@nextblock-cms/db 0.2.10 → 0.2.11

package/supabase/migrations/20250526153321_optimize_rls_policies.sql

@@ -0,0 +1,188 @@
+-- supabase/migrations/YYYYMMDDHHMMSS_optimize_rls_policies_v2.sql
+-- Replace YYYYMMDDHHMMSS with the actual timestamp of this migration file.
+
+BEGIN;
+
+-- == PROFILES ==
+DROP POLICY IF EXISTS "users_can_select_own_profile" ON public.profiles;
+DROP POLICY IF EXISTS "users_can_update_own_profile" ON public.profiles;
+DROP POLICY IF EXISTS "admins_can_select_any_profile" ON public.profiles;
+DROP POLICY IF EXISTS "admins_can_update_any_profile" ON public.profiles;
+
+CREATE POLICY "authenticated_can_read_profiles" ON public.profiles
+  FOR SELECT
+  TO authenticated
+  USING (
+    (id = (SELECT auth.uid())) OR
+    (public.get_current_user_role() = 'ADMIN')
+  );
+COMMENT ON POLICY "authenticated_can_read_profiles" ON public.profiles IS 'Authenticated users can read their own profile, and admins can read any profile.';
+
+CREATE POLICY "authenticated_can_update_profiles" ON public.profiles
+  FOR UPDATE
+  TO authenticated
+  USING (
+    (id = (SELECT auth.uid())) OR
+    (public.get_current_user_role() = 'ADMIN')
+  )
+  WITH CHECK (
+    (id = (SELECT auth.uid())) OR
+    (public.get_current_user_role() = 'ADMIN')
+  );
+COMMENT ON POLICY "authenticated_can_update_profiles" ON public.profiles IS 'Authenticated users can update their own profile, and admins can update any profile.';
+
+-- Ensure admin insert policy is present and correct (it typically uses WITH CHECK on the role, not USING for insert)
+DROP POLICY IF EXISTS "admins_can_insert_profiles" ON public.profiles;
+CREATE POLICY "admins_can_insert_profiles" ON public.profiles
+    FOR INSERT TO authenticated
+    WITH CHECK (public.get_current_user_role() = 'ADMIN');
+COMMENT ON POLICY "admins_can_insert_profiles" ON public.profiles IS 'Admin users can insert new profiles.';
+
+
+-- == PAGES ==
+DROP POLICY IF EXISTS "pages_are_publicly_readable_when_published" ON public.pages;
+DROP POLICY IF EXISTS "authors_writers_admins_can_read_own_drafts" ON public.pages;
+DROP POLICY IF EXISTS "authors_writers_admins_can_read_own_or_all_drafts" ON public.pages;
+DROP POLICY IF EXISTS "admins_and_writers_can_manage_pages" ON public.pages;
+
+CREATE POLICY "pages_anon_can_read_published" ON public.pages
+  FOR SELECT
+  TO anon
+  USING (status = 'published');
+COMMENT ON POLICY "pages_anon_can_read_published" ON public.pages IS 'Anonymous users can read published pages.';
+
+CREATE POLICY "pages_authenticated_access" ON public.pages
+  FOR SELECT
+  TO authenticated
+  USING (
+    (status = 'published') OR
+    (author_id = (SELECT auth.uid()) AND status <> 'published') OR
+    (public.get_current_user_role() IN ('ADMIN', 'WRITER'))
+  );
+COMMENT ON POLICY "pages_authenticated_access" ON public.pages IS 'Authenticated users can read published pages, their own drafts, or all pages if admin/writer.';
+
+CREATE POLICY "pages_admin_writer_management" ON public.pages
+  FOR ALL -- Changed from INSERT, UPDATE, DELETE
+  TO authenticated
+  USING (public.get_current_user_role() IN ('ADMIN', 'WRITER'))
+  WITH CHECK (public.get_current_user_role() IN ('ADMIN', 'WRITER'));
+COMMENT ON POLICY "pages_admin_writer_management" ON public.pages IS 'Admins and Writers can manage pages.';
+
+
+-- == POSTS ==
+DROP POLICY IF EXISTS "posts_are_publicly_readable_when_published" ON public.posts;
+DROP POLICY IF EXISTS "authors_writers_admins_can_read_own_draft_posts" ON public.posts;
+DROP POLICY IF EXISTS "authors_writers_admins_can_read_own_or_all_draft_posts" ON public.posts;
+DROP POLICY IF EXISTS "admins_and_writers_can_manage_posts" ON public.posts;
+
+CREATE POLICY "posts_anon_can_read_published" ON public.posts
+  FOR SELECT
+  TO anon
+  USING (status = 'published' AND (published_at IS NULL OR published_at <= now()));
+COMMENT ON POLICY "posts_anon_can_read_published" ON public.posts IS 'Anonymous users can read published posts.';
+
+CREATE POLICY "posts_authenticated_access" ON public.posts
+  FOR SELECT
+  TO authenticated
+  USING (
+    (status = 'published' AND (published_at IS NULL OR published_at <= now())) OR
+    (author_id = (SELECT auth.uid()) AND status <> 'published') OR
+    (public.get_current_user_role() IN ('ADMIN', 'WRITER'))
+  );
+COMMENT ON POLICY "posts_authenticated_access" ON public.posts IS 'Authenticated users can read published posts, their own drafts, or all posts if admin/writer.';
+
+CREATE POLICY "posts_admin_writer_management" ON public.posts
+  FOR ALL -- Changed from INSERT, UPDATE, DELETE
+  TO authenticated
+  USING (public.get_current_user_role() IN ('ADMIN', 'WRITER'))
+  WITH CHECK (public.get_current_user_role() IN ('ADMIN', 'WRITER'));
