@manablox/db 0.3.0 → 0.4.0

package/dist/{schema-Bb4p16Yz.js → schema-Dm3RcBst.js}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
 import { relations, sql } from "drizzle-orm";
-import { boolean, customType, index, integer, jsonb, pgTable, primaryKey, text, timestamp, unique, uniqueIndex, uuid } from "drizzle-orm/pg-core";
+import { bigserial, boolean, customType, index, integer, jsonb, pgTable, primaryKey, text, timestamp, unique, uniqueIndex, uuid } from "drizzle-orm/pg-core";
 //#region src/columns.ts
 /**
 * `ltree` — the materialised ancestor path of a content node. A subtree move is one
@@ -193,6 +193,44 @@ const assetUsages = pgTable("asset_usages", {
 	index("asset_usages_content_idx").on(table.contentId)
 ]);
 //#endregion
+//#region src/schema/audit.ts
+/**
+* The audit log: one row per action, appended and never changed.
+*
+* Nothing here references another table. A space, a user or a document may be deleted
+* long after the row was written, and the row must still say who did what: the actor
+* and the target are recorded by id *and* by label, as they were at the time. A trigger
+* (see the migration) refuses every `update` and `delete`, and each row carries the
+* SHA-256 of its content chained to the previous row's, so a gap or an edit shows up
+* when the chain is verified.
+*/
+const auditEntries = pgTable("audit_entries", {
+	id: uuid().primaryKey().defaultRandom(),
+	/** The order of the chain; assigned by the database, gapless within a transaction. */
+	seq: bigserial({ mode: "number" }).notNull(),
+	at: timestamp({ withTimezone: true }).notNull().defaultNow(),
+	/** Null for an instance-wide action: an account, a key, creating a space. */
+	spaceId: uuid(),
+	actorKind: text().$type().notNull(),
+	actorId: text(),
+	actorLabel: text().notNull(),
+	actorDetail: jsonb().$type(),
+	action: text().$type().notNull(),
+	targetKind: text().$type().notNull(),
+	targetId: text(),
+	targetLabel: text(),
+	changes: jsonb().$type().notNull().default(sql`'[]'::jsonb`),
+	meta: jsonb().$type(),
+	prevHash: text(),
+	hash: text().notNull()
+}, (table) => [
+	index("audit_entries_seq_idx").on(table.seq),
+	index("audit_entries_space_at_idx").on(table.spaceId, table.at),
+	index("audit_entries_target_idx").on(table.targetKind, table.targetId),
+	index("audit_entries_actor_idx").on(table.actorKind, table.actorId),
+	index("audit_entries_action_idx").on(table.action)
+]);
+//#endregion
 //#region src/schema/auth.ts
 const users = pgTable("users", {
 	id: uuid().primaryKey().defaultRandom(),
@@ -204,6 +242,11 @@ const users = pgTable("users", {
 	role: text().notNull().default("editor"),
 	banned: boolean().notNull().default(false),
 	banReason: text(),
+	/**
+	* Per notification kind, the channels this person switched on or off. Only what
+	* differs from the catalogue's defaults is stored; see `resolveNotificationPreferences`.
+	*/
+	notificationPreferences: jsonb().$type().notNull().default(sql`'{}'::jsonb`),
 	createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
 	updatedAt: timestamp({ withTimezone: true }).notNull().defaultNow()
 }, (table) => [uniqueIndex("users_email_key").on(table.email)]);
@@ -309,6 +352,7 @@ const contentTypes = pgTable("content_types", {
 	isPublishable: boolean().notNull().default(true),
 	isVisibleInTree: boolean().notNull().default(true),
 	canBeVisibleInMenu: boolean().notNull().default(true),
+	requiresApproval: boolean().notNull().default(false),
 	fields: jsonb().$type().notNull().default(sql`'[]'::jsonb`),
 	createdAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
 	updatedAt: timestamp({ withTimezone: true }).notNull().defaultNow()
@@ -349,6 +393,68 @@ const menuItems = pgTable("menu_items", {
 	url: text()
 }, (table) => [index("menu_items_menu_idx").on(table.menuId, table.parentId, table.position), index("menu_items_localization_idx").on(table.localizationId)]);
 //#endregion
+//#region src/schema/notifications.ts
+/**
+* One notification, for one person. A single event that concerns five people is five
+* rows, so each can be read, kept or dropped on its own; the fan-out is the service's.
+*
+* The row is the in-app copy. Email and push are sent at the same time and leave no
+* row of their own: a notification the person turned off in the admin but kept by
+* email is a mail, not a row here.
+*/
+const notifications = pgTable("notifications", {
+	id: uuid().primaryKey().defaultRandom(),
+	userId: uuid().notNull().references(() => users.id, { onDelete: "cascade" }),
+	/** Null for something that concerns the instance rather than a space. */
+	spaceId: uuid().references(() => spaces.id, { onDelete: "cascade" }),
+	kind: text().$type().notNull(),
+	title: text().notNull(),
+	body: text().notNull().default(""),
