@nextblock-cms/db 0.17.0 → 0.17.1

package/supabase/migrations/00000000000016_product_revisions_and_revision_baseline.sql

@@ -1,310 +0,0 @@
--- 00000000000016_product_revisions_and_revision_baseline.sql
---
--- Revision History, part 1 of 2 (schema). The application-side rewrite lives in
--- apps/nextblock/app/cms/revisions/**.
---
--- Three things happen here:
---
---   1. products.version    — the monotonic counter the hybrid revision engine drives,
---                            mirroring pages.version / posts.version.
---
---   2. product_revisions   — a structural mirror of page_revisions / post_revisions.
---                            product_id is uuid (products.id is uuid, not bigint), and
---                            writes are gated on is_admin() to match products_*_policy
---                            rather than the ADMIN|WRITER pattern the page/post revision
---                            tables use. A WRITER who could insert a revision but not
---                            apply a restore would get a silent no-op restore, because
---                            PostgREST returns no error for an UPDATE matching zero rows.
---
---   3. Revision baseline   — every page, post and product gets a real `snapshot` row to
---                            restore to. Until now the CMS synthesised a fake "Initial
---                            Version" entry in the UI whose Restore button resolved to
---                            "current metadata + zero blocks" and wiped the content.
---                            There is now an actual stored baseline instead.
---
---                            Case A (version = 1, no revisions at all): the live row IS
---                            version 1. This covers seeded content — 00000000000003
---                            inserts every page and post at version 1 and writes no
---                            revision rows — and everything authored since the CMS save
---                            path stopped recording revisions. Snapshotting it at
---                            version 1 is what makes "restore the original seeded page"
---                            real for the first time.
---
---                            Case B (version > 1 but no snapshot at or below it): the
---                            true v1 is unrecoverable and is NOT fabricated. A snapshot
---                            of the current state is stored at the current version so the
---                            diff chain has a valid base and future restores resolve.
---
--- Forward-only, idempotent, and it modifies no existing row: every backfill is an
--- INSERT ... WHERE NOT EXISTS ... ON CONFLICT DO NOTHING.
-
--- ---------------------------------------------------------------------------
--- 1. products.version
--- ---------------------------------------------------------------------------
-
-ALTER TABLE public.products
-    ADD COLUMN IF NOT EXISTS version integer DEFAULT 1 NOT NULL;
-
-COMMENT ON COLUMN public.products.version IS 'Monotonic version number for hybrid revisions.';
-
--- ---------------------------------------------------------------------------
--- 2. product_revisions
--- ---------------------------------------------------------------------------
-
-CREATE TABLE IF NOT EXISTS public.product_revisions (
-    id bigint NOT NULL,
-    product_id uuid NOT NULL,
-    author_id uuid,
-    version integer NOT NULL,
-    revision_type public.revision_type NOT NULL,
-    content jsonb NOT NULL,
-    created_at timestamp with time zone DEFAULT now() NOT NULL
-);
-
-COMMENT ON TABLE public.product_revisions IS 'Hybrid (snapshot/diff) revisions for products.';
-COMMENT ON COLUMN public.product_revisions.content IS 'If snapshot: full content; if diff: JSON Patch array.';
-
-DO $rb$
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM pg_attribute
-     WHERE attrelid = 'public.product_revisions'::regclass
-       AND attname  = 'id'
-       AND attidentity <> ''
-  ) THEN
-    ALTER TABLE public.product_revisions
-      ALTER COLUMN id ADD GENERATED BY DEFAULT AS IDENTITY (
-        SEQUENCE NAME public.product_revisions_id_seq
-        START WITH 1