+COMMENT ON POLICY "posts_admin_writer_management" ON public.posts IS 'Admins and Writers can manage posts.';
+
+
+-- == BLOCKS ==
+DROP POLICY IF EXISTS "blocks_are_readable_if_parent_is_published" ON public.blocks;
+DROP POLICY IF EXISTS "admins_and_writers_can_manage_blocks" ON public.blocks;
+
+CREATE POLICY "blocks_anon_can_read_published" ON public.blocks
+  FOR SELECT
+  TO anon
+  USING (
+    (page_id IS NOT NULL AND EXISTS(SELECT 1 FROM public.pages p WHERE p.id = blocks.page_id AND p.status = 'published')) OR
+    (post_id IS NOT NULL AND EXISTS(SELECT 1 FROM public.posts pt WHERE pt.id = blocks.post_id AND pt.status = 'published' AND (pt.published_at IS NULL OR pt.published_at <= now())))
+  );
+COMMENT ON POLICY "blocks_anon_can_read_published" ON public.blocks IS 'Anonymous users can read blocks of published parent pages/posts.';
+
+CREATE POLICY "blocks_authenticated_access" ON public.blocks
+  FOR SELECT
+  TO authenticated
+  USING (
+    (public.get_current_user_role() IN ('ADMIN', 'WRITER')) OR
+    (
+      (public.get_current_user_role() = 'USER') AND (
+        (page_id IS NOT NULL AND EXISTS(SELECT 1 FROM public.pages p WHERE p.id = blocks.page_id AND p.status = 'published')) OR
+        (post_id IS NOT NULL AND EXISTS(SELECT 1 FROM public.posts pt WHERE pt.id = blocks.post_id AND pt.status = 'published' AND (pt.published_at IS NULL OR pt.published_at <= now())))
+      )
+    )
+  );
+COMMENT ON POLICY "blocks_authenticated_access" ON public.blocks IS 'Admins/Writers can read all blocks; Users can read blocks of published parents.';
+
+CREATE POLICY "blocks_admin_writer_management" ON public.blocks
+  FOR ALL -- Changed from INSERT, UPDATE, DELETE
+  TO authenticated
+  USING (public.get_current_user_role() IN ('ADMIN', 'WRITER'))
+  WITH CHECK (public.get_current_user_role() IN ('ADMIN', 'WRITER'));
+COMMENT ON POLICY "blocks_admin_writer_management" ON public.blocks IS 'Admins and Writers can manage blocks.';
+
+
+-- == LANGUAGES ==
+DROP POLICY IF EXISTS "languages_are_publicly_readable" ON public.languages;
+DROP POLICY IF EXISTS "admins_can_manage_languages" ON public.languages;
+
+CREATE POLICY "languages_are_publicly_readable_by_all" ON public.languages
+  FOR SELECT
+  USING (true);
+COMMENT ON POLICY "languages_are_publicly_readable_by_all" ON public.languages IS 'All users (anon and authenticated) can read languages.';
+
+CREATE POLICY "languages_admin_management" ON public.languages
+  FOR ALL -- Changed from INSERT, UPDATE, DELETE
+  TO authenticated
+  USING (public.get_current_user_role() = 'ADMIN')
+  WITH CHECK (public.get_current_user_role() = 'ADMIN');
+COMMENT ON POLICY "languages_admin_management" ON public.languages IS 'Admins can manage languages.';
+
+
+-- == MEDIA ==
+DROP POLICY IF EXISTS "media_is_readable_by_all" ON public.media;
+DROP POLICY IF EXISTS "media_are_publicly_readable" ON public.media;
+DROP POLICY IF EXISTS "admins_and_writers_can_manage_media" ON public.media;
+
+CREATE POLICY "media_is_publicly_readable_by_all" ON public.media
+  FOR SELECT
+  USING (true);
+COMMENT ON POLICY "media_is_publicly_readable_by_all" ON public.media IS 'All users (anon and authenticated) can read media records.';
+
+CREATE POLICY "media_admin_writer_management" ON public.media
+  FOR ALL -- Changed from INSERT, UPDATE, DELETE
+  TO authenticated
+  USING (public.get_current_user_role() IN ('ADMIN', 'WRITER'))
+  WITH CHECK (public.get_current_user_role() IN ('ADMIN', 'WRITER'));
+COMMENT ON POLICY "media_admin_writer_management" ON public.media IS 'Admins and Writers can manage media records.';
+
+
+-- == NAVIGATION ITEMS ==
+DROP POLICY IF EXISTS "navigation_is_publicly_readable" ON public.navigation_items;
+DROP POLICY IF EXISTS "admins_can_manage_navigation" ON public.navigation_items;
+
+CREATE POLICY "nav_items_are_publicly_readable_by_all" ON public.navigation_items
+  FOR SELECT
+  USING (true);
+COMMENT ON POLICY "nav_items_are_publicly_readable_by_all" ON public.navigation_items IS 'All users (anon and authenticated) can read navigation items.';
+
+CREATE POLICY "nav_items_admin_management" ON public.navigation_items
+  FOR ALL -- Changed from INSERT, UPDATE, DELETE
+  TO authenticated
+  USING (public.get_current_user_role() = 'ADMIN')
+  WITH CHECK (public.get_current_user_role() = 'ADMIN');
+COMMENT ON POLICY "nav_items_admin_management" ON public.navigation_items IS 'Admins can manage navigation items.';
+
+COMMIT;

package/supabase/migrations/20250526172513_resolve_select_policy_overlaps.sql

@@ -0,0 +1,96 @@
+-- supabase/migrations/YYYYMMDDHHMMSS_resolve_select_policy_overlaps.sql
+-- (Ensure YYYYMMDDHHMMSS is the current timestamp)
+
+BEGIN;
+
+-- == BLOCKS ==
+-- Assuming "blocks_admin_writer_management" is FOR ALL and covers SELECT for ADMIN/WRITER.
