@nextblock-cms/db 0.2.22 → 0.2.24

package/supabase/migrations/00000000000012_setup_rls_policies.sql

@@ -0,0 +1,239 @@
+-- 00000000000020_setup_rls_policies.sql
+-- Consolidated RLS Policies
+
+BEGIN;
+
+-- 1. Enable RLS on all tables
+ALTER TABLE public.profiles ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.languages ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.media ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.posts ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.pages ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.blocks ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.navigation_items ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.logos ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.site_settings ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.translations ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.page_revisions ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.post_revisions ENABLE ROW LEVEL SECURITY;
+
+-- 2. GRANT PERMISSIONS (Crucial step often missed)
+-- Grant usage on schema (redundant if in setup_extensions, but safe)
+GRANT USAGE ON SCHEMA public TO anon, authenticated, service_role;
+
+-- Grant SELECT to anon (public) for content that should be visible
+GRANT SELECT ON TABLE public.profiles TO anon;
+GRANT SELECT ON TABLE public.languages TO anon;
+GRANT SELECT ON TABLE public.media TO anon;
+GRANT SELECT ON TABLE public.posts TO anon;
+GRANT SELECT ON TABLE public.pages TO anon;
+GRANT SELECT ON TABLE public.blocks TO anon;
+GRANT SELECT ON TABLE public.navigation_items TO anon;
+GRANT SELECT ON TABLE public.logos TO anon;
+GRANT SELECT ON TABLE public.site_settings TO anon;
+GRANT SELECT ON TABLE public.translations TO anon;
+
+-- Grant ALL to authenticated (RLS will still restrict rows)
+GRANT ALL ON ALL TABLES IN SCHEMA public TO authenticated;
+GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO authenticated;
+
+
+-- 3. PROFILES
+-- Read: Public can read basic profile info (needed for author display).
+CREATE POLICY "profiles_read_policy" ON public.profiles
+  FOR SELECT TO public
+  USING (true);
+
+-- Update: Users can update own profile; Admins can update all.
+CREATE POLICY "profiles_update_policy" ON public.profiles
+  FOR UPDATE TO authenticated
+  USING (
+    (id = auth.uid()) OR
+    (public.get_current_user_role() = 'ADMIN')
+  )
+  WITH CHECK (
+    (id = auth.uid()) OR
+    (public.get_current_user_role() = 'ADMIN')
+  );
+
+-- Insert: Admins can insert (Trigger handles signups).
+CREATE POLICY "profiles_insert_policy" ON public.profiles
+  FOR INSERT TO authenticated
+  WITH CHECK (public.get_current_user_role() = 'ADMIN');
+
+
+-- 4. PAGES
+-- Read: Anon/Auth can read published. Authors/Admins/Writers can read drafts.
+CREATE POLICY "pages_read_policy" ON public.pages
+  FOR SELECT TO authenticated
+  USING (
+    (status = 'published') OR
+    (author_id = auth.uid() AND status <> 'published') OR
+    (public.get_current_user_role() IN ('ADMIN', 'WRITER'))
+  );
+
+CREATE POLICY "pages_anon_read_policy" ON public.pages
+  FOR SELECT TO anon
+  USING (status = 'published');
+
+-- Manage: Admins/Writers can do everything.
+CREATE POLICY "pages_manage_policy" ON public.pages
+  FOR ALL TO authenticated
+  USING (public.get_current_user_role() IN ('ADMIN', 'WRITER'))
+  WITH CHECK (public.get_current_user_role() IN ('ADMIN', 'WRITER'));
+
+
+-- 5. POSTS
+-- Read: Anon/Auth can read published. Authors/Admins/Writers can read drafts.
+CREATE POLICY "posts_read_policy" ON public.posts
+  FOR SELECT TO authenticated
+  USING (
+    (status = 'published' AND (published_at IS NULL OR published_at <= now())) OR
+    (author_id = auth.uid() AND status <> 'published') OR
+    (public.get_current_user_role() IN ('ADMIN', 'WRITER'))
+  );
+
+CREATE POLICY "posts_anon_read_policy" ON public.posts
+  FOR SELECT TO anon
+  USING (status = 'published' AND (published_at IS NULL OR published_at <= now()));
+
+-- Manage: Admins/Writers can do everything.
+CREATE POLICY "posts_manage_policy" ON public.posts
+  FOR ALL TO authenticated
+  USING (public.get_current_user_role() IN ('ADMIN', 'WRITER'))
+  WITH CHECK (public.get_current_user_role() IN ('ADMIN', 'WRITER'));
+
+
+-- 6. BLOCKS
+-- Read: Admins/Writers see all. Others see blocks of published parents.
