@nextblock-cms/db 0.15.10 → 0.16.1

package/lib/supabase/server.d.ts

@@ -173,6 +173,36 @@ export declare const getServiceRoleSupabaseClient: () => import('@supabase/supab
                 referencedColumns: ["id"];
             }];
         };
+        cms_redirects: {
+            Row: {
+                created_at: string;
+                destination_path: string;
+                id: string;
+                is_active: boolean;
+                source_path: string;
+                status_code: number;
+                updated_at: string;
+            };
+            Insert: {
+                created_at?: string;
+                destination_path: string;
+                id?: string;
+                is_active?: boolean;
+                source_path: string;
+                status_code?: number;
+                updated_at?: string;
+            };
+            Update: {
+                created_at?: string;
+                destination_path?: string;
+                id?: string;
+                is_active?: boolean;
+                source_path?: string;
+                status_code?: number;
+                updated_at?: string;
+            };
+            Relationships: [];
+        };
         content_drafts: {
             Row: {
                 author_id: string | null;
@@ -2722,6 +2752,6 @@ export declare const getServiceRoleSupabaseClient: () => import('@supabase/supab
     };
     CompositeTypes: { [_ in never]: never; };
 }, {
-    PostgrestVersion: "14.17";
+    PostgrestVersion: "14.15";
 }>;
 export {};

package/lib/supabase/types.d.ts

@@ -3,7 +3,7 @@ export type Json = string | number | boolean | null | {
 } | Json[];
 export type Database = {
     __InternalSupabase: {
-        PostgrestVersion: "14.17";
+        PostgrestVersion: "14.15";
     };
     public: {
         Tables: {
@@ -179,6 +179,36 @@ export type Database = {
                     }
                 ];
             };
+            cms_redirects: {
+                Row: {
+                    created_at: string;
+                    destination_path: string;
+                    id: string;
+                    is_active: boolean;
+                    source_path: string;
+                    status_code: number;
+                    updated_at: string;
+                };
+                Insert: {
+                    created_at?: string;
+                    destination_path: string;
+                    id?: string;
+                    is_active?: boolean;
+                    source_path: string;
+                    status_code?: number;
+                    updated_at?: string;
+                };
+                Update: {
+                    created_at?: string;
+                    destination_path?: string;
+                    id?: string;
+                    is_active?: boolean;
+                    source_path?: string;
+                    status_code?: number;
+                    updated_at?: string;
+                };
+                Relationships: [];
+            };
             content_drafts: {
                 Row: {
                     author_id: string | null;
@@ -2814,9 +2844,9 @@ type DatabaseWithoutInternals = Omit<Database, "__InternalSupabase">;
 type DefaultSchema = DatabaseWithoutInternals[Extract<keyof Database, "public">];
 export type Tables<DefaultSchemaTableNameOrOptions extends keyof (DefaultSchema["Tables"] & DefaultSchema["Views"]) | {
     schema: keyof DatabaseWithoutInternals;
-}, TableName extends DefaultSchemaTableNameOrOptions extends {
+}, TableName extends (DefaultSchemaTableNameOrOptions extends {
     schema: keyof DatabaseWithoutInternals;
-} ? keyof (DatabaseWithoutInternals[DefaultSchemaTableNameOrOptions["schema"]]["Tables"] & DatabaseWithoutInternals[DefaultSchemaTableNameOrOptions["schema"]]["Views"]) : never = never> = DefaultSchemaTableNameOrOptions extends {
+} ? keyof (DatabaseWithoutInternals[DefaultSchemaTableNameOrOptions["schema"]]["Tables"] & DatabaseWithoutInternals[DefaultSchemaTableNameOrOptions["schema"]]["Views"]) : never) = never> = DefaultSchemaTableNameOrOptions extends {
     schema: keyof DatabaseWithoutInternals;
 } ? (DatabaseWithoutInternals[DefaultSchemaTableNameOrOptions["schema"]]["Tables"] & DatabaseWithoutInternals[DefaultSchemaTableNameOrOptions["schema"]]["Views"])[TableName] extends {