+	/** Where to go in the admin, as a path: `/content/<id>`. */
+	url: text(),
+	/** What it is about, so the inbox can group and a target's later fate can be shown. */
+	targetKind: text(),
+	targetId: text(),
+	/**
+	* Who caused it; `null` for the system. Text rather than a uuid, like the audit
+	* log's actor: it is a snapshot of whoever acted, not a reference.
+	*/
+	actorId: text(),
+	actorLabel: text(),
+	meta: jsonb().$type(),
+	readAt: timestamp({ withTimezone: true }),
+	createdAt: timestamp({ withTimezone: true }).notNull().defaultNow()
+}, (table) => [
+	index("notifications_user_created_idx").on(table.userId, table.createdAt),
+	index("notifications_user_unread_idx").on(table.userId, table.readAt),
+	index("notifications_target_idx").on(table.targetKind, table.targetId)
+]);
+/**
+* A request to publish a document on the author's behalf, and what became of it. One
+* document may have several over its life (sent back, resubmitted), but at most one
+* pending at a time; the service keeps that rule, the table keeps the history.
+*
+* Cascades with the document: a deleted draft has nothing left to approve.
+*/
+const contentApprovals = pgTable("content_approvals", {
+	id: uuid().primaryKey().defaultRandom(),
+	spaceId: uuid().notNull().references(() => spaces.id, { onDelete: "cascade" }),
+	contentId: uuid().notNull().references(() => contents.id, { onDelete: "cascade" }),
+	typeId: uuid().notNull(),
+	status: text().$type().notNull().default("pending"),
+	/** Who asked; kept even once the account is gone, so the history stays readable. */
+	requestedBy: uuid(),
+	requestedByLabel: text().notNull().default(""),
+	requestNote: text(),
+	/** The document's version when it was submitted, so a reviewer sees what changed since. */
+	contentVersion: integer(),
+	requestedAt: timestamp({ withTimezone: true }).notNull().defaultNow(),
+	decidedBy: uuid(),
+	decidedByLabel: text(),
+	decisionNote: text(),
+	decidedAt: timestamp({ withTimezone: true })
+}, (table) => [index("content_approvals_content_idx").on(table.contentId, table.requestedAt), index("content_approvals_space_status_idx").on(table.spaceId, table.status, table.requestedAt)]);
+//#endregion
 //#region src/schema/relations.ts
 const spacesRelations = relations(spaces, ({ many }) => ({
 	contents: many(contents),
@@ -510,6 +616,8 @@ var schema_exports = /* @__PURE__ */ __exportAll({
 	assetVariantsRelations: () => assetVariantsRelations,
 	assets: () => assets,
 	assetsRelations: () => assetsRelations,
+	auditEntries: () => auditEntries,
+	contentApprovals: () => contentApprovals,
 	contentTypes: () => contentTypes,
 	contentVersions: () => contentVersions,
 	contents: () => contents,
@@ -520,6 +628,7 @@ var schema_exports = /* @__PURE__ */ __exportAll({
 	menuItemsRelations: () => menuItemsRelations,
 	menus: () => menus,
 	menusRelations: () => menusRelations,
+	notifications: () => notifications,
 	publishedContents: () => publishedContents,
 	pushSubscriptions: () => pushSubscriptions,
 	roles: () => roles,
@@ -536,4 +645,4 @@ var schema_exports = /* @__PURE__ */ __exportAll({
 	workflows: () => workflows
 });
 //#endregion
-export { contentVersions as A, tsvector as B, roles as C, assetUsages as D, verifications as E, idToLabel as F, labelToId as I, ltree as L, publishedContents as M, spaces as N, assetVariants as O, buildPath as P, parsePath as R, memberships as S, users as T, menuItems as _, webhookDeliveries as a, accounts as b, assetVariantsRelations as c, membershipsRelations as d, menuItemsRelations as f, usersRelations as g, spacesRelations as h, workflows as i, contents as j, assets as k, assetsRelations as l, rolesRelations as m, pushSubscriptions as n, webhooks as o, menusRelations as p, workflowRuns as r, assetUsagesRelations as s, schema_exports as t, contentsRelations as u, menus as v, sessions as w, apikeys as x, contentTypes as y, pathDepth as z };
+export { assetUsages as A, ltree as B, apikeys as C, users as D, sessions as E, publishedContents as F, pathDepth as H, spaces as I, buildPath as L, assets as M, contentVersions as N, verifications as O, contents as P, idToLabel as R, accounts as S, roles as T, tsvector as U, parsePath as V, contentApprovals as _, webhookDeliveries as a, menus as b, assetVariantsRelations as c, membershipsRelations as d, menuItemsRelations as f, usersRelations as g, spacesRelations as h, workflows as i, assetVariants as j, auditEntries as k, assetsRelations as l, rolesRelations as m, pushSubscriptions as n, webhooks as o, menusRelations as p, workflowRuns as r, assetUsagesRelations as s, schema_exports as t, contentsRelations as u, notifications as v, memberships as w, contentTypes as x, menuItems as y, labelToId as z };

