId: application.id, permissionKeys, apiKey: application.inserted ? candidateApiKey : null };
+        return { applicationId: application.id, permissionKeys };
     }
     finally {
         await client.end();

package/migrations/0038_role_and_role_permissions_audit_triggers.sql

@@ -0,0 +1,84 @@
+-- 0013/0024 established "the database logs it, not application code" for
+-- every other mutation surface, but roles and role_permissions were never
+-- covered — creating or deleting a custom role, or granting/revoking a
+-- permission on one, has produced zero audit trail since day one. Found
+-- while designing API + MCP routes for role management: those routes must
+-- not become the first and only place these actions get logged, since the
+-- whole point of trigger-based auditing is that it keeps recording
+-- regardless of which caller (browser, API, MCP, Studio/psql) made the
+-- change.
+--
+-- These fire for system-role rows too (the auto-created "Administrador de
+-- <app>" role, and its auto-synced permission set) — same as every other
+-- trigger here, the log reflects what actually happened in the database,
+-- not just human-initiated changes. actor_user_id is auth.uid(), which is
+-- null for those system-triggered inserts; that's expected and matches how
+-- 0013's own device.revoked/membership.created triggers already behave.
+
+create or replace function kontrolia_auth.log_role_change()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if tg_op = 'INSERT' then
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (
+      new.organization_id, auth.uid(), 'role.created', 'role', new.id::text,
+      jsonb_build_object('name', new.name, 'slug', new.slug, 'application_id', new.application_id, 'is_system_role', new.is_system_role)
+    );
+    return new;
+  else
+    if old.organization_id is null or exists (select 1 from kontrolia_auth.organizations where id = old.organization_id) then
+      insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+      values (
+        old.organization_id, auth.uid(), 'role.deleted', 'role', old.id::text,
+        jsonb_build_object('name', old.name, 'slug', old.slug, 'application_id', old.application_id)
+      );
+    end if;
+    return old;
+  end if;
+end;
+$$;
+
+create trigger audit_role_change
+  after insert or delete on kontrolia_auth.roles
+  for each row execute function kontrolia_auth.log_role_change();
+
+create or replace function kontrolia_auth.log_role_permission_change()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  target_role record;
+begin
+  select organization_id, name, slug into target_role
+  from kontrolia_auth.roles
+  where id = coalesce(new.role_id, old.role_id);
+
+  if tg_op = 'INSERT' then
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (
+      target_role.organization_id, auth.uid(), 'role_permission.granted', 'role', new.role_id::text,
+      jsonb_build_object('role_slug', target_role.slug, 'permission_id', new.permission_id)
+    );
+    return new;
+  else
+    if target_role.organization_id is null or exists (select 1 from kontrolia_auth.organizations where id = target_role.organization_id) then
+      insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+      values (
+        target_role.organization_id, auth.uid(), 'role_permission.revoked', 'role', old.role_id::text,
+        jsonb_build_object('role_slug', target_role.slug, 'permission_id', old.permission_id)
+      );
+    end if;
+    return old;
+  end if;
+end;
+$$;
+
+create trigger audit_role_permission_change
+  after insert or delete on kontrolia_auth.role_permissions
+  for each row execute function kontrolia_auth.log_role_permission_change();

