@marktiderman/genesis-supabase 0.1.1 → 0.3.0

package/functions/genesis-support-notify/handler.ts

@@ -0,0 +1,167 @@
+/**
+ * The genesis-support-notify Edge Function's request handling, with its
+ * dependencies passed in, so it is tested without Deno.
+ *
+ * A Supabase Database Webhook calls it on INSERT into public.support_reports
+ * (Dashboard → Database → Webhooks, or `supabase_functions.http_request` in a
+ * migration of your own), with the header `x-genesis-support-secret: <secret>`.
+ * It forwards a summary to the sinks that are configured:
+ *
+ *   - a GitHub issue per report: GITHUB_TOKEN (fine-grained, Issues: write on
+ *     one repository) and GITHUB_REPO ("owner/name"); GITHUB_LABELS optional;
+ *   - a webhook: SUPPORT_WEBHOOK_URL, the body signed with
+ *     SUPPORT_WEBHOOK_SIGNING_SECRET as `x-genesis-signature: sha256=<hex>`.
+ *
+ * What leaves the database is the summary only: the report id, type, title,
+ * message (cut to 2000 characters), route, app version, platform and time.
+ * Never the person's id or email, the device or context bags, or a
+ * screenshot. The message is what the person typed and may still name
+ * someone, so point the GitHub sink at a private repository.
+ */
+
+export interface ReportRecord {
+  id: string;
+  type?: string;
+  title?: string | null;
+  message?: string;
+  route?: string | null;
+  app_version?: string | null;
+  platform?: string | null;
+  created_at?: string;
+}
+
+export interface ReportSummary {
+  id: string;
+  type: string;
+  title: string;
+  message: string;
+  route: string | null;
+  appVersion: string | null;
+  platform: string | null;
+  createdAt: string | null;
+}
+
+export interface NotifyDeps {
+  env: (name: string) => string | undefined;
+  fetch: typeof fetch;
+  log: (message: string) => void;
+}
+
+const MESSAGE_CAP = 2000;
+
+/** The only fields a sink ever sees. */
+export function summarize(record: ReportRecord): ReportSummary {
+  const message = String(record.message ?? "");
+  return {
+    id: String(record.id),
+    type: String(record.type ?? "bug"),
+    title: (record.title ?? "").trim() || message.slice(0, 120),
+    message: message.length > MESSAGE_CAP ? `${message.slice(0, MESSAGE_CAP)}…` : message,
+    route: record.route ?? null,
+    appVersion: record.app_version ?? null,
+    platform: record.platform ?? null,
+    createdAt: record.created_at ?? null,
+  };
+}
+
+/** A constant-time comparison, so the secret can't be guessed a byte at a time. */
+export function sameSecret(a: string, b: string): boolean {
+  const x = new TextEncoder().encode(a);
+  const y = new TextEncoder().encode(b);
+  let diff = x.length ^ y.length;
+  for (let i = 0; i < Math.max(x.length, y.length); i++) diff |= (x[i] ?? 0) ^ (y[i] ?? 0);
+  return diff === 0;
+}
+
+export async function hmacHex(secret: string, body: string): Promise<string> {
+  const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const sig = new Uint8Array(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(body)));
+  return Array.from(sig, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+function json(status: number, body: Record<string, unknown>): Response {
+  return new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json", "cache-control": "no-store" } });
+}
+
+/** Markdown for the issue body; the person's text is fenced so it can't mention or link anyone. */
+export function issueBody(s: ReportSummary): string {
+  const fence = "````";
+  return [
+    `**${s.type}** from the app${s.platform ? ` (${s.platform})` : ""}`,
+    "",
+    fence,
+    s.message.replaceAll(fence, "``` `"),
+    fence,
+    "",
+    `- Route: ${s.route ? `\`${s.route.replaceAll("`", "")}\`` : "none"}`,
+    `- Version: ${s.appVersion ? `\`${s.appVersion.replaceAll("`", "")}\`` : "unknown"}`,