+-- Make "blocks_authenticated_access" specific to non-ADMIN/WRITER authenticated users.
+DROP POLICY IF EXISTS "blocks_authenticated_access" ON public.blocks;
+CREATE POLICY "blocks_authenticated_user_access" ON public.blocks -- Renamed for clarity
+  FOR SELECT
+  TO authenticated
+  USING (
+    (public.get_current_user_role() NOT IN ('ADMIN', 'WRITER')) AND -- This is the key change
+    (
+      (page_id IS NOT NULL AND EXISTS(SELECT 1 FROM public.pages p WHERE p.id = blocks.page_id AND p.status = 'published')) OR
+      (post_id IS NOT NULL AND EXISTS(SELECT 1 FROM public.posts pt WHERE pt.id = blocks.post_id AND pt.status = 'published' AND (pt.published_at IS NULL OR pt.published_at <= now())))
+    )
+  );
+COMMENT ON POLICY "blocks_authenticated_user_access" ON public.blocks IS 'Authenticated USERS (non-admin/writer) can read blocks of published parents. Admin/Writer SELECT via their management policy.';
+-- Note: "blocks_anon_can_read_published" (FOR SELECT TO anon) should remain unchanged.
+-- Note: "blocks_admin_writer_management" (FOR ALL TO authenticated USING role IN (ADMIN,WRITER)) should remain unchanged.
+
+-- == LANGUAGES ==
+-- Assuming "languages_admin_management" is FOR ALL and covers SELECT for ADMIN.
+-- Make "languages_are_publicly_readable_by_all" not apply to authenticated ADMINs.
+DROP POLICY IF EXISTS "languages_are_publicly_readable_by_all" ON public.languages;
+CREATE POLICY "languages_readable_by_anon_and_non_admins" ON public.languages -- Renamed
+  FOR SELECT
+  USING (
+    NOT (auth.role() = 'authenticated' AND public.get_current_user_role() = 'ADMIN')
+  );
+COMMENT ON POLICY "languages_readable_by_anon_and_non_admins" ON public.languages IS 'Anonymous users and authenticated non-admins can read languages. Admin SELECT via management policy.';
+-- Note: "languages_admin_management" (FOR ALL TO authenticated USING role = ADMIN) should remain unchanged.
+
+-- == MEDIA ==
+-- Assuming "media_admin_writer_management" is FOR ALL and covers SELECT for ADMIN/WRITER.
+-- Make "media_is_publicly_readable_by_all" not apply to authenticated ADMIN/WRITERs.
+DROP POLICY IF EXISTS "media_is_publicly_readable_by_all" ON public.media;
+CREATE POLICY "media_readable_by_anon_and_non_privileged_users" ON public.media -- Renamed
+  FOR SELECT
+  USING (
+    NOT (auth.role() = 'authenticated' AND public.get_current_user_role() IN ('ADMIN', 'WRITER'))
+  );
+COMMENT ON POLICY "media_readable_by_anon_and_non_privileged_users" ON public.media IS 'Anonymous users and authenticated non-admin/writer users can read media. Admin/Writer SELECT via management policy.';
+-- Note: "media_admin_writer_management" (FOR ALL TO authenticated USING role IN (ADMIN,WRITER)) should remain unchanged.
+
+-- == NAVIGATION ITEMS ==
+-- Assuming "nav_items_admin_management" is FOR ALL and covers SELECT for ADMIN.
+-- Make "nav_items_are_publicly_readable_by_all" not apply to authenticated ADMINs.
+DROP POLICY IF EXISTS "nav_items_are_publicly_readable_by_all" ON public.navigation_items;
+CREATE POLICY "nav_items_readable_by_anon_and_non_admins" ON public.navigation_items -- Renamed
+  FOR SELECT
+  USING (
+    NOT (auth.role() = 'authenticated' AND public.get_current_user_role() = 'ADMIN')
+  );
+COMMENT ON POLICY "nav_items_readable_by_anon_and_non_admins" ON public.navigation_items IS 'Anonymous users and authenticated non-admins can read nav items. Admin SELECT via management policy.';
+-- Note: "nav_items_admin_management" (FOR ALL TO authenticated USING role = ADMIN) should remain unchanged.