package/migrations/0039_instance_settings.sql

@@ -0,0 +1,54 @@
+-- Instance-wide branding/behavior settings for auth-server's hosted auth
+-- screens (login, register, forgot-password, reset-password, verify-email,
+-- MFA challenge, invitation accept, OAuth consent — everywhere AuthShell
+-- renders). A single row, not per-organization: this installation's
+-- self-hosted auth UI has one look, controlled by a platform admin from
+-- admin-panel, same way there's one GoTrue project per installation.
+--
+-- registration_enabled: when false, auth-server hides "Crear cuenta" and
+-- /register redirects back to /login — the only way to add a new person is
+-- an Owner/Admin inviting them from admin-panel. theme forces light/dark
+-- regardless of the browser's prefers-color-scheme, or 'system' (default)
+-- to keep following it. button_color overrides --k-primary. logo_url
+-- replaces the "K" mark + wordmark when set.
+create table kontrolia_auth.instance_settings (
+  id boolean primary key default true,
+  registration_enabled boolean not null default true,
+  theme text not null default 'system' check (theme in ('light', 'dark', 'system')),
+  button_color text check (button_color is null or button_color ~ '^#[0-9a-fA-F]{6}$'),
+  logo_url text,
+  updated_at timestamptz not null default now(),
+  updated_by uuid references auth.users (id) on delete set null,
+  constraint instance_settings_singleton check (id)
+);
+
+comment on table kontrolia_auth.instance_settings is 'Singleton row (id is always true) — instance-wide branding/behavior for auth-server''s hosted auth screens.';
+
+insert into kontrolia_auth.instance_settings (id) values (true);
+
+alter table kontrolia_auth.instance_settings enable row level security;
+
+-- Public read: auth-server's login/register/etc. pages render this before
+-- anyone is authenticated, and none of these fields are sensitive.
+create policy "anyone can read instance settings" on kontrolia_auth.instance_settings
+  for select using (true);
+
+-- Writes still go through auth-server's API routes with a service-role
+-- client (same Model B pattern as platform-admins/oauth-clients), which
+-- bypasses RLS — this policy is defense-in-depth for any direct client use.
+create policy "platform admins can update instance settings" on kontrolia_auth.instance_settings
+  for update using (exists (select 1 from kontrolia_auth.platform_admins pa where pa.user_id = auth.uid()));
+
+grant select on kontrolia_auth.instance_settings to anon, authenticated;
+grant update on kontrolia_auth.instance_settings to authenticated;
+
+-- Logo uploads. Public bucket: served via Supabase's unauthenticated
+-- /storage/v1/object/public/branding/... path, so auth-server's own
+-- unauthenticated login screen can just <img src> it directly — no signed
+-- URLs, no extra round-trip. Uploads/deletes only ever happen server-side
+-- through auth-server's service-role client (same as every other
+-- platform-admin-gated mutation in this codebase), so no storage.objects
+-- RLS policies are needed for writes.
+insert into storage.buckets (id, name, public)
+values ('branding', 'branding', true)
+on conflict (id) do nothing;