+CREATE POLICY "blocks_read_policy" ON public.blocks
+  FOR SELECT TO authenticated
+  USING (
+    (public.get_current_user_role() IN ('ADMIN', 'WRITER')) OR
+    (
+      (page_id IS NOT NULL AND EXISTS(SELECT 1 FROM public.pages p WHERE p.id = blocks.page_id AND p.status = 'published')) OR
+      (post_id IS NOT NULL AND EXISTS(SELECT 1 FROM public.posts pt WHERE pt.id = blocks.post_id AND pt.status = 'published' AND (pt.published_at IS NULL OR pt.published_at <= now())))
+    )
+  );
+
+CREATE POLICY "blocks_anon_read_policy" ON public.blocks
+  FOR SELECT TO anon
+  USING (
+    (page_id IS NOT NULL AND EXISTS(SELECT 1 FROM public.pages p WHERE p.id = blocks.page_id AND p.status = 'published')) OR
+    (post_id IS NOT NULL AND EXISTS(SELECT 1 FROM public.posts pt WHERE pt.id = blocks.post_id AND pt.status = 'published' AND (pt.published_at IS NULL OR pt.published_at <= now())))
+  );
+
+-- Manage: Admins/Writers can do everything.
+CREATE POLICY "blocks_manage_policy" ON public.blocks
+  FOR ALL TO authenticated
+  USING (public.get_current_user_role() IN ('ADMIN', 'WRITER'))
+  WITH CHECK (public.get_current_user_role() IN ('ADMIN', 'WRITER'));
+
+
+-- 7. MEDIA
+-- Read: Publicly readable.
+CREATE POLICY "media_read_policy" ON public.media
+  FOR SELECT TO public
+  USING (true);
+
+-- Manage: Admins/Writers can do everything.
+CREATE POLICY "media_manage_policy" ON public.media
+  FOR ALL TO authenticated
+  USING (public.get_current_user_role() IN ('ADMIN', 'WRITER'))
+  WITH CHECK (public.get_current_user_role() IN ('ADMIN', 'WRITER'));
+
+-- Service Role: Full access (for uploads).
+CREATE POLICY "media_service_role_policy" ON public.media
+  FOR ALL TO service_role
+  USING (true)
+  WITH CHECK (true);
+
+
+-- 8. NAVIGATION
+-- Read: Publicly readable.
+CREATE POLICY "navigation_read_policy" ON public.navigation_items
+  FOR SELECT TO public
+  USING (true);
+
+-- Manage: Admins only.
+CREATE POLICY "navigation_manage_policy" ON public.navigation_items
+  FOR ALL TO authenticated
+  USING (public.get_current_user_role() = 'ADMIN')
+  WITH CHECK (public.get_current_user_role() = 'ADMIN');
+
+
+-- 9. LANGUAGES
+-- Read: Publicly readable.
+CREATE POLICY "languages_read_policy" ON public.languages
+  FOR SELECT TO public
+  USING (true);
+
+-- Manage: Admins only.
+CREATE POLICY "languages_manage_policy" ON public.languages
+  FOR ALL TO authenticated
+  USING (public.get_current_user_role() = 'ADMIN')
+  WITH CHECK (public.get_current_user_role() = 'ADMIN');
+
+
+-- 10. LOGOS
+-- Read: Publicly readable.
+CREATE POLICY "logos_read_policy" ON public.logos
+  FOR SELECT TO public
+  USING (true);
+
+-- Manage: Admins only.
+CREATE POLICY "logos_manage_policy" ON public.logos
+  FOR ALL TO authenticated
+  USING (public.get_current_user_role() = 'ADMIN')
+  WITH CHECK (public.get_current_user_role() = 'ADMIN');
+
+
+-- 11. SITE SETTINGS
+-- Read: Publicly readable.
+CREATE POLICY "site_settings_read_policy" ON public.site_settings
+  FOR SELECT TO public
+  USING (true);
+
+-- Manage: Admins/Writers.
+CREATE POLICY "site_settings_manage_policy" ON public.site_settings
+  FOR ALL TO authenticated
+  USING (public.get_current_user_role() IN ('ADMIN', 'WRITER'))
+  WITH CHECK (public.get_current_user_role() IN ('ADMIN', 'WRITER'));
+
+
+-- 12. TRANSLATIONS
+-- Read: Publicly readable.
+CREATE POLICY "translations_read_policy" ON public.translations
+  FOR SELECT TO public
+  USING (true);
+
+-- Manage: Authenticated users (Open for now based on latest fix).
+CREATE POLICY "translations_manage_policy" ON public.translations
+  FOR ALL TO authenticated
+  USING (true)
+  WITH CHECK (true);
+  
+
+-- 13. REVISIONS
+-- Read: Authenticated users.