+    `- Report: \`${s.id}\``,
+  ].join("\n");
+}
+
+export async function handle(req: Request, deps: NotifyDeps): Promise<Response> {
+  if (req.method !== "POST") return json(405, { error: "method_not_allowed" });
+  const secret = deps.env("GENESIS_SUPPORT_WEBHOOK_SECRET") ?? "";
+  if (!secret) {
+    deps.log("[genesis-support-notify] GENESIS_SUPPORT_WEBHOOK_SECRET is not set; refusing every call");
+    return json(500, { error: "not_configured" });
+  }
+  if (!sameSecret(req.headers.get("x-genesis-support-secret") ?? "", secret)) return json(401, { error: "unauthorized" });
+
+  let payload: { type?: string; table?: string; schema?: string; record?: ReportRecord };
+  try {
+    payload = await req.json();
+  } catch {
+    return json(400, { error: "invalid_json" });
+  }
+  if (payload.type !== "INSERT" || payload.table !== "support_reports" || !payload.record?.id) {
+    return json(200, { ok: true, skipped: true });
+  }
+  const summary = summarize(payload.record);
+  const sent: string[] = [];
+  const failed: string[] = [];
+
+  const repo = deps.env("GITHUB_REPO");
+  const token = deps.env("GITHUB_TOKEN");
+  if (repo && token) {
+    if (!/^[\w.-]+\/[\w.-]+$/.test(repo)) {
+      deps.log("[genesis-support-notify] GITHUB_REPO must be owner/name");
+      failed.push("github");
+    } else {
+      const labels = (deps.env("GITHUB_LABELS") ?? "feedback").split(",").map((l) => l.trim()).filter(Boolean);
+      const res = await deps.fetch(`https://api.github.com/repos/${repo}/issues`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${token}`, accept: "application/vnd.github+json", "content-type": "application/json", "user-agent": "genesis-support-notify" },
+        body: JSON.stringify({ title: `[${summary.type}] ${summary.title}`.slice(0, 256), body: issueBody(summary), labels: [...labels, summary.type] }),
+      });
+      if (res.ok) sent.push("github");
+      else {
+        deps.log(`[genesis-support-notify] GitHub answered ${res.status}`);
+        failed.push("github");
+      }
+    }
+  }
+
+  const hook = deps.env("SUPPORT_WEBHOOK_URL");
+  if (hook) {
+    if (!hook.startsWith("https://")) {
+      deps.log("[genesis-support-notify] SUPPORT_WEBHOOK_URL must be https");
+      failed.push("webhook");
+    } else {
+      const body = JSON.stringify({ event: "support.report.created", report: summary });
+      const signing = deps.env("SUPPORT_WEBHOOK_SIGNING_SECRET");
+      const headers: Record<string, string> = { "content-type": "application/json" };
+      if (signing) headers["x-genesis-signature"] = `sha256=${await hmacHex(signing, body)}`;
+      const res = await deps.fetch(hook, { method: "POST", headers, body });
+      if (res.ok) sent.push("webhook");
+      else {
+        deps.log(`[genesis-support-notify] the webhook answered ${res.status}`);
+        failed.push("webhook");
+      }
+    }
+  }
+
+  if (!sent.length && !failed.length) deps.log("[genesis-support-notify] no sink is configured (GITHUB_REPO + GITHUB_TOKEN, or SUPPORT_WEBHOOK_URL)");
+  // 502 when a sink failed, so the database webhook's log shows it.
+  return json(failed.length ? 502 : 200, { ok: failed.length === 0, sent, failed });
+}

package/functions/genesis-support-notify/index.ts

@@ -0,0 +1,15 @@
+// genesis-support-notify: an optional server-side sink for new support reports.
+// A Database Webhook on INSERT into public.support_reports calls it; it opens a
+// GitHub issue per report and/or posts a signed webhook, with a summary only
+// (no person id, email, device, context or screenshot). See handler.ts.
+// A template from @marktiderman/genesis-supabase: copy this folder to your app's
+// `supabase/functions/`, beside migration 0006 (see the package README).