     Row: infer R;
@@ -2825,9 +2855,9 @@ export type Tables<DefaultSchemaTableNameOrOptions extends keyof (DefaultSchema[
 } ? R : never : never;
 export type TablesInsert<DefaultSchemaTableNameOrOptions extends keyof DefaultSchema["Tables"] | {
     schema: keyof DatabaseWithoutInternals;
-}, TableName extends DefaultSchemaTableNameOrOptions extends {
+}, TableName extends (DefaultSchemaTableNameOrOptions extends {
     schema: keyof DatabaseWithoutInternals;
-} ? keyof DatabaseWithoutInternals[DefaultSchemaTableNameOrOptions["schema"]]["Tables"] : never = never> = DefaultSchemaTableNameOrOptions extends {
+} ? keyof DatabaseWithoutInternals[DefaultSchemaTableNameOrOptions["schema"]]["Tables"] : never) = never> = DefaultSchemaTableNameOrOptions extends {
     schema: keyof DatabaseWithoutInternals;
 } ? DatabaseWithoutInternals[DefaultSchemaTableNameOrOptions["schema"]]["Tables"][TableName] extends {
     Insert: infer I;
@@ -2836,9 +2866,9 @@ export type TablesInsert<DefaultSchemaTableNameOrOptions extends keyof DefaultSc
 } ? I : never : never;
 export type TablesUpdate<DefaultSchemaTableNameOrOptions extends keyof DefaultSchema["Tables"] | {
     schema: keyof DatabaseWithoutInternals;
-}, TableName extends DefaultSchemaTableNameOrOptions extends {
+}, TableName extends (DefaultSchemaTableNameOrOptions extends {
     schema: keyof DatabaseWithoutInternals;
-} ? keyof DatabaseWithoutInternals[DefaultSchemaTableNameOrOptions["schema"]]["Tables"] : never = never> = DefaultSchemaTableNameOrOptions extends {
+} ? keyof DatabaseWithoutInternals[DefaultSchemaTableNameOrOptions["schema"]]["Tables"] : never) = never> = DefaultSchemaTableNameOrOptions extends {
     schema: keyof DatabaseWithoutInternals;
 } ? DatabaseWithoutInternals[DefaultSchemaTableNameOrOptions["schema"]]["Tables"][TableName] extends {
     Update: infer U;
@@ -2847,16 +2877,16 @@ export type TablesUpdate<DefaultSchemaTableNameOrOptions extends keyof DefaultSc
 } ? U : never : never;
 export type Enums<DefaultSchemaEnumNameOrOptions extends keyof DefaultSchema["Enums"] | {
     schema: keyof DatabaseWithoutInternals;
-}, EnumName extends DefaultSchemaEnumNameOrOptions extends {
+}, EnumName extends (DefaultSchemaEnumNameOrOptions extends {
     schema: keyof DatabaseWithoutInternals;
-} ? keyof DatabaseWithoutInternals[DefaultSchemaEnumNameOrOptions["schema"]]["Enums"] : never = never> = DefaultSchemaEnumNameOrOptions extends {
+} ? keyof DatabaseWithoutInternals[DefaultSchemaEnumNameOrOptions["schema"]]["Enums"] : never) = never> = DefaultSchemaEnumNameOrOptions extends {
     schema: keyof DatabaseWithoutInternals;
 } ? DatabaseWithoutInternals[DefaultSchemaEnumNameOrOptions["schema"]]["Enums"][EnumName] : DefaultSchemaEnumNameOrOptions extends keyof DefaultSchema["Enums"] ? DefaultSchema["Enums"][DefaultSchemaEnumNameOrOptions] : never;
 export type CompositeTypes<PublicCompositeTypeNameOrOptions extends keyof DefaultSchema["CompositeTypes"] | {
     schema: keyof DatabaseWithoutInternals;
-}, CompositeTypeName extends PublicCompositeTypeNameOrOptions extends {
+}, CompositeTypeName extends (PublicCompositeTypeNameOrOptions extends {
     schema: keyof DatabaseWithoutInternals;
-} ? keyof DatabaseWithoutInternals[PublicCompositeTypeNameOrOptions["schema"]]["CompositeTypes"] : never = never> = PublicCompositeTypeNameOrOptions extends {
+} ? keyof DatabaseWithoutInternals[PublicCompositeTypeNameOrOptions["schema"]]["CompositeTypes"] : never) = never> = PublicCompositeTypeNameOrOptions extends {
     schema: keyof DatabaseWithoutInternals;
 } ? DatabaseWithoutInternals[PublicCompositeTypeNameOrOptions["schema"]]["CompositeTypes"][CompositeTypeName] : PublicCompositeTypeNameOrOptions extends keyof DefaultSchema["CompositeTypes"] ? DefaultSchema["CompositeTypes"][PublicCompositeTypeNameOrOptions] : never;
 export declare const Constants: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextblock-cms/db",
-  "version": "0.15.10",
+  "version": "0.16.1",
   "main": "index.cjs.js",
   "module": "index.es.js",
   "types": "index.d.ts",

package/supabase/migrations/00000000000030_seo_redirects_and_robots.sql

@@ -0,0 +1,149 @@
+-- SEO engine: managed 301/302 redirects and operator-configurable robots directives.
