@nextblock-cms/db 0.14.5 → 0.14.6

package/lib/supabase/server.d.ts

@@ -725,6 +725,45 @@ export declare const getServiceRoleSupabaseClient: () => import('@supabase/supab
                 referencedColumns: ["id"];
             }];
         };
+        mcp_access_tokens: {
+            Row: {
+                created_at: string;
+                created_by: string | null;
+                expires_at: string | null;
+                id: string;
+                last_used_at: string | null;
+                name: string;
+                revoked_at: string | null;
+                scopes: string[];
+                token_hash: string;
+                token_prefix: string;
+            };
+            Insert: {
+                created_at?: string;
+                created_by?: string | null;
+                expires_at?: string | null;
+                id?: string;
+                last_used_at?: string | null;
+                name: string;
+                revoked_at?: string | null;
+                scopes?: string[];
+                token_hash: string;
+                token_prefix: string;
+            };
+            Update: {
+                created_at?: string;
+                created_by?: string | null;
+                expires_at?: string | null;
+                id?: string;
+                last_used_at?: string | null;
+                name?: string;
+                revoked_at?: string | null;
+                scopes?: string[];
+                token_hash?: string;
+                token_prefix?: string;
+            };
+            Relationships: [];
+        };
         media: {
             Row: {
                 blur_data_url: string | null;
@@ -1523,6 +1562,48 @@ export declare const getServiceRoleSupabaseClient: () => import('@supabase/supab
                 referencedColumns: ["id"];
             }];
         };
+        product_revisions: {
+            Row: {
+                author_id: string | null;
+                content: import('./types').Json;
+                created_at: string;
+                id: number;
+                product_id: string;
+                revision_type: Database["public"]["Enums"]["revision_type"];
+                version: number;
+            };
+            Insert: {
+                author_id?: string | null;
+                content: import('./types').Json;
+                created_at?: string;
+                id?: number;
+                product_id: string;
+                revision_type: Database["public"]["Enums"]["revision_type"];
+                version: number;
+            };
+            Update: {
+                author_id?: string | null;
+                content?: import('./types').Json;
+                created_at?: string;
+                id?: number;
+                product_id?: string;
+                revision_type?: Database["public"]["Enums"]["revision_type"];
+                version?: number;
+            };
+            Relationships: [{
+                foreignKeyName: "product_revisions_author_id_fkey";
+                columns: ["author_id"];
+                isOneToOne: false;
+                referencedRelation: "profiles";
+                referencedColumns: ["id"];
+            }, {
+                foreignKeyName: "product_revisions_product_id_fkey";
+                columns: ["product_id"];
+                isOneToOne: false;
+                referencedRelation: "products";
+                referencedColumns: ["id"];
+            }];
+        };
         product_variants: {
             Row: {
                 created_at: string | null;
@@ -1636,6 +1717,7 @@ export declare const getServiceRoleSupabaseClient: () => import('@supabase/supab
                 trial_requires_payment_method: boolean;
                 upc: string | null;
                 updated_at: string | null;
+                version: number;
             };
             Insert: {
                 average_rating?: number;
@@ -1674,6 +1756,7 @@ export declare const getServiceRoleSupabaseClient: () => import('@supabase/supab
                 trial_requires_payment_method?: boolean;
                 upc?: string | null;
                 updated_at?: string | null;
+                version?: number;
             };
             Update: {
                 average_rating?: number;
@@ -1712,6 +1795,7 @@ export declare const getServiceRoleSupabaseClient: () => import('@supabase/supab
                 trial_requires_payment_method?: boolean;
                 upc?: string | null;
                 updated_at?: string | null;
+                version?: number;
             };
             Relationships: [{
                 foreignKeyName: "products_language_id_fkey";