+//
+// Secrets (`supabase secrets set …`): GENESIS_SUPPORT_WEBHOOK_SECRET (required; the
+// database webhook sends it as `x-genesis-support-secret`), and for each sink you
+// want: GITHUB_TOKEN + GITHUB_REPO (+ GITHUB_LABELS), SUPPORT_WEBHOOK_URL
+// (+ SUPPORT_WEBHOOK_SIGNING_SECRET). Deploy with `verify_jwt = false`: the
+// webhook secret is the check.
+import { handle } from "./handler.ts";
+
+Deno.serve((req) => handle(req, { env: (name) => Deno.env.get(name), fetch, log: (message) => console.error(message) }));

package/functions/tests/genesis-apple-revoke_test.ts

@@ -0,0 +1,81 @@
+// Deno test for the genesis-apple-revoke function's handler, in the runtime it
+// deploys to (WebCrypto, fetch, Request). Apple and the database are faked.
+//   deno test functions/tests/genesis-apple-revoke_test.ts
+import { handle, type DueRevocation, type HandlerDeps } from "../genesis-apple-revoke/handler.ts";
+import { decodeJwtPayload } from "../genesis-apple-revoke/apple.ts";
+
+function assertEquals(actual: unknown, expected: unknown, message = "") {
+  const a = JSON.stringify(actual);
+  const e = JSON.stringify(expected);
+  if (a !== e) throw new Error(`${message} expected ${e}, got ${a}`);
+}
+
+const pair = await crypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, ["sign", "verify"]);
+const der = new Uint8Array(await crypto.subtle.exportKey("pkcs8", pair.privateKey));
+const pem = `-----BEGIN PRIVATE KEY-----\n${btoa(String.fromCharCode(...der))}\n-----END PRIVATE KEY-----`;
+const env: Record<string, string> = { APPLE_TEAM_ID: "TEAM123456", APPLE_KEY_ID: "KEY1234567", APPLE_PRIVATE_KEY: pem, APPLE_CLIENT_IDS: "com.example.app" };
+const b64 = (o: unknown) => btoa(JSON.stringify(o)).replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
+
+function deps(queue: DueRevocation[], forms: Record<string, string>[]): HandlerDeps & { saved: unknown[][]; done: number[] } {
+  const saved: unknown[][] = [];
+  const done: number[] = [];
+  return {
+    saved,
+    done,
+    env: (n) => env[n],
+    fetch: (async (url: string | URL | Request, init?: RequestInit) => {
+      const form = Object.fromEntries(new URLSearchParams(String(init?.body)));
+      forms.push({ url: String(url), ...form });
+      if (String(url).endsWith("/auth/token")) {
+        const id_token = `${b64({ alg: "RS256" })}.${b64({ iss: "https://appleid.apple.com", aud: "com.example.app", sub: "apple-sub" })}.sig`;
+        return new Response(JSON.stringify({ refresh_token: "rt", id_token }), { status: 200 });
+      }
+      return new Response(null, { status: 200 });
+    }) as typeof fetch,
+    getUser: async (t) => (t === "access" ? { id: "user-1", appleUserIds: ["apple-sub"] } : null),
+    store: {
+      save: async (...args) => {
+        saved.push(args);
+        return "stored";
+      },
+      claim: async () => queue.splice(0),
+      done: async (id) => void done.push(id),
+      failed: async () => "retry" as const,
+    },
+    log: () => {},
+  };
+}
+
+const post = (body: unknown, token?: string) =>
+  new Request("http://localhost/functions/v1/genesis-apple-revoke", { method: "POST", headers: token ? { authorization: `Bearer ${token}` } : {}, body: JSON.stringify(body) });
+
+Deno.test("store exchanges the code with a signed client secret and saves the token", async () => {
+  const forms: Record<string, string>[] = [];
+  const d = deps([], forms);
+  const res = await handle(post({ action: "store", code: "code-1" }, "access"), d);
+  assertEquals(res.status, 200);
+  assertEquals(await res.json(), { ok: true });
+  assertEquals(d.saved, [["user-1", "com.example.app", "rt"]]);
+  const secret = forms[0]!.client_secret!;
+  const [h, p, s] = secret.split(".");
+  const ok = await crypto.subtle.verify(
+    { name: "ECDSA", hash: "SHA-256" },
+    pair.publicKey,
+    Uint8Array.from(atob(s!.replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0)),
+    new TextEncoder().encode(`${h}.${p}`),
+  );
+  assertEquals(ok, true, "client secret signature");
+  assertEquals(decodeJwtPayload(secret)?.sub, "com.example.app");
+});
+
+Deno.test("revoke works through the queue with no caller", async () => {
+  const forms: Record<string, string>[] = [];
+  const d = deps([{ id: 9, client_id: "com.example.app", refresh_token: "queued-rt", attempts: 1 }], forms);
+  const res = await handle(post({ action: "revoke" }), d);
+  assertEquals(res.status, 200);
+  // First the proof (the token is live with these secrets), then the revocation.