package/dist/schema.d.ts

@@ -1,2 +1,2 @@
-import { A as menusRelations, B as accounts, C as spaces, D as contentsRelations, E as assetsRelations, F as menus, G as users, H as memberships, I as contentTypes, J as assetVariants, K as verifications, L as contentVersions, M as spacesRelations, N as usersRelations, O as membershipsRelations, P as menuItems, R as contents, S as webhooks, T as assetVariantsRelations, U as roles, V as apikeys, W as sessions, Y as assets, a as ContentRow, b as workflows, c as MembershipRow, d as PushSubscriptionRow, f as RoleRow, g as WorkflowRunRow, h as WorkflowRow, i as ContentInsert, j as rolesRelations, k as menuItemsRelations, l as MenuItemRow, m as UserRow, n as AssetUsageRow, o as ContentTypeRow, p as SpaceRow, q as assetUsages, r as AssetVariantRow, s as ContentVersionRow, t as AssetRow, u as MenuRow, v as pushSubscriptions, w as assetUsagesRelations, x as webhookDeliveries, y as workflowRuns, z as publishedContents } from "./index-rZ24t-Ln.js";
-export { AssetRow, AssetUsageRow, AssetVariantRow, ContentInsert, ContentRow, ContentTypeRow, ContentVersionRow, MembershipRow, MenuItemRow, MenuRow, PushSubscriptionRow, RoleRow, SpaceRow, UserRow, WorkflowRow, WorkflowRunRow, accounts, apikeys, assetUsages, assetUsagesRelations, assetVariants, assetVariantsRelations, assets, assetsRelations, contentTypes, contentVersions, contents, contentsRelations, memberships, membershipsRelations, menuItems, menuItemsRelations, menus, menusRelations, publishedContents, pushSubscriptions, roles, rolesRelations, sessions, spaces, spacesRelations, users, usersRelations, verifications, webhookDeliveries, webhooks, workflowRuns, workflows };
+import { $ as assetUsages, A as contentsRelations, B as menus, C as workflows, D as assetUsagesRelations, E as spaces, F as spacesRelations, G as accounts, H as contentVersions, I as usersRelations, J as roles, K as apikeys, L as contentApprovals, M as menuItemsRelations, N as menusRelations, O as assetVariantsRelations, P as rolesRelations, Q as auditEntries, R as notifications, S as workflowRuns, T as webhooks, U as contents, V as contentTypes, W as publishedContents, X as users, Y as sessions, Z as verifications, _ as UserRow, a as ContentApprovalRow, c as ContentTypeRow, d as MenuItemRow, et as assetVariants, f as MenuRow, g as SpaceRow, h as RoleRow, i as AuditEntryRow, j as membershipsRelations, k as assetsRelations, l as ContentVersionRow, m as PushSubscriptionRow, n as AssetUsageRow, o as ContentInsert, p as NotificationRow, q as memberships, r as AssetVariantRow, s as ContentRow, t as AssetRow, tt as assets, u as MembershipRow, v as WorkflowRow, w as webhookDeliveries, x as pushSubscriptions, y as WorkflowRunRow, z as menuItems } from "./index-DrNMGM9N.js";
+export { AssetRow, AssetUsageRow, AssetVariantRow, AuditEntryRow, ContentApprovalRow, ContentInsert, ContentRow, ContentTypeRow, ContentVersionRow, MembershipRow, MenuItemRow, MenuRow, NotificationRow, PushSubscriptionRow, RoleRow, SpaceRow, UserRow, WorkflowRow, WorkflowRunRow, accounts, apikeys, assetUsages, assetUsagesRelations, assetVariants, assetVariantsRelations, assets, assetsRelations, auditEntries, contentApprovals, contentTypes, contentVersions, contents, contentsRelations, memberships, membershipsRelations, menuItems, menuItemsRelations, menus, menusRelations, notifications, publishedContents, pushSubscriptions, roles, rolesRelations, sessions, spaces, spacesRelations, users, usersRelations, verifications, webhookDeliveries, webhooks, workflowRuns, workflows };