+--
+-- Two unrelated-looking things ship in one migration because they are the same
+-- feature from an operator's point of view: the `/cms/settings/seo` screen is where
+-- someone goes to say "this URL moved" and "do not crawl that". Splitting them
+-- across two migrations would only mean two files that must always be applied
+-- together.
+--
+-- WHY A TABLE AND NOT next.config.js redirects(). Redirects are content, not
+-- configuration. An editor who renames a page's slug needs the old URL to keep
+-- working immediately, without a redeploy and without touching source control.
+-- That rules out the build-time array; it has to be data.
+--
+-- WHY THE PROXY READS THIS WITH THE ANON KEY. apps/nextblock/proxy.ts (Next 16's
+-- renamed middleware) resolves redirects before rendering, and it holds a Supabase
+-- client built from the anon key. So the public SELECT policy below is load-bearing:
+-- without an explicit `TO authenticated, anon` grant the proxy's lookup would return
+-- zero rows for every anonymous visitor -- silently, with no error -- and no redirect
+-- would ever fire. Only is_active rows are exposed, so a half-written rule is never
+-- live.
+--
+-- WHY status_code IS AN integer AND NOT AN ENUM. The same reasoning migration 27
+-- recorded for `source`: a Postgres enum cannot be extended and used inside the same
+-- transaction, which is exactly the scope of one migration file. A CHECK constraint
+-- is replaceable in a single statement. 301 and 302 are the only two values the
+-- admin UI offers; 307/308 are deliberately not exposed, because their
+-- method-preserving semantics surprise operators who just want "this page moved".
+--
+-- LOOP SAFETY is enforced in application code (wouldCreateLoop in
+-- @nextblock-cms/utils, called by the admin server actions) rather than by a
+-- constraint, because detecting a cycle requires walking the whole table and a CHECK
+-- constraint can only see one row. The self-redirect case IS cheap to check per row,
+-- so that one is a constraint -- it is the cycle operators actually hit.
+--
+-- SECURITY POSTURE. A redirect can send every visitor of a path to an arbitrary
+-- external origin, which makes this table an open-redirect surface and a phishing
+-- lever. Writes are therefore ADMIN-only -- WRITER is deliberately excluded, matching
+-- site_scripts rather than the content tables. Reads are public but limited to active
+-- rows. The robots settings live in site_settings, whose existing read policy is
+-- already public for non-secret keys; nothing here is secret.
+--
+-- Forward-only and idempotent.
+
+CREATE TABLE IF NOT EXISTS public.cms_redirects (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    -- The incoming site-relative path to match, normalized by the application to a
+    -- leading slash with no trailing slash (except root). Matching is exact: prefix
+    -- and wildcard rules are deliberately not supported, because they are the usual
+    -- way an operator builds an accidental loop.
+    source_path text NOT NULL,
+    -- Where to send the visitor. Either another site-relative path or a fully
+    -- qualified https URL for an off-site move.