+  assertEquals(forms[0]!.grant_type, "refresh_token");
+  assertEquals(forms[1]!.url, "https://appleid.apple.com/auth/revoke");
+  assertEquals(forms[1]!.token_type_hint, "refresh_token");
+  assertEquals(d.done, [9]);
+});

package/functions/tests/genesis-push-send_test.ts

@@ -0,0 +1,53 @@
+// Deno test for the genesis-push-send function's handler, in the runtime it
+// deploys to (WebCrypto, fetch, Request, AbortSignal.timeout). Expo and the
+// database are faked.
+//   deno test functions/tests/genesis-push-send_test.ts
+import { handle, type HandlerDeps, type TicketRow } from "../genesis-push-send/handler.ts";
+
+function assertEquals(actual: unknown, expected: unknown, message = "") {
+  const a = JSON.stringify(actual);
+  const e = JSON.stringify(expected);
+  if (a !== e) throw new Error(`${message} expected ${e}, got ${a}`);
+}
+
+const secret = "x".repeat(32);
+const user = "00000000-0000-4000-8000-000000000001";
+
+function deps(sentBodies: unknown[], tickets: TicketRow[]): HandlerDeps {
+  return {
+    env: (n) => ({ GENESIS_PUSH_SECRET: secret })[n],
+    fetch: (async (_url: string | URL | Request, init?: RequestInit) => {
+      const body = JSON.parse(String(init?.body)) as unknown[];
+      sentBodies.push(body);
+      return new Response(JSON.stringify({ data: body.map((_, i) => ({ status: "ok", id: `t${i}` })) }), { status: 200 });
+    }) as typeof fetch,
+    store: {
+      targets: async () => [{ device_id: "d1", token: "ExponentPushToken[abc]", platform: "ios", hide_previews: true }],
+      status: async () => ({ deliver: true, reason: "ok", quiet_until: null }),
+      recordTickets: async (rows) => void tickets.push(...rows),
+      forgetDevices: async () => {},
+      claimReceipts: async () => [],
+      settleReceipts: async () => {},
+    },
+    log: () => {},
+  };
+}
+
+Deno.test("sends with hidden previews and records the ticket", async () => {
+  const sent: unknown[] = [];
+  const tickets: TicketRow[] = [];
+  const req = new Request("http://localhost", {
+    method: "POST",
+    headers: { authorization: `Bearer ${secret}` },
+    body: JSON.stringify({ action: "send", messages: [{ userId: user, category: "messages", title: "Private title", body: "Private body", url: "/messages/1" }] }),
+  });
+  const res = await handle(req, deps(sent, tickets));
+  assertEquals(res.status, 200);
+  assertEquals(sent, [[{ to: "ExponentPushToken[abc]", title: "New notification", data: { category: "messages", url: "/messages/1" }, sound: "default", channelId: "messages", priority: "high" }]]);
+  assertEquals(tickets, [{ user_id: user, device_id: "d1", category: "messages", ticket_id: "t0", status: "sent" }]);
+});
+
+Deno.test("refuses a caller without the secret", async () => {
+  const res = await handle(new Request("http://localhost", { method: "POST", headers: { authorization: "Bearer nope" }, body: "{}" }), deps([], []));
+  assertEquals(res.status, 401);
+});

package/migrations/0001_genesis_account_deletion.sql

@@ -0,0 +1,133 @@
+-- Genesis account deletion: public.delete_my_account()
+--
+-- App Store Review Guideline 5.1.1(v) requires an app that lets people make
+-- an account to let them delete it from inside the app. This function deletes
+-- the signed-in person's login; the client half is `deleteMyAccount(client)`
+-- in @marktiderman/genesis-supabase.