package/dist/schema.js

@@ -1,2 +1,2 @@
-import { A as contentVersions, C as roles, D as assetUsages, E as verifications, M as publishedContents, N as spaces, O as assetVariants, S as memberships, T as users, _ as menuItems, a as webhookDeliveries, b as accounts, c as assetVariantsRelations, d as membershipsRelations, f as menuItemsRelations, g as usersRelations, h as spacesRelations, i as workflows, j as contents, k as assets, l as assetsRelations, m as rolesRelations, n as pushSubscriptions, o as webhooks, p as menusRelations, r as workflowRuns, s as assetUsagesRelations, u as contentsRelations, v as menus, w as sessions, x as apikeys, y as contentTypes } from "./schema-Bb4p16Yz.js";
-export { accounts, apikeys, assetUsages, assetUsagesRelations, assetVariants, assetVariantsRelations, assets, assetsRelations, contentTypes, contentVersions, contents, contentsRelations, memberships, membershipsRelations, menuItems, menuItemsRelations, menus, menusRelations, publishedContents, pushSubscriptions, roles, rolesRelations, sessions, spaces, spacesRelations, users, usersRelations, verifications, webhookDeliveries, webhooks, workflowRuns, workflows };
+import { A as assetUsages, C as apikeys, D as users, E as sessions, F as publishedContents, I as spaces, M as assets, N as contentVersions, O as verifications, P as contents, S as accounts, T as roles, _ as contentApprovals, a as webhookDeliveries, b as menus, c as assetVariantsRelations, d as membershipsRelations, f as menuItemsRelations, g as usersRelations, h as spacesRelations, i as workflows, j as assetVariants, k as auditEntries, l as assetsRelations, m as rolesRelations, n as pushSubscriptions, o as webhooks, p as menusRelations, r as workflowRuns, s as assetUsagesRelations, u as contentsRelations, v as notifications, w as memberships, x as contentTypes, y as menuItems } from "./schema-Dm3RcBst.js";
+export { accounts, apikeys, assetUsages, assetUsagesRelations, assetVariants, assetVariantsRelations, assets, assetsRelations, auditEntries, contentApprovals, contentTypes, contentVersions, contents, contentsRelations, memberships, membershipsRelations, menuItems, menuItemsRelations, menus, menusRelations, notifications, publishedContents, pushSubscriptions, roles, rolesRelations, sessions, spaces, spacesRelations, users, usersRelations, verifications, webhookDeliveries, webhooks, workflowRuns, workflows };

package/dist/testing.d.ts

@@ -1,4 +1,4 @@
-import { U as DatabaseHandle, t as Repositories } from "./index-Cyf_N5K3.js";
+import { it as DatabaseHandle, t as Repositories } from "./index-BLAkQMJT.js";
 import { ContentTypeDefinition, ContentTypeRegistry } from "@manablox/core";
 //#region src/testing-fixtures.d.ts
 export declare const stringField: import("@manablox/core").FieldTypeDefinition<Record<string, unknown>, string>;

package/dist/testing.js

@@ -1,4 +1,4 @@
-import { _ as applyBootstrapSql, g as createDatabase, t as createRepositories } from "./repositories-DYjzuuF6.js";
+import { b as applyBootstrapSql, t as createRepositories, y as createDatabase } from "./repositories-pz4NeWaF.js";
 import postgres from "postgres";
 import { ContentTypeRegistry, FieldTypeRegistry, defineContentType, defineFieldType } from "@manablox/core";
 import { dirname, join, resolve } from "node:path";

