@nextblock-cms/db 0.2.18 → 0.2.20

package/supabase/migrations/20251126100000_seed_site_logo.sql

@@ -0,0 +1,33 @@
+-- supabase/migrations/20251126100000_seed_site_logo.sql
+
+DO $$
+DECLARE
+  v_logo_media_id UUID := gen_random_uuid();
+  v_admin_id UUID;
+BEGIN
+  -- Get an admin user ID to set as uploader (optional, fallback to NULL)
+  SELECT id INTO v_admin_id FROM public.profiles WHERE role = 'ADMIN' LIMIT 1;
+
+  -- Insert the logo into the media table
+  INSERT INTO public.media (id, uploader_id, file_name, object_key, file_type, size_bytes, description)
+  VALUES (
+    v_logo_media_id,
+    v_admin_id,
+    'nextblock-logo-small.webp',
+    '/images/nextblock-logo-small.webp',
+    'image/webp',
+    10000, -- Dummy size
+    'NextBlock Site Logo'
+  )
+  ON CONFLICT (object_key) DO UPDATE
+  SET
+    file_name = excluded.file_name,
+    file_type = excluded.file_type,
+    description = excluded.description
+  RETURNING id INTO v_logo_media_id;
+
+  -- Insert the logo into the logos table
+  INSERT INTO public.logos (name, media_id)
+  VALUES ('NextBlock Logo', v_logo_media_id);
+
+END $$;

package/supabase/migrations/20251126133000_fix_blocks_rls.sql

@@ -0,0 +1,49 @@
+-- Fix blocks update policy
+-- Explicitly allow authenticated users with ADMIN or WRITER roles to update blocks
+-- Cleans up potential conflicting policies and ensures permissions are granted
+
+BEGIN;
+
+-- 1. Grant permissions to the role (in case they were missing)
+GRANT ALL ON TABLE public.blocks TO authenticated;
+GRANT USAGE, SELECT ON SEQUENCE public.blocks_id_seq TO authenticated;
+
+-- 2. Drop ALL known previous/conflicting update policies
+DROP POLICY IF EXISTS "Allow authenticated users to update blocks" ON public.blocks;
+DROP POLICY IF EXISTS "Allow admins and writers to update blocks" ON public.blocks;
+DROP POLICY IF EXISTS "blocks_admin_writer_can_update" ON public.blocks;
+DROP POLICY IF EXISTS "admins_and_writers_can_manage_blocks" ON public.blocks;
+
+-- 3. Create new policy using the trusted security definer function
+-- We use get_my_role() which is SECURITY DEFINER to bypass RLS on profiles table
+CREATE POLICY "Allow admins and writers to update blocks"
+ON public.blocks
+FOR UPDATE
+TO authenticated
+USING (
+  get_my_role() IN ('ADMIN', 'WRITER')
+)
+WITH CHECK (
+  get_my_role() IN ('ADMIN', 'WRITER')
+);
+
+-- 4. Also fix INSERT/DELETE just in case, using the same robust method
+DROP POLICY IF EXISTS "blocks_admin_writer_can_insert" ON public.blocks;
+CREATE POLICY "Allow admins and writers to insert blocks"
+ON public.blocks
+FOR INSERT
+TO authenticated
+WITH CHECK (
+  get_my_role() IN ('ADMIN', 'WRITER')
+);
+
+DROP POLICY IF EXISTS "blocks_admin_writer_can_delete" ON public.blocks;
+CREATE POLICY "Allow admins and writers to delete blocks"
+ON public.blocks
+FOR DELETE
+TO authenticated
+USING (
+  get_my_role() IN ('ADMIN', 'WRITER')
+);
+
+COMMIT;