+--
+-- Use: copy this file into your app's `supabase/migrations/` under a new
+-- timestamped name (e.g. `20261024000000_genesis_account_deletion.sql`).
+-- Never edit it once applied; change it with a new migration.
+--
+-- What it refuses, by SQLSTATE (the client sees it as `SupabaseQueryError.code`):
+--   42501  nobody is signed in, or the person has a verified MFA factor and
+--          this session isn't aal2 (verify the second factor first)
+--   GA001  refused by the app's hook (below), e.g. the sole owner of something
+--   GA002  the app requires a recent sign-in and this one isn't (below)
+--   23503  a row still references the login (see "Your data")
+--
+-- Your data: deleting from auth.users removes rows whose foreign keys to
+-- auth.users(id) say `on delete cascade`, and fails (23503) on any that
+-- don't, so the person keeps their whole account rather than half of it. Give
+-- every user-owned table a foreign key to auth.users with `on delete cascade`
+-- (or `set null` for rows that must outlive the person): a table keyed on
+-- auth.uid() with no foreign key keeps orphans, and accepts new ones while an
+-- old access token is still valid (below).
+--
+-- Storage: Supabase documents that a user who owns objects in Storage can't
+-- be deleted, so this fails (23503) while they have files. Remove a person's
+-- files through the Storage API (not SQL) before calling it. (Documented by
+-- Supabase; not verified against a full stack in Genesis's own tests.)
+--
+-- Sign in with Apple: Apple requires apps to revoke the person's Apple tokens
+-- (https://appleid.apple.com/auth/revoke) when the account is deleted. That
+-- needs your Apple client secret, so it is a server step this file can't do;
+-- see the package README ("Not covered yet").
+--
+-- Sessions: the person's refresh tokens go with the login. An access token
+-- already issued stays valid until it expires (the JWT expiry, one hour by
+-- default); `deleteMyAccount` signs this device out straight after.
+--
+-- The app hook: if `private.genesis_before_account_delete(uuid)` exists, it
+-- runs first, in the same transaction, with this function's (the owner's)
+-- rights and the person's id. Use it to scrub data, set flags, or refuse. Any
+-- error it raises refuses the delete and nothing is deleted; it reaches the
+-- client as GA001 (or as the hook's own code when that starts with GA), e.g.
+--
+--   create function private.genesis_before_account_delete(person uuid) returns void
+--   language plpgsql set search_path = '' as $$
+--   begin
+--     if exists (select 1 from public.teams t where t.sole_owner = person) then
+--       raise exception 'Hand over your teams before deleting your account';
+--     end if;
+--     -- Optional: require a sign-in in the last 10 minutes (GA002 otherwise).
+--     perform private.genesis_require_recent_sign_in(interval '10 minutes');
+--   end $$;
+--   revoke execute on function private.genesis_before_account_delete(uuid) from public, anon, authenticated;
+--
+-- Verify: the pgTAP test beside this file (`tests/0001_genesis_account_deletion.test.sql`).
+
+create schema if not exists private;
+
+-- Raises GA002 unless the person authenticated (password, OTP, OAuth, MFA…)
+-- within `max_age`. Reads the newest `amr` timestamp in the JWT, which records
+-- when they actually signed in and survives token refreshes; falls back to
+-- `iat` (when this token was issued, which a refresh renews) without one.