+    destination_path text NOT NULL,
+    -- 301 permanent (the SEO-meaningful one: search engines transfer ranking signals
+    -- and browsers cache it aggressively) or 302 temporary.
+    status_code integer DEFAULT 301 NOT NULL,
+    is_active boolean DEFAULT true NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT cms_redirects_pkey PRIMARY KEY (id),
+    -- One rule per source. This UNIQUE constraint also provides the index the proxy
+    -- lookup relies on, so no separate plain index on source_path is needed.
+    CONSTRAINT cms_redirects_source_path_key UNIQUE (source_path),
+    CONSTRAINT cms_redirects_status_code_check
+        CHECK ((status_code = ANY (ARRAY[301, 302]))),
+    -- A source is always a path on this site; accepting an absolute URL here would
+    -- silently never match, since the proxy only ever compares pathnames.
+    CONSTRAINT cms_redirects_source_path_check
+        CHECK ((source_path ~ '^/')),
+    -- A destination is either a site-relative path or an https URL. Plain http is
+    -- refused so a redirect can never downgrade a visitor to cleartext.
+    CONSTRAINT cms_redirects_destination_path_check
+        CHECK (((destination_path ~ '^/') OR (destination_path ~ '^https://'))),
+    -- The one cycle a single row can express, and the one operators actually create.
+    CONSTRAINT cms_redirects_no_self_redirect_check
+        CHECK ((source_path <> destination_path))
+);
+
+COMMENT ON TABLE public.cms_redirects IS
+    'Operator-managed 301/302 redirects resolved by apps/nextblock/proxy.ts before rendering. Only is_active rows are publicly readable; only ADMIN may write, because a redirect rule is an open-redirect surface.';
+COMMENT ON COLUMN public.cms_redirects.source_path IS
+    'Exact site-relative path to match, normalized to a leading slash and no trailing slash (except root). No wildcards, by design.';
+COMMENT ON COLUMN public.cms_redirects.destination_path IS
+    'Site-relative path or absolute https URL to send the visitor to.';
+COMMENT ON COLUMN public.cms_redirects.status_code IS
+    '301 permanent or 302 temporary. 307/308 are not offered by the admin UI.';
+COMMENT ON COLUMN public.cms_redirects.is_active IS
+    'Only active rows are readable by anon, and only active rows are matched by the proxy.';
+
+-- The proxy loads the whole active set once per cache window rather than querying per
+-- request, so the hot query is "all active rows" and this partial index is what serves
+-- it. Carrying source_path in the index keeps that read index-only.
+CREATE INDEX IF NOT EXISTS cms_redirects_active_source_idx
+    ON public.cms_redirects USING btree (source_path) WHERE (is_active);
+
+DROP TRIGGER IF EXISTS set_cms_redirects_updated_at ON public.cms_redirects;
+CREATE TRIGGER set_cms_redirects_updated_at
+    BEFORE UPDATE ON public.cms_redirects
+    FOR EACH ROW EXECUTE FUNCTION public.set_current_timestamp_updated_at();
+
+ALTER TABLE public.cms_redirects ENABLE ROW LEVEL SECURITY;
+
+GRANT ALL ON TABLE public.cms_redirects TO anon;
+GRANT ALL ON TABLE public.cms_redirects TO authenticated;
+GRANT ALL ON TABLE public.cms_redirects TO service_role;
+
+-- The proxy runs as anon for a logged-out visitor, which is the overwhelming majority
+-- of traffic and the only traffic redirects really matter for. Without this policy the
+-- lookup returns zero rows and the feature is silently dead.