+CREATE POLICY "page_revisions_read_policy" ON public.page_revisions
+  FOR SELECT TO authenticated
+  USING (true);
+
+CREATE POLICY "post_revisions_read_policy" ON public.post_revisions
+  FOR SELECT TO authenticated
+  USING (true);
+
+-- Manage: Admins/Writers.
+CREATE POLICY "page_revisions_manage_policy" ON public.page_revisions
+  FOR ALL TO authenticated
+  USING (public.get_current_user_role() IN ('ADMIN', 'WRITER'))
+  WITH CHECK (public.get_current_user_role() IN ('ADMIN', 'WRITER'));
+
+CREATE POLICY "post_revisions_manage_policy" ON public.post_revisions
+  FOR ALL TO authenticated
+  USING (public.get_current_user_role() IN ('ADMIN', 'WRITER'))
+  WITH CHECK (public.get_current_user_role() IN ('ADMIN', 'WRITER'));
+
+
+COMMIT;

package/supabase/migrations/00000000000013_seed_data.sql

@@ -0,0 +1,139 @@
+-- 00000000000040_seed_data.sql
+-- Consolidated Seed Data: Translations, Logo, Foundational Content
+
+BEGIN;
+
+-- 1. Translations
+-- Merged from multiple translation seed files
+INSERT INTO public.translations (key, translations) VALUES
+('sign_in', '{"en": "Sign in", "fr": "Connexion"}'),
+('sign_up', '{"en": "Sign up", "fr": "Inscription"}'),
+('sign_out', '{"en": "Sign out", "fr": "Déconnexion"}'),
+('dont_have_account', '{"en": "Don''t have an account?", "fr": "Pas encore de compte ?"}'),
+('email', '{"en": "Email", "fr": "Email"}'),
+('you_at_example_com', '{"en": "you@example.com", "fr": "vous@example.com"}'),
+('password', '{"en": "Password", "fr": "Mot de passe"}'),
+('forgot_password', '{"en": "Forgot Password?", "fr": "Mot de passe oublié ?"}'),
+('your_password', '{"en": "Your password", "fr": "Votre mot de passe"}'),
+('signing_in_pending', '{"en": "Signing In...", "fr": "Connexion en cours..."}'),
+('already_have_account', '{"en": "Already have an account?", "fr": "Déjà un compte ?"}'),
+('signing_up_pending', '{"en": "Signing up...", "fr": "Inscription en cours..."}'),
+('reset_password', '{"en": "Reset Password", "fr": "Réinitialiser le mot de passe"}'),
+('blog_prefix', '{"en": "article", "fr": "article"}'),
+('edit_page', '{"en": "Edit Page", "fr": "Éditer la page"}'),
+('edit_post', '{"en": "Edit Post", "fr": "Éditer l''article"}'),
+('open_main_menu', '{"en": "Open main menu", "fr": "Ouvrir le menu principal"}'),
+('mobile_navigation_menu', '{"en": "Mobile navigation menu", "fr": "Menu de navigation mobile"}'),
+('cms_dashboard', '{"en": "CMS Dashboard", "fr": "Tableau de bord CMS"}'),
+('update_env_file_warning', '{"en": "Please update .env.local file with anon key and url", "fr": "Veuillez mettre à jour .env.local avec l''anon key et l''URL"}'),
+('greeting', '{"en": "Hey, {username}!", "fr": "Salut, {username} !"}')
+ON CONFLICT (key) DO UPDATE
+SET translations = EXCLUDED.translations;
+
+
+-- 2. Site Logo
+DO $$
+DECLARE
+  v_logo_media_id UUID := gen_random_uuid();
+  v_admin_id UUID;
+BEGIN
+  -- Get an admin user ID to set as uploader (optional, fallback to NULL)
+  SELECT id INTO v_admin_id FROM public.profiles WHERE role = 'ADMIN' LIMIT 1;
+
+  -- Insert the logo into the media table
+  INSERT INTO public.media (id, uploader_id, file_name, object_key, file_type, size_bytes, description)
+  VALUES (
+    v_logo_media_id,
+    v_admin_id,
+    'nextblock-logo-small.webp',
+    '/images/nextblock-logo-small.webp',
+    'image/webp',
+    10000,
+    'NextBlock Site Logo'
+  )
+  ON CONFLICT (object_key) DO UPDATE
+  SET
+    file_name = excluded.file_name,
+    file_type = excluded.file_type,
+    description = excluded.description
+  RETURNING id INTO v_logo_media_id;
+
+  -- Insert the logo into the logos table
+  INSERT INTO public.logos (name, media_id)
+  VALUES ('NextBlock Logo', v_logo_media_id)
+  ON CONFLICT DO NOTHING; -- Assuming name is not unique but we don't want to double insert if running multiple times? No unique constraint on name.