+-- Not called by default: an app turns it on from its hook.
+create or replace function private.genesis_require_recent_sign_in(max_age interval)
+returns void
+language plpgsql
+stable
+set search_path = ''
+as $$
+declare
+  claims jsonb := coalesce(nullif(current_setting('request.jwt.claims', true), '')::jsonb, '{}'::jsonb);
+  signed_in bigint;
+begin
+  select max((m ->> 'timestamp')::bigint) into signed_in
+  from jsonb_array_elements(case when jsonb_typeof(claims -> 'amr') = 'array' then claims -> 'amr' else '[]'::jsonb end) m
+  where m ->> 'timestamp' ~ '^\d+$';
+  signed_in := coalesce(signed_in, nullif(claims ->> 'iat', '')::bigint);
+  if signed_in is null or to_timestamp(signed_in) < now() - max_age then
+    raise exception 'delete_my_account: sign in again to delete your account'
+      using errcode = 'GA002', hint = 'Ask the person to sign in again, then retry.';
+  end if;
+end;
+$$;
+
+create or replace function public.delete_my_account()
+returns void
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  me uuid := auth.uid();
+  claims jsonb := coalesce(nullif(current_setting('request.jwt.claims', true), '')::jsonb, '{}'::jsonb);
+begin
+  if me is null then
+    raise exception 'delete_my_account: not signed in' using errcode = '42501';
+  end if;
+
+  -- MFA step-up: with a verified second factor, only an aal2 session may delete.
+  if exists (select 1 from auth.mfa_factors f where f.user_id = me and f.status = 'verified')
+     and coalesce(claims ->> 'aal', '') <> 'aal2' then
+    raise exception 'delete_my_account: verify your second factor first'
+      using errcode = '42501', hint = 'Complete MFA (aal2), then retry.';
+  end if;
+
+  if to_regprocedure('private.genesis_before_account_delete(uuid)') is not null then
+    begin
+      perform private.genesis_before_account_delete(me);
+    exception when others then
+      if left(sqlstate, 2) = 'GA' then
+        raise;
+      end if;
+      raise exception '%', sqlerrm
+        using errcode = 'GA001', detail = format('Refused by private.genesis_before_account_delete (SQLSTATE %s).', sqlstate);
+    end;
+  end if;
+
+  delete from auth.users where id = me;
+end;
+$$;
+
+comment on function public.delete_my_account() is
+  'Deletes the signed-in person''s login (auth.users) and, through on delete cascade, their data. Genesis account block.';
+
+-- Privileges by name. Revoking here doesn't survive a later blanket grant
+-- (`grant execute on all functions in schema public to anon` hands this back
+-- to anon), so a blanket grant must exclude these functions.
+revoke execute on function public.delete_my_account() from public, anon;
+grant execute on function public.delete_my_account() to authenticated;
+revoke execute on function private.genesis_require_recent_sign_in(interval) from public, anon, authenticated;

package/migrations/0002_genesis_app_release_policy.sql

@@ -0,0 +1,82 @@
+-- Genesis app release policy: public.app_release_policy
+--
+-- What a native app reads at launch to decide whether this install must
+-- update from the store, whether the app is down for maintenance, and which
+-- release notes to show. The client half is `supabasePolicySource(client)` in
+-- @marktiderman/genesis-native/updates.
+--
+-- Use: copy this file into your app's `supabase/migrations/` under a new
+-- timestamped name (e.g. `20261024000000_genesis_app_release_policy.sql`).
+-- Never edit it once applied; change it with a new migration.
+--
+-- Access: anyone may read (anon included: the app reads it before sign-in);
+-- nobody but the service role (or a migration) may write. Edit the row from
+-- the SQL editor, a migration, or a server job with the secret key.