+
+-- == PAGES ==
+-- Assuming "pages_admin_writer_management" is FOR ALL and covers SELECT for ADMIN/WRITER.
+-- Make "pages_authenticated_access" specific to non-ADMIN/WRITER authenticated users.
+DROP POLICY IF EXISTS "pages_authenticated_access" ON public.pages;
+CREATE POLICY "pages_user_authenticated_access" ON public.pages -- Renamed
+  FOR SELECT
+  TO authenticated
+  USING (
+    (public.get_current_user_role() NOT IN ('ADMIN', 'WRITER')) AND -- This is the key change
+    (
+      (status = 'published') OR
+      (author_id = (SELECT auth.uid()) AND status <> 'published')
+    )
+  );
+COMMENT ON POLICY "pages_user_authenticated_access" ON public.pages IS 'Authenticated USERS (non-admin/writer) can read published pages or their own drafts. Admin/Writer SELECT via their management policy.';
+-- Note: "pages_anon_can_read_published" (FOR SELECT TO anon) should remain unchanged.
+-- Note: "pages_admin_writer_management" (FOR ALL TO authenticated USING role IN (ADMIN,WRITER)) should remain unchanged.
+
+-- == POSTS ==
+-- Assuming "posts_admin_writer_management" is FOR ALL and covers SELECT for ADMIN/WRITER.
+-- Make "posts_authenticated_access" specific to non-ADMIN/WRITER authenticated users.
+DROP POLICY IF EXISTS "posts_authenticated_access" ON public.posts;
+CREATE POLICY "posts_user_authenticated_access" ON public.posts -- Renamed
+  FOR SELECT
+  TO authenticated
+  USING (
+    (public.get_current_user_role() NOT IN ('ADMIN', 'WRITER')) AND -- This is the key change
+    (
+      (status = 'published' AND (published_at IS NULL OR published_at <= now())) OR
+      (author_id = (SELECT auth.uid()) AND status <> 'published')
+    )
+  );
+COMMENT ON POLICY "posts_user_authenticated_access" ON public.posts IS 'Authenticated USERS (non-admin/writer) can read published posts or their own drafts. Admin/Writer SELECT via their management policy.';
+-- Note: "posts_anon_can_read_published" (FOR SELECT TO anon) should remain unchanged.
+-- Note: "posts_admin_writer_management" (FOR ALL TO authenticated USING role IN (ADMIN,WRITER)) should remain unchanged.
+
+COMMIT;

package/supabase/migrations/20250526172853_resolve_remaining_rls_v5.sql

@@ -0,0 +1,107 @@
+-- supabase/migrations/YYYYMMDDHHMMSS_resolve_remaining_rls_v5.sql
+-- (Ensure YYYYMMDDHHMMSS is the current timestamp)
+
+BEGIN;
+
+-- == LANGUAGES ==
+-- Drop the policy from v4 that needs auth.role() fix and better role targeting.
+DROP POLICY IF EXISTS "languages_readable_by_anon_and_non_admins" ON public.languages;
+-- Policy for anon
+CREATE POLICY "languages_anon_can_read" ON public.languages
+  FOR SELECT TO anon USING (true);
+COMMENT ON POLICY "languages_anon_can_read" ON public.languages IS 'Anonymous users can read languages.';
+-- Policy for authenticated USERS (non-admins)
+CREATE POLICY "languages_user_can_read" ON public.languages
+  FOR SELECT TO authenticated
+  USING (public.get_current_user_role() <> 'ADMIN'); -- Allows USER and WRITER (if writer isn't admin)
+COMMENT ON POLICY "languages_user_can_read" ON public.languages IS 'Authenticated non-admin users can read languages.';
+-- "languages_admin_management" (FOR ALL TO authenticated USING role = ADMIN) is assumed to be current and handles admin SELECT.
+
+
+-- == MEDIA ==
+-- Drop the policy from v4
+DROP POLICY IF EXISTS "media_readable_by_anon_and_non_privileged_users" ON public.media;
+-- Policy for anon
+CREATE POLICY "media_anon_can_read" ON public.media
+  FOR SELECT TO anon USING (true);
+COMMENT ON POLICY "media_anon_can_read" ON public.media IS 'Anonymous users can read media records.';
+-- Policy for authenticated USERS (non-admin/writer)
+CREATE POLICY "media_user_can_read" ON public.media
+  FOR SELECT TO authenticated
+  USING (public.get_current_user_role() NOT IN ('ADMIN', 'WRITER'));
+COMMENT ON POLICY "media_user_can_read" ON public.media IS 'Authenticated USERS (non-admin/writer) can read media records.';
+-- "media_admin_writer_management" (FOR ALL TO authenticated USING role IN (ADMIN,WRITER)) is assumed current.