package/lib/supabase/types.d.ts

@@ -749,6 +749,45 @@ export type Database = {
                     }
                 ];
             };
+            mcp_access_tokens: {
+                Row: {
+                    created_at: string;
+                    created_by: string | null;
+                    expires_at: string | null;
+                    id: string;
+                    last_used_at: string | null;
+                    name: string;
+                    revoked_at: string | null;
+                    scopes: string[];
+                    token_hash: string;
+                    token_prefix: string;
+                };
+                Insert: {
+                    created_at?: string;
+                    created_by?: string | null;
+                    expires_at?: string | null;
+                    id?: string;
+                    last_used_at?: string | null;
+                    name: string;
+                    revoked_at?: string | null;
+                    scopes?: string[];
+                    token_hash: string;
+                    token_prefix: string;
+                };
+                Update: {
+                    created_at?: string;
+                    created_by?: string | null;
+                    expires_at?: string | null;
+                    id?: string;
+                    last_used_at?: string | null;
+                    name?: string;
+                    revoked_at?: string | null;
+                    scopes?: string[];
+                    token_hash?: string;
+                    token_prefix?: string;
+                };
+                Relationships: [];
+            };
             media: {
                 Row: {
                     blur_data_url: string | null;
@@ -1586,6 +1625,51 @@ export type Database = {
                     }
                 ];
             };
+            product_revisions: {
+                Row: {
+                    author_id: string | null;
+                    content: Json;
+                    created_at: string;
+                    id: number;
+                    product_id: string;
+                    revision_type: Database["public"]["Enums"]["revision_type"];
+                    version: number;
+                };
+                Insert: {
+                    author_id?: string | null;
+                    content: Json;
+                    created_at?: string;
+                    id?: number;
+                    product_id: string;
+                    revision_type: Database["public"]["Enums"]["revision_type"];
+                    version: number;
+                };
+                Update: {
+                    author_id?: string | null;
+                    content?: Json;
+                    created_at?: string;
+                    id?: number;
+                    product_id?: string;
+                    revision_type?: Database["public"]["Enums"]["revision_type"];
+                    version?: number;
+                };
+                Relationships: [
+                    {
+                        foreignKeyName: "product_revisions_author_id_fkey";
+                        columns: ["author_id"];
+                        isOneToOne: false;
+                        referencedRelation: "profiles";
+                        referencedColumns: ["id"];
+                    },
+                    {
+                        foreignKeyName: "product_revisions_product_id_fkey";
+                        columns: ["product_id"];
+                        isOneToOne: false;
+                        referencedRelation: "products";
+                        referencedColumns: ["id"];
+                    }
+                ];
+            };
             product_variants: {
                 Row: {
                     created_at: string | null;
@@ -1702,6 +1786,7 @@ export type Database = {
                     trial_requires_payment_method: boolean;
                     upc: string | null;
                     updated_at: string | null;
+                    version: number;
                 };
                 Insert: {
                     average_rating?: number;
@@ -1740,6 +1825,7 @@ export type Database = {
                     trial_requires_payment_method?: boolean;
                     upc?: string | null;
                     updated_at?: string | null;
+                    version?: number;
                 };
                 Update: {
                     average_rating?: number;
@@ -1778,6 +1864,7 @@ export type Database = {
                     trial_requires_payment_method?: boolean;
                     upc?: string | null;
                     updated_at?: string | null;
+                    version?: number;
                 };
                 Relationships: [
                     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextblock-cms/db",
-  "version": "0.14.5",
+  "version": "0.14.6",
   "main": "index.cjs.js",
   "module": "index.es.js",
   "types": "index.d.ts",