-        INCREMENT BY 1
-        NO MINVALUE
-        NO MAXVALUE
-        CACHE 1
-      );
-  END IF;
-END $rb$;
-
-DO $rb$
-BEGIN
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint
-                  WHERE conname = 'product_revisions_pkey'
-                    AND conrelid = 'public.product_revisions'::regclass) THEN
-    ALTER TABLE ONLY public.product_revisions
-      ADD CONSTRAINT product_revisions_pkey PRIMARY KEY (id);
-  END IF;
-END $rb$;
-
-DO $rb$
-BEGIN
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint
-                  WHERE conname = 'product_revisions_product_version_key'
-                    AND conrelid = 'public.product_revisions'::regclass) THEN
-    ALTER TABLE ONLY public.product_revisions
-      ADD CONSTRAINT product_revisions_product_version_key UNIQUE (product_id, version);
-  END IF;
-END $rb$;
-
-DO $rb$
-BEGIN
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint
-                  WHERE conname = 'product_revisions_author_id_fkey'
-                    AND conrelid = 'public.product_revisions'::regclass) THEN
-    ALTER TABLE ONLY public.product_revisions
-      ADD CONSTRAINT product_revisions_author_id_fkey
-      FOREIGN KEY (author_id) REFERENCES public.profiles(id) ON DELETE SET NULL;
-  END IF;
-END $rb$;
-
-DO $rb$
-BEGIN
-  IF NOT EXISTS (SELECT 1 FROM pg_constraint
-                  WHERE conname = 'product_revisions_product_id_fkey'
-                    AND conrelid = 'public.product_revisions'::regclass) THEN
-    ALTER TABLE ONLY public.product_revisions
-      ADD CONSTRAINT product_revisions_product_id_fkey
-      FOREIGN KEY (product_id) REFERENCES public.products(id) ON DELETE CASCADE;
-  END IF;
-END $rb$;
-
-CREATE INDEX IF NOT EXISTS idx_product_revisions_author_id
-    ON public.product_revisions USING btree (author_id);
-
-CREATE INDEX IF NOT EXISTS idx_product_revisions_product_id_version
-    ON public.product_revisions USING btree (product_id, version);
-
-ALTER TABLE public.product_revisions ENABLE ROW LEVEL SECURITY;
-
-DROP POLICY IF EXISTS product_revisions_read_policy ON public.product_revisions;
-CREATE POLICY product_revisions_read_policy ON public.product_revisions
-  FOR SELECT TO authenticated USING (true);
-
-DROP POLICY IF EXISTS product_revisions_insert_policy ON public.product_revisions;
-CREATE POLICY product_revisions_insert_policy ON public.product_revisions
-  FOR INSERT TO authenticated
-  WITH CHECK (((SELECT public.is_admin() AS is_admin) IS TRUE));
-
-DROP POLICY IF EXISTS product_revisions_update_policy ON public.product_revisions;
-CREATE POLICY product_revisions_update_policy ON public.product_revisions
-  FOR UPDATE TO authenticated
-  USING (((SELECT public.is_admin() AS is_admin) IS TRUE))
-  WITH CHECK (((SELECT public.is_admin() AS is_admin) IS TRUE));
-
-DROP POLICY IF EXISTS product_revisions_delete_policy ON public.product_revisions;
-CREATE POLICY product_revisions_delete_policy ON public.product_revisions
-  FOR DELETE TO authenticated
-  USING (((SELECT public.is_admin() AS is_admin) IS TRUE));
-
-GRANT ALL ON TABLE    public.product_revisions        TO anon;
-GRANT ALL ON TABLE    public.product_revisions        TO authenticated;
-GRANT ALL ON TABLE    public.product_revisions        TO service_role;
-GRANT ALL ON SEQUENCE public.product_revisions_id_seq TO anon;
-GRANT ALL ON SEQUENCE public.product_revisions_id_seq TO authenticated;
-GRANT ALL ON SEQUENCE public.product_revisions_id_seq TO service_role;
-
--- ---------------------------------------------------------------------------
--- 3. Revision baseline backfill
---
--- The JSON shape must match FullPageContent / FullPostContent / FullProductContent
--- in apps/nextblock/app/cms/revisions/utils.ts exactly, or the first diff taken
--- against a baseline row will be full of phantom operations.
---
--- Timestamps are rendered with an explicit millisecond-precision UTC format so they
--- match JavaScript's Date#toISOString() ("2026-07-03T17:52:15.643Z"). Postgres'
--- default jsonb rendering of timestamptz ("2026-07-03T17:52:15.643901+00:00") would
--- differ from the value the application writes and produce a spurious diff on the
--- very next save.