+
+
+-- == NAVIGATION ITEMS ==
+-- Drop the policy from v4
+DROP POLICY IF EXISTS "nav_items_readable_by_anon_and_non_admins" ON public.navigation_items;
+-- Policy for anon
+CREATE POLICY "nav_items_anon_can_read" ON public.navigation_items
+  FOR SELECT TO anon USING (true);
+COMMENT ON POLICY "nav_items_anon_can_read" ON public.navigation_items IS 'Anonymous users can read navigation items.';
+-- Policy for authenticated USERS (non-admins)
+CREATE POLICY "nav_items_user_can_read" ON public.navigation_items
+  FOR SELECT TO authenticated
+  USING (public.get_current_user_role() <> 'ADMIN'); -- Allows USER and WRITER
+COMMENT ON POLICY "nav_items_user_can_read" ON public.navigation_items IS 'Authenticated non-admin users can read navigation items.';
+-- "nav_items_admin_management" (FOR ALL TO authenticated USING role = ADMIN) is assumed current.
+
+
+-- == BLOCKS ==
+-- Drop the "blocks_authenticated_user_access" from v4
+DROP POLICY IF EXISTS "blocks_authenticated_user_access" ON public.blocks;
+-- Recreate explicitly for USER role to avoid overlap with admin/writer FOR ALL policy
+CREATE POLICY "blocks_user_role_can_read_published_parents" ON public.blocks
+  FOR SELECT
+  TO authenticated
+  USING (
+    (public.get_current_user_role() = 'USER') AND
+    (
+      (page_id IS NOT NULL AND EXISTS(SELECT 1 FROM public.pages p WHERE p.id = blocks.page_id AND p.status = 'published')) OR
+      (post_id IS NOT NULL AND EXISTS(SELECT 1 FROM public.posts pt WHERE pt.id = blocks.post_id AND pt.status = 'published' AND (pt.published_at IS NULL OR pt.published_at <= now())))
+    )
+  );
+COMMENT ON POLICY "blocks_user_role_can_read_published_parents" ON public.blocks IS 'Authenticated USERS can read blocks of published parents. Admin/Writer SELECT via their management policy.';
+-- "blocks_anon_can_read_published" (FOR SELECT TO anon) from previous migrations is assumed to be fine.
+-- "blocks_admin_writer_management" (FOR ALL TO authenticated USING role IN (ADMIN,WRITER)) is assumed current.
+
+
+-- == PAGES ==
+-- Drop "pages_user_authenticated_access" from v4
+DROP POLICY IF EXISTS "pages_user_authenticated_access" ON public.pages;
+-- Recreate explicitly for USER role
+CREATE POLICY "pages_user_role_access" ON public.pages
+  FOR SELECT
+  TO authenticated
+  USING (
+    (public.get_current_user_role() = 'USER') AND
+    (
+      (status = 'published') OR
+      (author_id = (SELECT auth.uid()) AND status <> 'published') -- auth.uid() is fine here as it's specific to USER
+    )
+  );
+COMMENT ON POLICY "pages_user_role_access" ON public.pages IS 'Authenticated USERS can read published pages or their own drafts. Admin/Writer SELECT via their management policy.';
+-- "pages_anon_can_read_published" (FOR SELECT TO anon) is assumed fine.
+-- "pages_admin_writer_management" (FOR ALL TO authenticated USING role IN (ADMIN,WRITER)) is assumed current.
+
+-- == POSTS ==
+-- Drop "posts_user_authenticated_access" from v4
+DROP POLICY IF EXISTS "posts_user_authenticated_access" ON public.posts;
+-- Recreate explicitly for USER role
+CREATE POLICY "posts_user_role_access" ON public.posts
+  FOR SELECT
+  TO authenticated
+  USING (
+    (public.get_current_user_role() = 'USER') AND
+    (
+      (status = 'published' AND (published_at IS NULL OR published_at <= now())) OR
+      (author_id = (SELECT auth.uid()) AND status <> 'published') -- auth.uid() is fine here
+    )
+  );
+COMMENT ON POLICY "posts_user_role_access" ON public.posts IS 'Authenticated USERS can read published posts or their own drafts. Admin/Writer SELECT via their management policy.';
+-- "posts_anon_can_read_published" (FOR SELECT TO anon) is assumed fine.
+-- "posts_admin_writer_management" (FOR ALL TO authenticated USING role IN (ADMIN,WRITER)) is assumed current.
+
+
+COMMIT;

package/supabase/migrations/20250526173538_finalize_rls_cleanup_v7.sql

@@ -0,0 +1,110 @@
+-- supabase/migrations/YYYYMMDDHHMMSS_final_rls_cleanup_v7.sql
+-- (Ensure YYMMDDHHMMSS is the current timestamp)
+
+BEGIN;
+
+-- == BLOCKS ==
+-- Conflicting: {blocks_admin_writer_management, blocks_user_role_can_read_published_parents}
+-- "blocks_admin_writer_management" is FOR ALL and covers SELECT for ADMIN/WRITER.
+-- "blocks_user_role_can_read_published_parents" is for 'USER' role.
+-- This structure *should* be fine. The linter might be overly cautious.
+-- To be absolutely sure, we ensure "blocks_user_role_can_read_published_parents" only targets 'USER'.