+--
+-- Failing open: the client never blocks on a missing row, a malformed value
+-- or a failed read. The checks below keep malformed values out in the first
+-- place: a minimum version is plain dotted numbers (`1`, `1.4`, `1.4.0`),
+-- store links are https (or the stores' own schemes), a minimum version
+-- comes with its platform's store link, and notes are an array of
+-- `{ "version": "1.4.0", "title"?: "...", "body": "..." }`.
+--
+-- One row per app (`app_id`, default 'default'). For example:
+--
+--   insert into public.app_release_policy (app_id, min_version_ios, store_url_ios)
+--   values ('default', '1.4.0', 'https://apps.apple.com/app/id0000000000')
+--   on conflict (app_id) do update set min_version_ios = excluded.min_version_ios,
+--     store_url_ios = excluded.store_url_ios, updated_at = now();
+--
+-- Maintenance: set `maintenance = true` (and a `maintenance_message`). The
+-- client honours it only from a live read, never from its cache, so a phone
+-- offline when maintenance ends is never stuck behind it.
+--
+-- Verify: the pgTAP test beside this file (`tests/0002_genesis_app_release_policy.test.sql`).
+
+create table if not exists public.app_release_policy (
+  app_id text primary key default 'default'
+    constraint app_release_policy_app_id_format check (app_id ~ '^[a-z0-9][a-z0-9._-]{0,63}$'),
+  min_version_ios text
+    constraint app_release_policy_min_version_ios_format check (min_version_ios ~ '^[0-9]{1,9}(\.[0-9]{1,9}){0,3}$'),
+  min_version_android text
+    constraint app_release_policy_min_version_android_format check (min_version_android ~ '^[0-9]{1,9}(\.[0-9]{1,9}){0,3}$'),
+  store_url_ios text
+    constraint app_release_policy_store_url_ios_format check (store_url_ios ~ '^(https|itms-apps)://'),
+  store_url_android text
+    constraint app_release_policy_store_url_android_format check (store_url_android ~ '^(https|market)://'),
+  maintenance boolean not null default false,
+  maintenance_message text
+    constraint app_release_policy_maintenance_message_length check (char_length(maintenance_message) <= 500),
+  -- An array of objects, each with a string version and body (and a string title, if any).
+  -- `strict` stops lax mode unwrapping nested arrays; `.type()` rejects arrays where strings belong.
+  notes jsonb not null default '[]'::jsonb
+    constraint app_release_policy_notes_shape check (
+      jsonb_typeof(notes) = 'array'
+      and not jsonb_path_exists(notes, 'strict $[*] ? (@.type() != "object")')
+      and not jsonb_path_exists(notes, '$[*] ? (!(@.version.type() == "string") || !(@.body.type() == "string") || (exists(@.title) && !(@.title.type() == "string")))')
+    ),
+  updated_at timestamptz not null default now(),
+  -- A minimum version needs a store link: the force-upgrade screen's only way out is the store.
+  -- (The client also forces nothing without one.)
+  constraint app_release_policy_ios_store_link check (min_version_ios is null or store_url_ios is not null),
+  constraint app_release_policy_android_store_link check (min_version_android is null or store_url_android is not null)
+);
+
+comment on table public.app_release_policy is
+  'Minimum store versions, maintenance switch and release notes for native apps. Readable by everyone, written only by the service role. Genesis updates block.';
+
+alter table public.app_release_policy enable row level security;
+
+-- Reading: everyone, every row. No insert, update or delete policy exists, so
+-- under RLS anon and authenticated can't write even if a later grant lets them try.
+drop policy if exists app_release_policy_read on public.app_release_policy;
+create policy app_release_policy_read on public.app_release_policy
+  for select to anon, authenticated
+  using (true);
+
+-- Privileges by name. Supabase's default privileges give anon and
+-- authenticated every privilege on a new public table; take them back and
+-- grant only select. The service role bypasses RLS and keeps write access.
+revoke all on table public.app_release_policy from public, anon, authenticated;
+grant select on table public.app_release_policy to anon, authenticated;
+grant select, insert, update, delete on table public.app_release_policy to service_role;