--- ---------------------------------------------------------------------------
-
--- 3a. Pages
-INSERT INTO public.page_revisions (page_id, author_id, version, revision_type, content)
-SELECT
-    p.id,
-    NULL::uuid,
-    p.version,
-    'snapshot'::public.revision_type,
-    jsonb_build_object(
-      'meta', jsonb_build_object(
-        'title',            p.title,
-        'slug',             p.slug,
-        'language_id',      p.language_id,
-        'status',           p.status,
-        'meta_title',       p.meta_title,
-        'meta_description', p.meta_description,
-        'custom_canonical', p.custom_canonical,
-        'published_at',     to_char(p.published_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'),
-        'feature_image_id', p.feature_image_id
-      ),
-      'blocks', COALESCE((
-        SELECT jsonb_agg(
-                 jsonb_build_object(
-                   'language_id', b.language_id,
-                   'block_type',  b.block_type,
-                   'content',     b.content,
-                   'order',       b."order"
-                 ) ORDER BY b."order" ASC, b.id ASC
-               )
-          FROM public.blocks b
-         WHERE b.page_id = p.id
-      ), '[]'::jsonb)
-    )
-  FROM public.pages p
- WHERE NOT EXISTS (
-         SELECT 1 FROM public.page_revisions r
-          WHERE r.page_id = p.id
-            AND r.revision_type = 'snapshot'
-            AND r.version <= p.version
-       )
-ON CONFLICT (page_id, version) DO NOTHING;
-
--- 3b. Posts
-INSERT INTO public.post_revisions (post_id, author_id, version, revision_type, content)
-SELECT
-    po.id,
-    NULL::uuid,
-    po.version,
-    'snapshot'::public.revision_type,
-    jsonb_build_object(
-      'meta', jsonb_build_object(
-        'title',            po.title,
-        'slug',             po.slug,
-        'language_id',      po.language_id,
-        'status',           po.status,
-        'meta_title',       po.meta_title,
-        'meta_description', po.meta_description,
-        'custom_canonical', po.custom_canonical,
-        'published_at',     to_char(po.published_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'),
-        'feature_image_id', po.feature_image_id,
-        'label',            po.label,
-        'excerpt',          po.excerpt,
-        'subtitle',         po.subtitle
-      ),
-      'blocks', COALESCE((
-        SELECT jsonb_agg(
-                 jsonb_build_object(
-                   'language_id', b.language_id,
-                   'block_type',  b.block_type,
-                   'content',     b.content,
-                   'order',       b."order"
-                 ) ORDER BY b."order" ASC, b.id ASC
-               )
-          FROM public.blocks b
-         WHERE b.post_id = po.id
-      ), '[]'::jsonb)
-    )
-  FROM public.posts po
- WHERE NOT EXISTS (
-         SELECT 1 FROM public.post_revisions r
-          WHERE r.post_id = po.id
-            AND r.revision_type = 'snapshot'
-            AND r.version <= po.version
-       )
-ON CONFLICT (post_id, version) DO NOTHING;
-
--- 3c. Products.
---
--- Content only. price/prices/sale_*/scheduled_*/stock/sku/average_rating/total_reviews
--- are deliberately excluded from the snapshot: pricing and inventory are mutated from
--- outside the editor (promotions, Freemius sync, order fulfilment), ratings are derived
--- aggregates, and inventory_items is keyed by bare SKU text with no FK to products — so
--- replaying commerce state on restore would reach rows the editor never touched.
--- Restoring a product restores its content, not its commerce state.