package/migrations/0040_application_api_keys.sql

@@ -0,0 +1,171 @@
+-- Replaces the single kapp_ key on kontrolia_auth.applications with a real
+-- multi-key model: an application can have any number of named, revocable,
+-- optionally-expiring keys, each independently scoped to whichever
+-- organization it was generated for — not necessarily the application's
+-- owner_organization_id. A tenant organization that merely enabled an
+-- application (application_organizations) can mint its own key to call
+-- that application's members API on its own behalf, without needing the
+-- owning organization's involvement at all. The application's own global
+-- permission catalog (POST /api/applications/sync) still accepts any valid,
+-- non-revoked, non-expired key for the application regardless of which org
+-- it's scoped to — syncing permissions isn't an org-scoped operation.
+create table kontrolia_auth.application_api_keys (
+  id uuid primary key default gen_random_uuid(),
+  application_id uuid not null references kontrolia_auth.applications (id) on delete cascade,
+  organization_id uuid not null references kontrolia_auth.organizations (id) on delete cascade,
+  name text not null,
+  key_hash text not null,
+  -- First several characters of the plaintext, purely so the list UI can
+  -- show "kapp_a1b2c3…" to help an operator tell keys apart without ever
+  -- storing (or being able to show again) the full secret. Null for rows
+  -- backfilled from the old single-key column below, where no prefix was
+  -- ever recorded.
+  key_prefix text,
+  last_used_at timestamptz,
+  expires_at timestamptz,
+  revoked_at timestamptz,
+  revoked_by uuid references auth.users (id) on delete set null,
+  created_by uuid references auth.users (id) on delete set null,
+  created_at timestamptz not null default now()
+);
+
+comment on table kontrolia_auth.application_api_keys is 'Named, independently-scoped, revocable/expiring kapp_ keys — replaces the single applications.api_key_hash. organization_id is whichever org the key was generated for (must have application_id enabled), not necessarily the application''s owner.';
+
+-- 0016's own "platform admins can view the platform admin list" SELECT
+-- policy on platform_admins queries platform_admins from inside its own
+-- policy — harmless as long as the only caller is service_role (which
+-- bypasses RLS entirely, the only way this table has ever actually been
+-- read in this codebase before now). The moment ANY other RLS policy
+-- (this migration's, below) checks platform-admin status via a plain
+-- `exists (select 1 from platform_admins ...)` under a real (non-service-role)
+-- caller, Postgres has to evaluate platform_admins' own SELECT policy for
+-- that subquery — which itself queries platform_admins — genuine infinite
+-- recursion ("infinite recursion detected in policy for relation
+-- platform_admins"), live-reproduced while building this migration's own
+-- policies below. A SECURITY DEFINER function (same escape hatch
+-- is_org_admin/is_org_owner already use for memberships/roles) runs with
+-- the function owner's privileges, bypassing the caller's own RLS on the
+-- table it queries — no recursion.
+create or replace function kontrolia_auth.is_platform_admin()
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select exists (select 1 from kontrolia_auth.platform_admins pa where pa.user_id = auth.uid());
+$$;
+
+-- Retrofit 0016's policy onto the same function, closing the recursion risk
+-- there too — not just in the new policies below that happened to expose it.
+drop policy if exists "platform admins can view the platform admin list" on kontrolia_auth.platform_admins;
+create policy "platform admins can view the platform admin list" on kontrolia_auth.platform_admins
+  for select using (kontrolia_auth.is_platform_admin());
+
+alter table kontrolia_auth.application_api_keys enable row level security;
+
+create policy "org admins can view their org's application keys" on kontrolia_auth.application_api_keys
+  for select using (kontrolia_auth.is_org_admin(organization_id) or kontrolia_auth.is_platform_admin());
+
+create policy "org admins can create application keys for their org" on kontrolia_auth.application_api_keys
+  for insert
+  with check (
+    (kontrolia_auth.is_org_admin(organization_id) or kontrolia_auth.is_platform_admin())
+    and exists (
+      select 1 from kontrolia_auth.application_organizations ao
+      where ao.application_id = application_api_keys.application_id
+        and ao.organization_id = application_api_keys.organization_id
+    )
+  );
+
+-- Keys are only ever revoked, never edited or hard-deleted — this policy
+-- only needs to authorize the "set revoked_at/revoked_by" update, which is
+-- everything the API route ever writes here.
+create policy "org admins can revoke their org's application keys" on kontrolia_auth.application_api_keys
+  for update using (kontrolia_auth.is_org_admin(organization_id) or kontrolia_auth.is_platform_admin())
+  with check (kontrolia_auth.is_org_admin(organization_id) or kontrolia_auth.is_platform_admin());
+
+-- Column-level ACL, same reasoning as 0032 for the column this replaces:
+-- key_hash must never be readable by any authenticated user for any
+-- organization. The auth-server route that matches a caller's Bearer key
+-- against these rows runs as service_role, which needs its own explicit
+-- grant — column privileges aren't inherited from a table-level grant.
+grant select (
+  id, application_id, organization_id, name, key_prefix, last_used_at, expires_at, revoked_at, revoked_by, created_by, created_at
+) on kontrolia_auth.application_api_keys to authenticated;
+grant insert (application_id, organization_id, name, key_hash, key_prefix, expires_at, created_by) on kontrolia_auth.application_api_keys to authenticated;
+grant update (revoked_at, revoked_by) on kontrolia_auth.application_api_keys to authenticated;
+grant select (id, application_id, organization_id, key_hash) on kontrolia_auth.application_api_keys to service_role;
+
+-- Same "the database logs it" pattern as every other mutation surface
+-- (0013, 0024, 0032, 0038).
+create or replace function kontrolia_auth.log_application_api_key_lifecycle()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if tg_op = 'INSERT' then
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (
+      new.organization_id, auth.uid(), 'application_api_key.created', 'application', new.application_id::text,
+      jsonb_build_object('keyId', new.id, 'name', new.name, 'expiresAt', new.expires_at)
+    );
+    return new;
+  end if;
+
+  if old.revoked_at is null and new.revoked_at is not null then
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (
+      new.organization_id, auth.uid(), 'application_api_key.revoked', 'application', new.application_id::text,
+      jsonb_build_object('keyId', new.id, 'name', new.name)
+    );
+  end if;
+  return new;
+end;
+$$;
+
+create trigger audit_application_api_key_lifecycle
+  after insert or update on kontrolia_auth.application_api_keys
+  for each row execute function kontrolia_auth.log_application_api_key_lifecycle();
+
+-- Carry forward every application's existing single key as its first named
+-- key, scoped to the same organization that already administered it
+-- (owner_organization_id — the only organization the old RLS policy ever
+-- let touch it).
+insert into kontrolia_auth.application_api_keys (application_id, organization_id, name, key_hash, last_used_at, created_at)
+select id, owner_organization_id, 'Clave original', api_key_hash, api_key_last_used_at, created_at
+from kontrolia_auth.applications
+where api_key_hash is not null and owner_organization_id is not null;
+
+-- log_application_api_key_change() (0032, extended by 0034) did double duty:
+-- logging api_key_hash changes AND ownership changes on kontrolia_auth.applications.
+-- The key-lifecycle half moves to the new table's own trigger above; redefine
+-- this one (same name, same trigger — a transparent swap, no drop/recreate
+-- needed) to keep only what it's now solely responsible for.
+create or replace function kontrolia_auth.log_application_api_key_change()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if old.owner_organization_id is distinct from new.owner_organization_id then
+    insert into kontrolia_auth.audit_logs (organization_id, actor_user_id, action, target_type, target_id, metadata)
+    values (
+      new.owner_organization_id,
+      auth.uid(),
+      case when old.owner_organization_id is null then 'application.ownership_claimed' else 'application.ownership_transferred' end,
+      'application',
+      new.id::text,
+      jsonb_build_object('slug', new.slug, 'previous_owner_organization_id', old.owner_organization_id)
+    );
+  end if;
+
+  return new;
+end;
+$$;
+
+alter table kontrolia_auth.applications drop column api_key_hash;
+alter table kontrolia_auth.applications drop column api_key_last_used_at;