+  -- Actually, logos table has no unique constraint on name. 
+  -- But since this is a seed, we might want to avoid duplicates if run multiple times.
+  -- Let's check if it exists.
+  IF NOT EXISTS (SELECT 1 FROM public.logos WHERE name = 'NextBlock Logo') THEN
+     INSERT INTO public.logos (name, media_id) VALUES ('NextBlock Logo', v_logo_media_id);
+  END IF;
+
+END $$;
+
+
+-- 3. Foundational Content (Pages & Posts Structure)
+DO $$
+DECLARE
+  v_home_page_group_id uuid := gen_random_uuid();
+  v_blog_page_group_id uuid := gen_random_uuid();
+  v_how_it_works_post_group_id uuid := gen_random_uuid();
+  v_en_lang_id bigint;
+  v_fr_lang_id bigint;
+  v_feature_media_id uuid;
+BEGIN
+  -- Ensure languages exist (already seeded in setup_languages, but good to be safe/get IDs)
+  SELECT id INTO v_en_lang_id FROM public.languages WHERE code = 'en' LIMIT 1;
+  SELECT id INTO v_fr_lang_id FROM public.languages WHERE code = 'fr' LIMIT 1;
+
+  IF v_en_lang_id IS NULL OR v_fr_lang_id IS NULL THEN
+    RAISE EXCEPTION 'Required languages (en, fr) not found.';
+  END IF;
+
+  -- Scaffold Home Pages
+  INSERT INTO public.pages (language_id, title, slug, status, translation_group_id)
+  VALUES (v_en_lang_id, 'Home', 'home', 'published', v_home_page_group_id)
+  ON CONFLICT (language_id, slug) DO UPDATE
+    SET title = EXCLUDED.title, status = EXCLUDED.status;
+    -- Note: We don't update translation_group_id on conflict to avoid overwriting existing groups if they were manually set?
+    -- Actually, for a fresh reset, it doesn't matter. For an update, we might want to preserve.
+    -- But the user said "reset the database every time". So we can overwrite.
+    
+  INSERT INTO public.pages (language_id, title, slug, status, translation_group_id)
+  VALUES (v_fr_lang_id, 'Accueil', 'accueil', 'published', v_home_page_group_id)
+  ON CONFLICT (language_id, slug) DO UPDATE
+    SET title = EXCLUDED.title, status = EXCLUDED.status;
+
+  -- Scaffold Articles Pages
+  INSERT INTO public.pages (language_id, title, slug, status, translation_group_id)
+  VALUES (v_en_lang_id, 'Articles', 'articles', 'published', v_blog_page_group_id)
+  ON CONFLICT (language_id, slug) DO UPDATE
+    SET title = EXCLUDED.title, status = EXCLUDED.status;
+
+  INSERT INTO public.pages (language_id, title, slug, status, translation_group_id)
+  VALUES (v_fr_lang_id, 'Articles', 'articles', 'published', v_blog_page_group_id)
+  ON CONFLICT (language_id, slug) DO UPDATE
+    SET title = EXCLUDED.title, status = EXCLUDED.status;
+
+  -- Seed Featured Image
+  v_feature_media_id := gen_random_uuid();
+  INSERT INTO public.media (id, file_name, object_key, file_type, size_bytes)
+  VALUES (v_feature_media_id, 'programmer-upscaled.webp', '/images/programmer-upscaled.webp', 'image/webp', 100000)
+  ON CONFLICT (object_key) DO UPDATE
+    SET file_name = EXCLUDED.file_name
+  RETURNING id INTO v_feature_media_id;
+
+  -- Seed "How It Works" Post
+  INSERT INTO public.posts (language_id, title, slug, status, translation_group_id, feature_image_id)
+  VALUES (v_en_lang_id, 'How NextBlock Works: A Look Under the Hood', 'how-nextblock-works', 'published', v_how_it_works_post_group_id, v_feature_media_id)
+  ON CONFLICT (language_id, slug) DO UPDATE
+    SET title = EXCLUDED.title, status = EXCLUDED.status, feature_image_id = EXCLUDED.feature_image_id;
+
+  INSERT INTO public.posts (language_id, title, slug, status, translation_group_id, feature_image_id)
+  VALUES (v_fr_lang_id, 'Comment NextBlock Fonctionne : Regard Sous le Capot', 'comment-nextblock-fonctionne', 'published', v_how_it_works_post_group_id, v_feature_media_id)
+  ON CONFLICT (language_id, slug) DO UPDATE
+    SET title = EXCLUDED.title, status = EXCLUDED.status, feature_image_id = EXCLUDED.feature_image_id;
+
+END $$;
+
+COMMIT;