package/migrations/0009_audit-log.sql

@@ -0,0 +1,40 @@
+CREATE TABLE "audit_entries" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"seq" bigserial NOT NULL,
+	"at" timestamp with time zone DEFAULT now() NOT NULL,
+	"space_id" uuid,
+	"actor_kind" text NOT NULL,
+	"actor_id" text,
+	"actor_label" text NOT NULL,
+	"actor_detail" jsonb,
+	"action" text NOT NULL,
+	"target_kind" text NOT NULL,
+	"target_id" text,
+	"target_label" text,
+	"changes" jsonb DEFAULT '[]'::jsonb NOT NULL,
+	"meta" jsonb,
+	"prev_hash" text,
+	"hash" text NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX "audit_entries_seq_idx" ON "audit_entries" USING btree ("seq");--> statement-breakpoint
+CREATE INDEX "audit_entries_space_at_idx" ON "audit_entries" USING btree ("space_id","at");--> statement-breakpoint
+CREATE INDEX "audit_entries_target_idx" ON "audit_entries" USING btree ("target_kind","target_id");--> statement-breakpoint
+CREATE INDEX "audit_entries_actor_idx" ON "audit_entries" USING btree ("actor_kind","actor_id");--> statement-breakpoint
+CREATE INDEX "audit_entries_action_idx" ON "audit_entries" USING btree ("action");--> statement-breakpoint
+-- The log is append-only. Postgres has no "insert-only" grant short of a second role,
+-- so a trigger refuses every update and delete instead; dropping it is a deliberate,
+-- visible act rather than a stray statement. Not tracked by drizzle-kit: `pnpm
+-- db:generate` neither sees nor removes it.
+CREATE FUNCTION audit_entries_immutable() RETURNS trigger AS $$
+BEGIN
+  RAISE EXCEPTION 'audit_entries is append-only: % refused', TG_OP
+    USING ERRCODE = 'insufficient_privilege';
+END;
+$$ LANGUAGE plpgsql;--> statement-breakpoint
+CREATE TRIGGER audit_entries_immutable
+  BEFORE UPDATE OR DELETE ON "audit_entries"
+  FOR EACH ROW EXECUTE FUNCTION audit_entries_immutable();--> statement-breakpoint
+CREATE TRIGGER audit_entries_no_truncate
+  BEFORE TRUNCATE ON "audit_entries"
+  FOR EACH STATEMENT EXECUTE FUNCTION audit_entries_immutable();

package/migrations/0010_notifications-approvals.sql

@@ -0,0 +1,45 @@
+CREATE TABLE "content_approvals" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"space_id" uuid NOT NULL,
+	"content_id" uuid NOT NULL,
+	"type_id" uuid NOT NULL,
+	"status" text DEFAULT 'pending' NOT NULL,
+	"requested_by" uuid,
+	"requested_by_label" text DEFAULT '' NOT NULL,
+	"request_note" text,
+	"content_version" integer,
+	"requested_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"decided_by" uuid,
+	"decided_by_label" text,
+	"decision_note" text,
+	"decided_at" timestamp with time zone
+);
+--> statement-breakpoint
+CREATE TABLE "notifications" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"user_id" uuid NOT NULL,
+	"space_id" uuid,
+	"kind" text NOT NULL,
+	"title" text NOT NULL,
+	"body" text DEFAULT '' NOT NULL,
+	"url" text,
+	"target_kind" text,
+	"target_id" text,
+	"actor_id" text,
+	"actor_label" text,
+	"meta" jsonb,
+	"read_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "notification_preferences" jsonb DEFAULT '{}'::jsonb NOT NULL;--> statement-breakpoint
+ALTER TABLE "content_types" ADD COLUMN "requires_approval" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE "content_approvals" ADD CONSTRAINT "content_approvals_space_id_spaces_id_fk" FOREIGN KEY ("space_id") REFERENCES "public"."spaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "content_approvals" ADD CONSTRAINT "content_approvals_content_id_contents_id_fk" FOREIGN KEY ("content_id") REFERENCES "public"."contents"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "notifications" ADD CONSTRAINT "notifications_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "notifications" ADD CONSTRAINT "notifications_space_id_spaces_id_fk" FOREIGN KEY ("space_id") REFERENCES "public"."spaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "content_approvals_content_idx" ON "content_approvals" USING btree ("content_id","requested_at");--> statement-breakpoint
+CREATE INDEX "content_approvals_space_status_idx" ON "content_approvals" USING btree ("space_id","status","requested_at");--> statement-breakpoint
+CREATE INDEX "notifications_user_created_idx" ON "notifications" USING btree ("user_id","created_at");--> statement-breakpoint
+CREATE INDEX "notifications_user_unread_idx" ON "notifications" USING btree ("user_id","read_at");--> statement-breakpoint
+CREATE INDEX "notifications_target_idx" ON "notifications" USING btree ("target_kind","target_id");