@nextblock-cms/db 0.2.21 → 0.2.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextblock-cms/db",
-  "version": "0.2.21",
+  "version": "0.2.22",
   "main": "index.cjs.js",
   "module": "index.es.js",
   "types": "index.d.ts",

package/supabase/migrations/20251127110000_fix_blocks_visibility_for_missing_profiles.sql

@@ -0,0 +1,23 @@
+BEGIN;
+
+-- Drop the existing restrictive policy
+DROP POLICY IF EXISTS "blocks_authenticated_comprehensive_select" ON public.blocks;
+
+-- Create the new inclusive policy
+CREATE POLICY "blocks_authenticated_comprehensive_select" ON public.blocks
+  FOR SELECT
+  TO authenticated
+  USING (
+    -- 1. Admin/Writer can see everything
+    ((SELECT public.get_current_user_role()) IN ('ADMIN', 'WRITER'))
+    OR
+    -- 2. Anyone (including USER or no-role) can see published content
+    (
+      (page_id IS NOT NULL AND EXISTS(SELECT 1 FROM public.pages p WHERE p.id = blocks.page_id AND p.status = 'published')) OR
+      (post_id IS NOT NULL AND EXISTS(SELECT 1 FROM public.posts pt WHERE pt.id = blocks.post_id AND pt.status = 'published' AND (pt.published_at IS NULL OR pt.published_at <= now())))
+    )
+  );
+
+COMMENT ON POLICY "blocks_authenticated_comprehensive_select" ON public.blocks IS 'Comprehensive SELECT policy for authenticated users on the blocks table. Admins/Writers see all. Others (including those with missing profiles) see blocks of published parents.';
+
+COMMIT;

package/supabase/migrations/20251127120000_fix_duplicate_rls_policies.sql

@@ -0,0 +1,36 @@
+BEGIN;
+
+-- ============================================================
+-- 1. Fix Duplicate Policies on public.blocks
+-- ============================================================
+
+-- Drop the "extra" policies that were causing duplicates.
+-- These appear to have been introduced in 20250619124100_fix_rls_performance_warnings.sql
+-- but conflict with the standard naming convention used in other migrations.
+
+DROP POLICY IF EXISTS "Allow read access to blocks" ON public.blocks;
+DROP POLICY IF EXISTS "Allow insert for admins and writers on blocks" ON public.blocks;
+DROP POLICY IF EXISTS "Allow update for admins and writers on blocks" ON public.blocks;
+DROP POLICY IF EXISTS "Allow delete for admins and writers on blocks" ON public.blocks;
+
+-- Ensure the canonical policies are in place (they should be, but good to be safe).
+-- The canonical policies are:
+-- SELECT: "blocks_authenticated_comprehensive_select" (from 20251127110000_fix_blocks_visibility_for_missing_profiles.sql)
+-- INSERT: "blocks_admin_writer_can_insert" (from 20251126133000_fix_blocks_rls.sql)
+-- UPDATE: "blocks_admin_writer_can_update" (from 20251126133000_fix_blocks_rls.sql)
+-- DELETE: "blocks_admin_writer_can_delete" (from 20251126133000_fix_blocks_rls.sql)
+
+-- Note: "blocks_anon_can_read_published_blocks" is also a valid policy for anon users.
+
+
+-- ============================================================
+-- 2. Fix Duplicate Policies on public.media
+-- ============================================================
+
+-- Drop the specific "admin/writer" read policy, as "media_public_can_read" covers everyone.
+DROP POLICY IF EXISTS "media_admin_writer_can_read" ON public.media;
+
+-- Ensure "media_public_can_read" exists (it should, from 20250526183746_fix_media_select_rls_v12.sql)
+-- If for some reason it's missing, we can recreate it, but usually dropping the duplicate is enough.
+
+COMMIT;