@nextblock-cms/db 0.17.7 → 0.17.8

package/lib/package-validation.d.ts

@@ -1 +1,20 @@
+/**
+ * Cache tag for every cached activation read. Activation and deactivation call
+ * `updateTag(PACKAGE_ACTIVATION_CACHE_TAG)` so a purchase unlocks the CMS on the very
+ * next request instead of after the 60 s window.
+ */
+export declare const PACKAGE_ACTIVATION_CACHE_TAG = "package-activation";
+/**
+ * The moment a stored activation stops being valid, from what the row knows:
+ * the license expiration (recorded from the vendor at checkout, from Freemius at
+ * activation, and refreshed by the background re-validation) or the trial end. Null
+ * when the row carries no date, which is the case for keys activated before these
+ * fields existed and for lifetime licenses.
+ */
+export declare function resolvePackageActivationExpiry(meta: unknown): number | null;
+/** A row counts only while its status is active AND any known expiry is in the future. */
+export declare function isPackageActivationRowValid(row: {
+    meta?: unknown;
+    status?: unknown;
+}, now?: number): boolean;
 export declare function verifyPackageOnline(packageId: string, customClient?: any): Promise<boolean>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextblock-cms/db",
-  "version": "0.17.7",
+  "version": "0.17.8",
   "main": "index.cjs.js",
   "module": "index.es.js",
   "types": "index.d.ts",

package/supabase/migrations/02014_package_activations_staff_read.sql

@@ -0,0 +1,18 @@
+-- 02014: package_activations is readable by staff only.
+--
+-- The baseline granted SELECT on package_activations to every authenticated user
+-- ("Allow authenticated read access" USING (true)). Public sign-up creates USER-role
+-- accounts, so any storefront customer could read the plaintext license keys and the
+-- Freemius install handles (meta.fm_uid / meta.fm_install_id) of the premium packages —
+-- and the dashboard now buys and stores those keys itself. Only staff surfaces read
+-- this table with the cookie client (the dashboard stats for ADMIN and WRITER, the
+-- packages page for ADMIN); everything else goes through the service role, which is
+-- unaffected. Writes were never allowed to authenticated users and stay that way.
+
+DROP POLICY IF EXISTS "Allow authenticated read access" ON public.package_activations;
+
+CREATE POLICY "Staff read package activations" ON public.package_activations
+  FOR SELECT TO authenticated
+  USING (
+    (SELECT public.get_current_user_role()) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role])
+  );