-INSERT INTO public.product_revisions (product_id, author_id, version, revision_type, content)
-SELECT
-    pr.id,
-    NULL::uuid,
-    pr.version,
-    'snapshot'::public.revision_type,
-    jsonb_build_object(
-      'meta', jsonb_build_object(
-        'title',             pr.title,
-        'slug',              pr.slug,
-        'language_id',       pr.language_id,
-        'status',            pr.status,
-        'meta_title',        pr.meta_title,
-        'meta_description',  pr.meta_description,
-        'custom_canonical',  pr.custom_canonical,
-        'published_at',      to_char(pr.published_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'),
-        'short_description', pr.short_description,
-        'description_json',  pr.description_json
-      ),
-      'blocks', COALESCE((
-        SELECT jsonb_agg(
-                 jsonb_build_object(
-                   'language_id', b.language_id,
-                   'block_type',  b.block_type,
-                   'content',     b.content,
-                   'order',       b."order"
-                 ) ORDER BY b."order" ASC, b.id ASC
-               )
-          FROM public.blocks b
-         WHERE b.product_id = pr.id
-      ), '[]'::jsonb)
-    )
-  FROM public.products pr
- WHERE NOT EXISTS (
-         SELECT 1 FROM public.product_revisions r
-          WHERE r.product_id = pr.id
-            AND r.revision_type = 'snapshot'
-            AND r.version <= pr.version
-       )
-ON CONFLICT (product_id, version) DO NOTHING;

package/supabase/migrations/00000000000017_cortex_ai_mcp_server.sql

@@ -1,91 +0,0 @@
--- Cortex AI MCP (Model Context Protocol) server access.
---
--- Adds the bearer-token store that gates /api/mcp, the endpoint that exposes the
--- Cortex AI tool registry to external MCP clients (Claude Code, Claude Desktop,
--- Cursor, VS Code). Two pieces:
---
---   1. public.mcp_access_tokens — one row per issued token. We store ONLY the
---      SHA-256 hash of the token, never the token itself: the plaintext is shown
---      to the admin exactly once at mint time and is unrecoverable afterwards, so
---      a database leak cannot be replayed against the MCP endpoint. `token_prefix`
---      is the non-secret leading fragment kept purely so the UI can tell two tokens
---      apart in a list.
---
---   2. cortex_ai_mcp_settings — a non-secret JSON site_settings row holding the
---      server on/off switch and the localhost-trust flag. It is added to all four
---      site_settings policies so only authenticated ADMINs can read or write it;
---      the MCP route itself reads it through the service-role client, which
---      bypasses RLS.
---
--- Forward-only. Recreates the four site_settings policies idempotently, preserving
--- every key already in each policy's sensitive array (note that
--- language_detection_settings stays anon-READABLE and so is absent from the SELECT
--- policy, exactly as migration 00000000000012 left it).
-
-CREATE TABLE IF NOT EXISTS public.mcp_access_tokens (
-  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
-  name text NOT NULL,
-  -- Lowercase hex SHA-256 of the plaintext token. Unique so a lookup is a single
-  -- indexed equality probe and duplicate mints are impossible.
-  token_hash text NOT NULL UNIQUE,
-  -- Non-secret display fragment, e.g. "nbmcp_a1b2c3d4". Never enough to authenticate.
-  token_prefix text NOT NULL,
-  -- 'read' grants the read-only tools; 'write' additionally grants the mutating ones.
-  scopes text[] NOT NULL DEFAULT ARRAY['read', 'write']::text[],
-  created_by uuid REFERENCES auth.users (id) ON DELETE SET NULL,
-  created_at timestamptz NOT NULL DEFAULT now(),
-  last_used_at timestamptz,
-  expires_at timestamptz,
-  revoked_at timestamptz
-);
-
-COMMENT ON TABLE public.mcp_access_tokens IS
-  'Bearer tokens for the Cortex AI MCP server at /api/mcp. Stores SHA-256 hashes only; plaintext is displayed once at mint time.';
-
-CREATE INDEX IF NOT EXISTS mcp_access_tokens_token_hash_idx
-  ON public.mcp_access_tokens (token_hash);
-
--- Orders the admin token list newest-first without a sort.
-CREATE INDEX IF NOT EXISTS mcp_access_tokens_created_at_idx
-  ON public.mcp_access_tokens (created_at DESC);
-
-ALTER TABLE public.mcp_access_tokens ENABLE ROW LEVEL SECURITY;
-
--- Tokens are credentials: admin-only, with no anon or WRITER access at all. The
--- MCP route verifies them with the service-role client, which bypasses RLS.