+DROP POLICY IF EXISTS "Public read active redirects" ON public.cms_redirects;
+CREATE POLICY "Public read active redirects" ON public.cms_redirects
+    FOR SELECT TO authenticated, anon USING (is_active);
+
+DROP POLICY IF EXISTS "Admins read all redirects" ON public.cms_redirects;
+CREATE POLICY "Admins read all redirects" ON public.cms_redirects
+    FOR SELECT TO authenticated
+    USING (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role));
+
+DROP POLICY IF EXISTS "Admins insert redirects" ON public.cms_redirects;
+CREATE POLICY "Admins insert redirects" ON public.cms_redirects
+    FOR INSERT TO authenticated
+    WITH CHECK (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role));
+
+DROP POLICY IF EXISTS "Admins update redirects" ON public.cms_redirects;
+CREATE POLICY "Admins update redirects" ON public.cms_redirects
+    FOR UPDATE TO authenticated
+    USING (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role))
+    WITH CHECK (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role));
+
+DROP POLICY IF EXISTS "Admins delete redirects" ON public.cms_redirects;
+CREATE POLICY "Admins delete redirects" ON public.cms_redirects
+    FOR DELETE TO authenticated
+    USING (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role));
+
+-- Robots directives live in site_settings rather than a table of their own: there is
+-- exactly one robots.txt per install, so a dedicated table would only ever hold one
+-- row, and site_settings already carries the public-read / staff-write policy this
+-- needs. The stored shape matches `RobotsSettings` in @nextblock-cms/utils, and
+-- `normalizeRobotsSettings` tolerates a missing or malformed value -- so this seed is
+-- a convenience for the settings screen, not a correctness requirement for rendering.
+--
+-- ON CONFLICT DO NOTHING because an install that has already configured robots must
+-- not have its rules reset by a replay of this migration.
+INSERT INTO public.site_settings (key, value)
+VALUES (
+    'seo_robots_settings',
+    '{"customRules": "", "isIndexingEnabled": true, "sitemapEnabled": true, "userAgentRules": [{"allow": ["/"], "disallow": [], "userAgent": "*"}]}'::jsonb
+)
+ON CONFLICT (key) DO NOTHING;

package/supabase/migrations/00000000000031_seo_robots_settings_admin_only.sql

@@ -0,0 +1,35 @@
+-- Restrict writes to the robots.txt settings row to ADMIN only.
+--
+-- `site_settings.seo_robots_settings` is the row that decides whether the whole site
+-- is crawlable: app/robots.ts reads it on every /robots.txt hit and serves a blanket
+-- `Disallow: /` when `isIndexingEnabled` is false. The CMS only offers that switch
+-- under /cms/settings/seo, and `saveRobotsSettings` re-checks for ADMIN before it
+-- writes — but RLS is the independent boundary, and it did not agree. The baseline
+-- write policies let ADMIN *or* WRITER write any key outside the sensitive array, so
+-- a WRITER holding a normal session could PATCH this row through PostgREST and take
+-- the entire site out of Google. That failure is quiet (nothing in the CMS shows it),
+-- slow to notice (search traffic decays over weeks) and hard to attribute after the
+-- fact, which is why the database has to refuse it rather than trusting the one
+-- server action that happens to guard it today.
+--
+-- The SELECT policy is deliberately NOT touched. This key must stay anon-READABLE:
+-- app/robots.ts reads it with the anon (SSG) client on every crawl, and adding the key
+-- to the read policy's sensitive array would make robots.txt fall back to its
+-- permissive defaults for every crawler. Only INSERT/UPDATE/DELETE move to ADMIN-only,
+-- matching the UI boundary — exactly the shape migration 00000000000011 used for
+-- language_detection_settings, which is anon-readable for the same reason.
+--
+-- Every key already present in each policy's array is preserved (dropping one would
+-- silently widen write access back to WRITER for that key); `seo_robots_settings` is
+-- appended to the three write policies only.
+
+DROP POLICY IF EXISTS site_settings_insert_policy ON public.site_settings;
+CREATE POLICY site_settings_insert_policy ON public.site_settings FOR INSERT TO authenticated WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text, 'seo_robots_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text, 'seo_robots_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+DROP POLICY IF EXISTS site_settings_update_policy ON public.site_settings;
+CREATE POLICY site_settings_update_policy ON public.site_settings FOR UPDATE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text, 'seo_robots_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text, 'seo_robots_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role)))) WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text, 'seo_robots_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text, 'seo_robots_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+DROP POLICY IF EXISTS site_settings_delete_policy ON public.site_settings;
+CREATE POLICY site_settings_delete_policy ON public.site_settings FOR DELETE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text, 'seo_robots_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text, 'seo_robots_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+-- Forward-only and idempotent.