package/supabase/migrations/00000000000017_cortex_ai_mcp_server.sql

@@ -0,0 +1,91 @@
+-- Cortex AI MCP (Model Context Protocol) server access.
+--
+-- Adds the bearer-token store that gates /api/mcp, the endpoint that exposes the
+-- Cortex AI tool registry to external MCP clients (Claude Code, Claude Desktop,
+-- Cursor, VS Code). Two pieces:
+--
+--   1. public.mcp_access_tokens — one row per issued token. We store ONLY the
+--      SHA-256 hash of the token, never the token itself: the plaintext is shown
+--      to the admin exactly once at mint time and is unrecoverable afterwards, so
+--      a database leak cannot be replayed against the MCP endpoint. `token_prefix`
+--      is the non-secret leading fragment kept purely so the UI can tell two tokens
+--      apart in a list.
+--
+--   2. cortex_ai_mcp_settings — a non-secret JSON site_settings row holding the
+--      server on/off switch and the localhost-trust flag. It is added to all four
+--      site_settings policies so only authenticated ADMINs can read or write it;
+--      the MCP route itself reads it through the service-role client, which
+--      bypasses RLS.
+--
+-- Forward-only. Recreates the four site_settings policies idempotently, preserving
+-- every key already in each policy's sensitive array (note that
+-- language_detection_settings stays anon-READABLE and so is absent from the SELECT
+-- policy, exactly as migration 00000000000012 left it).
+
+CREATE TABLE IF NOT EXISTS public.mcp_access_tokens (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  name text NOT NULL,
+  -- Lowercase hex SHA-256 of the plaintext token. Unique so a lookup is a single
+  -- indexed equality probe and duplicate mints are impossible.
+  token_hash text NOT NULL UNIQUE,
+  -- Non-secret display fragment, e.g. "nbmcp_a1b2c3d4". Never enough to authenticate.
+  token_prefix text NOT NULL,
+  -- 'read' grants the read-only tools; 'write' additionally grants the mutating ones.
+  scopes text[] NOT NULL DEFAULT ARRAY['read', 'write']::text[],
+  created_by uuid REFERENCES auth.users (id) ON DELETE SET NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  last_used_at timestamptz,
+  expires_at timestamptz,
+  revoked_at timestamptz
+);
+
+COMMENT ON TABLE public.mcp_access_tokens IS
+  'Bearer tokens for the Cortex AI MCP server at /api/mcp. Stores SHA-256 hashes only; plaintext is displayed once at mint time.';
+
+CREATE INDEX IF NOT EXISTS mcp_access_tokens_token_hash_idx
+  ON public.mcp_access_tokens (token_hash);
+
+-- Orders the admin token list newest-first without a sort.
+CREATE INDEX IF NOT EXISTS mcp_access_tokens_created_at_idx
+  ON public.mcp_access_tokens (created_at DESC);
+
+ALTER TABLE public.mcp_access_tokens ENABLE ROW LEVEL SECURITY;
+
+-- Tokens are credentials: admin-only, with no anon or WRITER access at all. The
+-- MCP route verifies them with the service-role client, which bypasses RLS.
+DROP POLICY IF EXISTS mcp_access_tokens_admin_select ON public.mcp_access_tokens;
+CREATE POLICY mcp_access_tokens_admin_select ON public.mcp_access_tokens
+  FOR SELECT TO authenticated
+  USING ((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role);
+
+DROP POLICY IF EXISTS mcp_access_tokens_admin_insert ON public.mcp_access_tokens;
+CREATE POLICY mcp_access_tokens_admin_insert ON public.mcp_access_tokens
+  FOR INSERT TO authenticated
+  WITH CHECK ((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role);
+
+DROP POLICY IF EXISTS mcp_access_tokens_admin_update ON public.mcp_access_tokens;
+CREATE POLICY mcp_access_tokens_admin_update ON public.mcp_access_tokens
+  FOR UPDATE TO authenticated
+  USING ((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role)
+  WITH CHECK ((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role);
+
+DROP POLICY IF EXISTS mcp_access_tokens_admin_delete ON public.mcp_access_tokens;
+CREATE POLICY mcp_access_tokens_admin_delete ON public.mcp_access_tokens
+  FOR DELETE TO authenticated
+  USING ((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role);
+
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.mcp_access_tokens TO authenticated;
+GRANT ALL ON public.mcp_access_tokens TO service_role;
+
+-- Add cortex_ai_mcp_settings to the admin-only site_settings group (all four policies).
+DROP POLICY IF EXISTS site_settings_read_policy ON public.site_settings;
+CREATE POLICY site_settings_read_policy ON public.site_settings FOR SELECT USING (((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT auth.role() AS role) = 'authenticated'::text) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+DROP POLICY IF EXISTS site_settings_insert_policy ON public.site_settings;
+CREATE POLICY site_settings_insert_policy ON public.site_settings FOR INSERT TO authenticated WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+DROP POLICY IF EXISTS site_settings_update_policy ON public.site_settings;
+CREATE POLICY site_settings_update_policy ON public.site_settings FOR UPDATE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role)))) WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+DROP POLICY IF EXISTS site_settings_delete_policy ON public.site_settings;
+CREATE POLICY site_settings_delete_policy ON public.site_settings FOR DELETE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));