-DROP POLICY IF EXISTS mcp_access_tokens_admin_select ON public.mcp_access_tokens;
-CREATE POLICY mcp_access_tokens_admin_select ON public.mcp_access_tokens
-  FOR SELECT TO authenticated
-  USING ((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role);
-
-DROP POLICY IF EXISTS mcp_access_tokens_admin_insert ON public.mcp_access_tokens;
-CREATE POLICY mcp_access_tokens_admin_insert ON public.mcp_access_tokens
-  FOR INSERT TO authenticated
-  WITH CHECK ((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role);
-
-DROP POLICY IF EXISTS mcp_access_tokens_admin_update ON public.mcp_access_tokens;
-CREATE POLICY mcp_access_tokens_admin_update ON public.mcp_access_tokens
-  FOR UPDATE TO authenticated
-  USING ((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role)
-  WITH CHECK ((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role);
-
-DROP POLICY IF EXISTS mcp_access_tokens_admin_delete ON public.mcp_access_tokens;
-CREATE POLICY mcp_access_tokens_admin_delete ON public.mcp_access_tokens
-  FOR DELETE TO authenticated
-  USING ((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role);
-
-GRANT SELECT, INSERT, UPDATE, DELETE ON public.mcp_access_tokens TO authenticated;
-GRANT ALL ON public.mcp_access_tokens TO service_role;
-
--- Add cortex_ai_mcp_settings to the admin-only site_settings group (all four policies).
-DROP POLICY IF EXISTS site_settings_read_policy ON public.site_settings;
-CREATE POLICY site_settings_read_policy ON public.site_settings FOR SELECT USING (((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT auth.role() AS role) = 'authenticated'::text) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
-
-DROP POLICY IF EXISTS site_settings_insert_policy ON public.site_settings;
-CREATE POLICY site_settings_insert_policy ON public.site_settings FOR INSERT TO authenticated WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
-
-DROP POLICY IF EXISTS site_settings_update_policy ON public.site_settings;
-CREATE POLICY site_settings_update_policy ON public.site_settings FOR UPDATE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role)))) WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
-
-DROP POLICY IF EXISTS site_settings_delete_policy ON public.site_settings;
-CREATE POLICY site_settings_delete_policy ON public.site_settings FOR DELETE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text, 'cortex_ai_mcp_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));

package/supabase/migrations/00000000000018_site_scripts.sql

@@ -1,96 +0,0 @@
--- Site scripts: admin-authored JavaScript injected into every page of the public site.
---
--- Rich-text blocks can already carry an inline <script>, but that script belongs to
--- one block on one page. This table is for behaviour that spans the site: chat
--- widgets, third-party embeds, and the scroll/animation helpers that page classes
--- rely on. Each row gets a name, an on/off switch, and a defined injection point.
---
--- NOT the same thing as `site_settings.privacy_settings -> custom_scripts`, which is
--- a single consent-gated blob for marketing tags and only fires once a visitor
--- accepts cookies. Rows here are functional site code and run unconditionally, so
--- anything requiring consent belongs in that setting instead, not this table.
---
--- Scripts are emitted with the request's CSP nonce by the root layout, so they run
--- under the site's existing Content-Security-Policy rather than forcing it open.
---
--- Security posture: this is arbitrary JavaScript on every page, so writes are
--- ADMIN-only (WRITER is deliberately excluded, unlike most content tables) and the
--- public may read only rows that are switched on, so a half-written draft is never
--- served to a visitor.
-
-CREATE TABLE IF NOT EXISTS public.site_scripts (
-    id uuid DEFAULT gen_random_uuid() NOT NULL,
-    name text NOT NULL,
-    description text,
-    -- Raw JavaScript, stored WITHOUT the surrounding <script> tag. The layout adds
-    -- the tag so the nonce and attributes are always applied by us, never by the
-    -- author. Ignored when `src` is set.
-    code text DEFAULT ''::text NOT NULL,
-    -- When set, an external script is loaded from this URL and `code` is ignored.
-    src text,
-    -- Where the tag is emitted. 'head' runs before first paint (blocking, use
-    -- sparingly); 'body_end' runs once the markup exists and is the right default
-    -- for anything that queries the DOM.
-    placement text DEFAULT 'body_end'::text NOT NULL,
-    -- Applies to external `src` scripts; inline code ignores it.