+DROP POLICY IF EXISTS "blocks_user_role_can_read_published_parents" ON public.blocks;
+CREATE POLICY "blocks_user_role_can_read_published_parents" ON public.blocks
+  FOR SELECT
+  TO authenticated
+  USING (
+    (public.get_current_user_role() = 'USER') AND
+    (
+      (page_id IS NOT NULL AND EXISTS(SELECT 1 FROM public.pages p WHERE p.id = blocks.page_id AND p.status = 'published')) OR
+      (post_id IS NOT NULL AND EXISTS(SELECT 1 FROM public.posts pt WHERE pt.id = blocks.post_id AND pt.status = 'published' AND (pt.published_at IS NULL OR pt.published_at <= now())))
+    )
+  );
+COMMENT ON POLICY "blocks_user_role_can_read_published_parents" ON public.blocks IS 'Authenticated USERS can read blocks of published parents. Admin/Writer SELECT via their FOR ALL management policy.';
+-- Assuming "blocks_anon_can_read_published" and "blocks_admin_writer_management" (FOR ALL) are correct from previous migrations.
+
+
+-- == LANGUAGES ==
+-- Conflicting: {languages_admin_management, languages_user_can_read}
+-- "languages_admin_management" is FOR ALL and covers SELECT for ADMIN.
+-- "languages_user_can_read" (from v5) was: TO authenticated USING (public.get_current_user_role() <> 'ADMIN');
+-- This should be fine, as an ADMIN would make the USING clause false.
+-- To be very explicit for the linter:
+DROP POLICY IF EXISTS "languages_user_can_read" ON public.languages;
+CREATE POLICY "languages_authenticated_non_admin_can_read" ON public.languages
+  FOR SELECT
+  TO authenticated
+  USING (
+    public.get_current_user_role() IN ('USER', 'WRITER') -- Explicitly target USER and WRITER
+  );
+COMMENT ON POLICY "languages_authenticated_non_admin_can_read" ON public.languages IS 'Authenticated USER and WRITER roles can read languages. Admin SELECT via their FOR ALL management policy.';
+-- Assuming "languages_anon_can_read" and "languages_admin_management" (FOR ALL) are correct.
+
+
+-- == MEDIA ==
+-- Conflicting: {media_admin_writer_management, media_user_can_read}
+-- "media_admin_writer_management" is FOR ALL and covers SELECT for ADMIN/WRITER.
+-- "media_user_can_read" (from v5) was: TO authenticated USING (public.get_current_user_role() NOT IN ('ADMIN', 'WRITER'));
+-- This should be fine. To be very explicit:
+DROP POLICY IF EXISTS "media_user_can_read" ON public.media;
+CREATE POLICY "media_user_role_can_read" ON public.media
+  FOR SELECT
+  TO authenticated
+  USING (
+    public.get_current_user_role() = 'USER' -- Explicitly target USER role
+  );
+COMMENT ON POLICY "media_user_role_can_read" ON public.media IS 'Authenticated USER role can read media. Admin/Writer SELECT via their FOR ALL management policy.';
+-- Assuming "media_anon_can_read" and "media_admin_writer_management" (FOR ALL) are correct.
+
+
+-- == NAVIGATION ITEMS ==
+-- Conflicting: {nav_items_admin_management, nav_items_user_can_read}
+-- "nav_items_admin_management" is FOR ALL and covers SELECT for ADMIN.
+-- "nav_items_user_can_read" (from v5) was: TO authenticated USING (public.get_current_user_role() <> 'ADMIN');
+DROP POLICY IF EXISTS "nav_items_user_can_read" ON public.navigation_items;
+CREATE POLICY "nav_items_authenticated_non_admin_can_read" ON public.navigation_items
+  FOR SELECT
+  TO authenticated
+  USING (
+    public.get_current_user_role() IN ('USER', 'WRITER') -- Explicitly target USER and WRITER
+  );
+COMMENT ON POLICY "nav_items_authenticated_non_admin_can_read" ON public.navigation_items IS 'Authenticated USER and WRITER roles can read nav items. Admin SELECT via their FOR ALL management policy.';
+-- Assuming "nav_items_anon_can_read" and "nav_items_admin_management" (FOR ALL) are correct.
+
+
+-- == PAGES ==
+-- Conflicting: {pages_admin_writer_management, pages_user_role_access}
+-- This structure is identical to blocks and should be fine if "pages_user_role_access" correctly targets only USER.
+DROP POLICY IF EXISTS "pages_user_role_access" ON public.pages;
+CREATE POLICY "pages_user_role_can_read" ON public.pages -- Consistent naming
+  FOR SELECT
+  TO authenticated
+  USING (
+    (public.get_current_user_role() = 'USER') AND
+    (
+      (status = 'published') OR
+      (author_id = (SELECT auth.uid()) AND status <> 'published')
+    )
+  );
+COMMENT ON POLICY "pages_user_role_can_read" ON public.pages IS 'Authenticated USERS can read published pages or their own drafts. Admin/Writer SELECT via their FOR ALL management policy.';
+-- Assuming "pages_anon_can_read_published" and "pages_admin_writer_management" (FOR ALL) are correct.