package/migrations/0041_mcp_oauth_client.sql

@@ -0,0 +1,14 @@
+-- Tracks the single, auto-provisioned, non-deletable OAuth client reserved
+-- for MCP agent connections (Claude Code, Claude Desktop, ChatGPT
+-- connectors, ...). Registering a client OAuth was previously only
+-- reachable through an application's own "Cliente OAuth" dialog — correct
+-- for genuine app SSO, but a modeling mismatch for a generic agent that
+-- isn't "logging in as" any one catalogued application. NULL until the
+-- first visit to admin-panel's "Clientes OAuth" screen bootstraps it (see
+-- POST /api/oauth-clients/mcp-bootstrap) — there's no way to create it from
+-- a plain SQL migration, since GoTrue's OAuth clients live behind its own
+-- admin HTTP API, not a table this schema can INSERT into directly.
+alter table kontrolia_auth.instance_settings add column mcp_oauth_client_id text;
+
+comment on column kontrolia_auth.instance_settings.mcp_oauth_client_id is
+  'GoTrue client_id of the reserved MCP OAuth client, once bootstrapped. Not a secret (client_id is public in the OAuth flow) — safe to expose via the same public GET /api/instance-settings as everything else on this row.';

package/migrations/0042_supabase_oauth_connection.sql

@@ -0,0 +1,32 @@
+-- Stores the OAuth 2.1 tokens for KontrolIA Auth's own connection to
+-- Supabase's Management API (a "Supabase OAuth App" a platform admin
+-- authorizes once, from admin-panel's Social login screen) — the
+-- self-renewing alternative to pasting a Personal Access Token that
+-- silently expires. access_token is short-lived; refresh_token lets
+-- auth-server renew it on its own, forever, until the connection is
+-- revoked (from here, or from the user's own Supabase account).
+--
+-- Deliberately NOT modeled like instance_settings (public-read singleton):
+-- RLS is enabled with zero policies, and there is no grant to anon/
+-- authenticated at all beyond the schema's blanket default privileges from
+-- migration 0008 — with RLS enabled and no permissive policy, that default
+-- grant still resolves to zero rows/denied for every command, for every
+-- role except service_role (which bypasses RLS entirely). This table's
+-- contents are account-wide-privileged Supabase credentials, meant to be
+-- reachable ONLY from auth-server's own service-role client — never via
+-- PostgREST under any authenticated session, no matter how the caller got
+-- there.
+create table kontrolia_auth.supabase_oauth_connection (
+  id boolean primary key default true,
+  access_token text not null,
+  refresh_token text not null,
+  expires_at timestamptz not null,
+  connected_by uuid references auth.users (id) on delete set null,
+  connected_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  constraint supabase_oauth_connection_singleton check (id)
+);
+
+comment on table kontrolia_auth.supabase_oauth_connection is 'Singleton row (id is always true) — OAuth tokens for this installation''s connection to Supabase''s Management API. service_role only, never exposed via PostgREST.';
+
+alter table kontrolia_auth.supabase_oauth_connection enable row level security;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontrolia/db",
-  "version": "2.1.3",
+  "version": "2.1.5",
   "license": "MIT",
   "description": "KontrolIA Auth database layer: SQL migrations for the `kontrolia` schema (organizations, RBAC, Custom Access Token Hook) and a connection-string-agnostic migration runner.",
   "keywords": [