-    load_strategy text DEFAULT 'default'::text NOT NULL,
-    is_active boolean DEFAULT false NOT NULL,
-    sort_order integer DEFAULT 0 NOT NULL,
-    created_at timestamp with time zone DEFAULT now() NOT NULL,
-    updated_at timestamp with time zone DEFAULT now() NOT NULL,
-    CONSTRAINT site_scripts_pkey PRIMARY KEY (id),
-    CONSTRAINT site_scripts_placement_check
-        CHECK ((placement = ANY (ARRAY['head'::text, 'body_start'::text, 'body_end'::text]))),
-    CONSTRAINT site_scripts_load_strategy_check
-        CHECK ((load_strategy = ANY (ARRAY['default'::text, 'defer'::text, 'async'::text]))),
-    -- An external script must be https so it cannot be downgraded in transit.
-    CONSTRAINT site_scripts_src_scheme_check
-        CHECK ((src IS NULL OR src ~ '^https://')),
-    -- A row has to actually do something: inline code or an external src.
-    CONSTRAINT site_scripts_has_payload_check
-        CHECK ((src IS NOT NULL OR length(btrim(code)) > 0))
-);
-
-COMMENT ON TABLE public.site_scripts IS
-    'Admin-authored JavaScript injected into the public site by the root layout, with the request CSP nonce applied. Only is_active rows are publicly readable; only ADMIN may write. Distinct from privacy_settings.custom_scripts, which is consent-gated marketing tags.';
-
-CREATE INDEX IF NOT EXISTS site_scripts_active_placement_sort_idx
-    ON public.site_scripts USING btree (is_active, placement, sort_order);
-
-DROP TRIGGER IF EXISTS set_site_scripts_updated_at ON public.site_scripts;
-CREATE TRIGGER set_site_scripts_updated_at
-    BEFORE UPDATE ON public.site_scripts
-    FOR EACH ROW EXECUTE FUNCTION public.set_current_timestamp_updated_at();
-
-ALTER TABLE public.site_scripts ENABLE ROW LEVEL SECURITY;
-
-GRANT ALL ON TABLE public.site_scripts TO anon;
-GRANT ALL ON TABLE public.site_scripts TO authenticated;
-GRANT ALL ON TABLE public.site_scripts TO service_role;
-
--- Anonymous visitors need the active scripts to render the page. Inactive rows stay
--- private so a half-written script is never exposed before it is switched on.
-DROP POLICY IF EXISTS "Public read active site scripts" ON public.site_scripts;
-CREATE POLICY "Public read active site scripts" ON public.site_scripts
-    FOR SELECT TO authenticated, anon USING (is_active);
-
-DROP POLICY IF EXISTS "Admins read all site scripts" ON public.site_scripts;
-CREATE POLICY "Admins read all site scripts" ON public.site_scripts
-    FOR SELECT TO authenticated
-    USING (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role));
-
-DROP POLICY IF EXISTS "Admins insert site scripts" ON public.site_scripts;
-CREATE POLICY "Admins insert site scripts" ON public.site_scripts
-    FOR INSERT TO authenticated
-    WITH CHECK (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role));
-
-DROP POLICY IF EXISTS "Admins update site scripts" ON public.site_scripts;
-CREATE POLICY "Admins update site scripts" ON public.site_scripts
-    FOR UPDATE TO authenticated
-    USING (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role))
-    WITH CHECK (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role));
-
-DROP POLICY IF EXISTS "Admins delete site scripts" ON public.site_scripts;
-CREATE POLICY "Admins delete site scripts" ON public.site_scripts
-    FOR DELETE TO authenticated
-    USING (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role));

package/supabase/migrations/00000000000019_site_script_revisions.sql

@@ -1,85 +0,0 @@
--- Audit trail and undo for site scripts.
---
--- `site_scripts` ships arbitrary JavaScript to every visitor, which makes it the
--- highest-privilege write in the CMS: a bad or malicious snippet can read cookies,
--- watch checkout forms, or phone home. Content has Revision History for exactly this
--- reason; code needs it more, not less. Every create/update/delete writes one row
--- here, and every row is a complete, restorable snapshot — so this table is both the
--- log ("who shipped what, when, from where") and the undo.
---
--- APPEND-ONLY BY CONSTRUCTION. There are no UPDATE or DELETE policies, and the
--- trigger below rejects both even for the service role, which otherwise bypasses
--- RLS. An audit trail that the compromised credential can rewrite is not an audit
--- trail. Reverting therefore writes a NEW 'revert' row rather than removing history.