+
+
+-- == POSTS ==
+-- Conflicting: {posts_admin_writer_management, posts_user_role_access}
+-- This structure is identical to blocks/pages and should be fine if "posts_user_role_access" correctly targets only USER.
+DROP POLICY IF EXISTS "posts_user_role_access" ON public.posts;
+CREATE POLICY "posts_user_role_can_read" ON public.posts -- Consistent naming
+  FOR SELECT
+  TO authenticated
+  USING (
+    (public.get_current_user_role() = 'USER') AND
+    (
+      (status = 'published' AND (published_at IS NULL OR published_at <= now())) OR
+      (author_id = (SELECT auth.uid()) AND status <> 'published')
+    )
+  );
+COMMENT ON POLICY "posts_user_role_can_read" ON public.posts IS 'Authenticated USERS can read published posts or their own drafts. Admin/Writer SELECT via their FOR ALL management policy.';
+-- Assuming "posts_anon_can_read_published" and "posts_admin_writer_management" (FOR ALL) are correct.
+
+COMMIT;

package/supabase/migrations/20250526174710_separate_write_policies_v8.sql

@@ -0,0 +1,147 @@
+-- supabase/migrations/YYYYMMDDHHMMSS_separate_write_policies_v8.sql
+
+BEGIN;
+
+-- == PROFILES ==
+-- Assuming "authenticated_can_read_profiles" (FOR SELECT) is correctly in place.
+-- Define explicit INSERT and leave UPDATE to the existing "authenticated_can_update_profiles" policy.
+DROP POLICY IF EXISTS "admins_can_insert_profiles" ON public.profiles;
+CREATE POLICY "admins_can_insert_profiles" ON public.profiles
+  FOR INSERT
+  TO authenticated
+  WITH CHECK (public.get_current_user_role() = 'ADMIN');
+COMMENT ON POLICY "admins_can_insert_profiles" ON public.profiles IS 'Admins can insert new profiles.';
+-- "authenticated_can_update_profiles" (FOR UPDATE) is assumed to be in place and correct.
+
+
+-- == BLOCKS ==
+-- Drop the old "FOR ALL" or "FOR INSERT, UPDATE, DELETE" management policy
+DROP POLICY IF EXISTS "blocks_admin_writer_management" ON public.blocks;
+
+-- Create separate policies for INSERT, UPDATE, DELETE for Admins/Writers
+CREATE POLICY "blocks_admin_writer_can_insert" ON public.blocks
+  FOR INSERT
+  TO authenticated
+  WITH CHECK (public.get_current_user_role() IN ('ADMIN', 'WRITER'));
+COMMENT ON POLICY "blocks_admin_writer_can_insert" ON public.blocks IS 'Admins/Writers can insert blocks.';
+
+CREATE POLICY "blocks_admin_writer_can_update" ON public.blocks
+  FOR UPDATE
+  TO authenticated
+  USING (public.get_current_user_role() IN ('ADMIN', 'WRITER')) -- USING is relevant for UPDATE
+  WITH CHECK (public.get_current_user_role() IN ('ADMIN', 'WRITER'));
+COMMENT ON POLICY "blocks_admin_writer_can_update" ON public.blocks IS 'Admins/Writers can update blocks.';
+
+CREATE POLICY "blocks_admin_writer_can_delete" ON public.blocks
+  FOR DELETE
+  TO authenticated
+  USING (public.get_current_user_role() IN ('ADMIN', 'WRITER'));
+COMMENT ON POLICY "blocks_admin_writer_can_delete" ON public.blocks IS 'Admins/Writers can delete blocks.';
+-- Assumed SELECT policies: "blocks_anon_can_read_published" and "blocks_user_role_can_read_published_parents" are in place.
+
+
+-- == LANGUAGES ==
+DROP POLICY IF EXISTS "languages_admin_management" ON public.languages;
+
+CREATE POLICY "languages_admin_can_insert" ON public.languages
+  FOR INSERT TO authenticated
+  WITH CHECK (public.get_current_user_role() = 'ADMIN');
+COMMENT ON POLICY "languages_admin_can_insert" ON public.languages IS 'Admins can insert languages.';
+
+CREATE POLICY "languages_admin_can_update" ON public.languages
+  FOR UPDATE TO authenticated
+  USING (public.get_current_user_role() = 'ADMIN')
+  WITH CHECK (public.get_current_user_role() = 'ADMIN');
+COMMENT ON POLICY "languages_admin_can_update" ON public.languages IS 'Admins can update languages.';
+
+CREATE POLICY "languages_admin_can_delete" ON public.languages
+  FOR DELETE TO authenticated
+  USING (public.get_current_user_role() = 'ADMIN');
+COMMENT ON POLICY "languages_admin_can_delete" ON public.languages IS 'Admins can delete languages.';
+-- Assumed SELECT policies: "languages_anon_can_read" and "languages_authenticated_non_admin_can_read" are in place.