---
--- `script_id` and `actor_user_id` are deliberately PLAIN uuids with no foreign keys:
--- an FK with ON DELETE SET NULL would have to UPDATE this table when a script or a
--- profile is deleted, which the append-only trigger forbids. `script_name` is
--- denormalised so a deleted script is still identifiable in the log.
-
-CREATE TABLE IF NOT EXISTS public.site_script_revisions (
-    id uuid DEFAULT gen_random_uuid() NOT NULL,
-    script_id uuid,
-    script_name text NOT NULL,
-    revision_type text NOT NULL,
-    -- Null when the actor could not be resolved (e.g. a localhost dev connection).
-    actor_user_id uuid,
-    -- Which surface made the change, so an unexpected edit can be traced back to
-    -- the dashboard or to an MCP token.
-    source text DEFAULT 'cms'::text NOT NULL,
-    summary text,
-    -- Full restorable state of the script at this revision. For 'delete' it is the
-    -- state immediately BEFORE removal, so restoring it brings the script back.
-    snapshot jsonb NOT NULL,
-    created_at timestamp with time zone DEFAULT now() NOT NULL,
-    CONSTRAINT site_script_revisions_pkey PRIMARY KEY (id),
-    CONSTRAINT site_script_revisions_type_check
-        CHECK ((revision_type = ANY (ARRAY['create'::text, 'update'::text, 'delete'::text, 'revert'::text]))),
-    CONSTRAINT site_script_revisions_source_check
-        CHECK ((source = ANY (ARRAY['cms'::text, 'mcp'::text]))),
-    CONSTRAINT site_script_revisions_snapshot_is_object_check
-        CHECK ((jsonb_typeof(snapshot) = 'object'))
-);
-
-COMMENT ON TABLE public.site_script_revisions IS
-    'Append-only audit log and undo history for site_scripts. Each row is a restorable snapshot. UPDATE and DELETE are blocked by trigger, including for the service role.';
-
-CREATE INDEX IF NOT EXISTS site_script_revisions_script_created_idx
-    ON public.site_script_revisions USING btree (script_id, created_at DESC);
-
-CREATE INDEX IF NOT EXISTS site_script_revisions_created_idx
-    ON public.site_script_revisions USING btree (created_at DESC);
-
--- Enforced in the database rather than the application so it holds for every
--- caller, including the service-role client the MCP server uses.
-CREATE OR REPLACE FUNCTION public.prevent_site_script_revision_rewrite() RETURNS trigger
-    LANGUAGE plpgsql
-    SET search_path = ''
-    AS $$
-BEGIN
-  RAISE EXCEPTION 'site_script_revisions is append-only; % is not permitted', TG_OP
-    USING ERRCODE = 'restrict_violation';
-END;
-$$;
-
-DROP TRIGGER IF EXISTS trg_site_script_revisions_append_only ON public.site_script_revisions;
-CREATE TRIGGER trg_site_script_revisions_append_only
-    BEFORE UPDATE OR DELETE ON public.site_script_revisions
-    FOR EACH ROW EXECUTE FUNCTION public.prevent_site_script_revision_rewrite();
-
-ALTER TABLE public.site_script_revisions ENABLE ROW LEVEL SECURITY;
-
-GRANT SELECT, INSERT ON TABLE public.site_script_revisions TO authenticated;
-GRANT ALL ON TABLE public.site_script_revisions TO service_role;
-
--- Read is ADMIN-only: snapshots contain the full source of scripts that may not be
--- active yet, and the log itself reveals operational history.
-DROP POLICY IF EXISTS "Admins read site script revisions" ON public.site_script_revisions;
-CREATE POLICY "Admins read site script revisions" ON public.site_script_revisions
-    FOR SELECT TO authenticated
-    USING (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role));
-
-DROP POLICY IF EXISTS "Admins insert site script revisions" ON public.site_script_revisions;
-CREATE POLICY "Admins insert site script revisions" ON public.site_script_revisions
-    FOR INSERT TO authenticated
-    WITH CHECK (((SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role));