+
+
+-- == MEDIA ==
+DROP POLICY IF EXISTS "media_admin_writer_management" ON public.media;
+
+CREATE POLICY "media_admin_writer_can_insert" ON public.media
+  FOR INSERT TO authenticated
+  WITH CHECK (public.get_current_user_role() IN ('ADMIN', 'WRITER'));
+COMMENT ON POLICY "media_admin_writer_can_insert" ON public.media IS 'Admins/Writers can insert media.';
+
+CREATE POLICY "media_admin_writer_can_update" ON public.media
+  FOR UPDATE TO authenticated
+  USING (public.get_current_user_role() IN ('ADMIN', 'WRITER'))
+  WITH CHECK (public.get_current_user_role() IN ('ADMIN', 'WRITER'));
+COMMENT ON POLICY "media_admin_writer_can_update" ON public.media IS 'Admins/Writers can update media.';
+
+CREATE POLICY "media_admin_writer_can_delete" ON public.media
+  FOR DELETE TO authenticated
+  USING (public.get_current_user_role() IN ('ADMIN', 'WRITER'));
+COMMENT ON POLICY "media_admin_writer_can_delete" ON public.media IS 'Admins/Writers can delete media.';
+-- Assumed SELECT policies: "media_anon_can_read" and "media_user_role_can_read" are in place.
+
+
+-- == NAVIGATION ITEMS ==
+DROP POLICY IF EXISTS "nav_items_admin_management" ON public.navigation_items;
+
+CREATE POLICY "nav_items_admin_can_insert" ON public.navigation_items
+  FOR INSERT TO authenticated
+  WITH CHECK (public.get_current_user_role() = 'ADMIN');
+COMMENT ON POLICY "nav_items_admin_can_insert" ON public.navigation_items IS 'Admins can insert navigation items.';
+
+CREATE POLICY "nav_items_admin_can_update" ON public.navigation_items
+  FOR UPDATE TO authenticated
+  USING (public.get_current_user_role() = 'ADMIN')
+  WITH CHECK (public.get_current_user_role() = 'ADMIN');
+COMMENT ON POLICY "nav_items_admin_can_update" ON public.navigation_items IS 'Admins can update navigation items.';
+
+CREATE POLICY "nav_items_admin_can_delete" ON public.navigation_items
+  FOR DELETE TO authenticated
+  USING (public.get_current_user_role() = 'ADMIN');
+COMMENT ON POLICY "nav_items_admin_can_delete" ON public.navigation_items IS 'Admins can delete navigation items.';
+-- Assumed SELECT policies: "nav_items_anon_can_read" and "nav_items_authenticated_non_admin_can_read" are in place.
+
+
+-- == PAGES ==
+DROP POLICY IF EXISTS "pages_admin_writer_management" ON public.pages;
+
+CREATE POLICY "pages_admin_writer_can_insert" ON public.pages
+  FOR INSERT TO authenticated
+  WITH CHECK (public.get_current_user_role() IN ('ADMIN', 'WRITER'));
+COMMENT ON POLICY "pages_admin_writer_can_insert" ON public.pages IS 'Admins/Writers can insert pages.';
+
+CREATE POLICY "pages_admin_writer_can_update" ON public.pages
+  FOR UPDATE TO authenticated
+  USING (public.get_current_user_role() IN ('ADMIN', 'WRITER'))
+  WITH CHECK (public.get_current_user_role() IN ('ADMIN', 'WRITER'));
+COMMENT ON POLICY "pages_admin_writer_can_update" ON public.pages IS 'Admins/Writers can update pages.';
+
+CREATE POLICY "pages_admin_writer_can_delete" ON public.pages
+  FOR DELETE TO authenticated
+  USING (public.get_current_user_role() IN ('ADMIN', 'WRITER'));
+COMMENT ON POLICY "pages_admin_writer_can_delete" ON public.pages IS 'Admins/Writers can delete pages.';
+-- Assumed SELECT policies: "pages_anon_can_read_published" and "pages_user_role_can_read" are in place.
+
+
+-- == POSTS ==
+DROP POLICY IF EXISTS "posts_admin_writer_management" ON public.posts;
+
+CREATE POLICY "posts_admin_writer_can_insert" ON public.posts
+  FOR INSERT TO authenticated
+  WITH CHECK (public.get_current_user_role() IN ('ADMIN', 'WRITER'));
+COMMENT ON POLICY "posts_admin_writer_can_insert" ON public.posts IS 'Admins/Writers can insert posts.';
+
+CREATE POLICY "posts_admin_writer_can_update" ON public.posts
+  FOR UPDATE TO authenticated
+  USING (public.get_current_user_role() IN ('ADMIN', 'WRITER'))
+  WITH CHECK (public.get_current_user_role() IN ('ADMIN', 'WRITER'));
+COMMENT ON POLICY "posts_admin_writer_can_update" ON public.posts IS 'Admins/Writers can update posts.';
+
+CREATE POLICY "posts_admin_writer_can_delete" ON public.posts
+  FOR DELETE TO authenticated
+  USING (public.get_current_user_role() IN ('ADMIN', 'WRITER'));
+COMMENT ON POLICY "posts_admin_writer_can_delete" ON public.posts IS 'Admins/Writers can delete posts.';
+-- Assumed SELECT policies: "posts_anon_can_read_published" and "posts_user_role_can_read" are in place.
+
+COMMIT;