@nextblock-cms/db 0.21.2 → 0.22.0

package/supabase/migrations/02020_commerce_product_accuracy.sql

@@ -0,0 +1,93 @@
+-- 02020: Commerce Pro license product copy, EN + FR (vendor-only rows: nextblock.dev has them,
+-- fresh installs do not, so this is a no-op everywhere else). Copy only; no schema.
+--
+-- The page claimed things the code does not do:
+-- * "real-time exchange rates" -- rates are ECB reference rates from api.frankfurter.dev, refreshed
+--   at most once a day from the CMS layout via after() (apps/nextblock/lib/commerce/currency-rates-refresh.ts),
+--   with a "Sync Live Rates" button and the optional /api/cron/sync-currencies route. The Vercel cron
+--   that used to run this was dropped because vercel.json ships to every 1-click install.
+-- * "< 50ms Cart API Response" -- there is no cart API route at all.
+-- * "135+ Currencies Supported" / "40+ Tax Jurisdictions" -- currencies are rows an operator creates,
+--   and tax coverage is Stripe's, not ours.
+-- * "Every API path is edge-cached" -- public pages come from the 5-minute content cache that clears
+--   on publish; HTML is served must-revalidate.
+-- * "optimistic locking" -- stock is deducted under SELECT ... FOR UPDATE (libs/ecommerce order-inventory.ts).
+-- * "email notifications" -- no order email exists; orders produce printable invoices.
+-- * "shares inventory and pricing" -- stock is shared through the SKU, prices are per language row.
+-- The page also never mentioned the 30-day free trial, the French buttons pointed at the English
+-- product, the cards skipped from h3 to h5, and neither language had SEO meta (45/100 in the audit;
+-- the new copy scores 85). Same copy as apps/nextblock/app/api/cron/reset-sandbox/commerce-product-copy.ts,
+-- which re-seeds the sandbox after every reset.
+--
+-- Guarded: each product is replaced only while it still carries the shipped signature, so a product
+-- the vendor rewrote by hand is left alone (a NOTICE names it). Idempotent: the new signature stops
+-- a second run.
+--
+-- NOTE: keep the word "sandbox" OUT of this filename -- generate-sandbox-reset.ts excludes any
+-- migration whose filename contains "sandbox" from the reset bundle.
+
+DO $nb_02020_products$
+DECLARE
+  v_id uuid;
+  v_lang bigint;
+BEGIN
+
+  -- English
+  v_id := NULL;
+  SELECT p.id, p.language_id INTO v_id, v_lang
+    FROM public.products AS p JOIN public.languages AS l ON l.id = p.language_id
+   WHERE p.slug = 'nextblock-commerce-pro-commerce-license' AND l.code = 'en'
+   ORDER BY p.id LIMIT 1;
+  IF v_id IS NOT NULL THEN
+    IF EXISTS (SELECT 1 FROM public.blocks WHERE product_id = v_id AND content::text LIKE $t$%Enterprise E-Commerce Engine%$t$)
+       AND NOT EXISTS (SELECT 1 FROM public.blocks WHERE product_id = v_id AND content::text LIKE $t$%Days free, no card%$t$) THEN
+      DELETE FROM public.blocks WHERE product_id = v_id;
+      INSERT INTO public.blocks (product_id, language_id, block_type, content, "order") VALUES
+        (v_id, v_lang, 'section', $nbcm0en${"padding":{"top":"xl","bottom":"xl"},"background":{"type":"gradient","gradient":{"type":"linear","stops":[{"color":"#022c22","position":0},{"color":"#064e3b","position":40},{"color":"#0f172a","position":100}],"direction":"135deg"}},"column_gap":"xl","column_blocks":[[{"content":{"html_content":"<p class=\"text-xs uppercase tracking-[0.3em] text-emerald-400 font-semibold mb-4\">Enterprise E-Commerce Engine</p>\n<h2 class=\"text-3xl md:text-5xl font-extrabold text-white leading-tight mb-5\">Turn Next.js Into a<br/>Global Storefront.</h2>\n<p class=\"text-base md:text-lg text-slate-200 leading-relaxed mb-6\">Commerce Pro is a composable, developer-first engine that powers physical product catalogs, digital licensing, and subscription commerce — all from your existing Next.js stack. Try it free for 30 days, no credit card.</p>"},"block_type":"text"},{"content":{"url":"https://nextblock.dev/product/nextblock-commerce-pro-commerce-license","size":"lg","text":"Get Commerce Pro →","variant":"default","position":"left"},"block_type":"button"}],[{"content":{"html_content":"<div class=\"rounded-2xl border border-emerald-700 bg-slate-950 p-6 shadow-xl sm:p-8\">\n<h3 class=\"text-lg font-bold text-white mb-5\">Why Teams Choose Commerce Pro</h3>\n<ul class=\"space-y-4 text-sm leading-relaxed text-slate-300\">\n  <li class=\"flex items-start gap-3\">\n    <span class=\"flex-shrink-0 w-6 h-6 rounded-full bg-emerald-950 flex items-center justify-center text-emerald-300 text-xs font-bold\">✓</span>\n    <span><strong class=\"text-white\">Multi-Currency Pricing</strong> — daily exchange-rate sync, charm pricing rules, and a currency suggested by the visitor's locale.</span>\n  </li>\n  <li class=\"flex items-start gap-3\">\n    <span class=\"flex-shrink-0 w-6 h-6 rounded-full bg-emerald-950 flex items-center justify-center text-emerald-300 text-xs font-bold\">✓</span>\n    <span><strong class=\"text-white\">Tax Automation</strong> — switch on Stripe Tax and checkout calculates and collects tax for you, with the tax lines stored on every order.</span>\n  </li>\n  <li class=\"flex items-start gap-3\">\n    <span class=\"flex-shrink-0 w-6 h-6 rounded-full bg-emerald-950 flex items-center justify-center text-emerald-300 text-xs font-bold\">✓</span>\n    <span><strong class=\"text-white\">Resilient Stock Tracking</strong> — inventory locks at checkout to prevent over-selling, with per-variant control.</span>\n  </li>\n  <li class=\"flex items-start gap-3\">\n    <span class=\"flex-shrink-0 w-6 h-6 rounded-full bg-emerald-950 flex items-center justify-center text-emerald-300 text-xs font-bold\">✓</span>\n    <span><strong class=\"text-white\">Flexible Shipping Zones</strong> — rate tables, free-shipping thresholds, and per-country rules out of the box.</span>\n  </li>\n</ul>\n</div>"},"block_type":"text"}]],"container_type":"container","responsive_columns":{"mobile":1,"tablet":1,"desktop":2},"vertical_alignment":"center"}$nbcm0en$::jsonb, 0),
+        (v_id, v_lang, 'section', $nbcm1en${"padding":{"top":"lg","bottom":"lg"},"background":{"type":"theme","theme":"muted"},"column_gap":"lg","column_blocks":[[{"content":{"html_content":"<p class=\"text-center\"><span class=\"block text-2xl font-extrabold text-foreground\">30</span><span class=\"text-xs text-muted-foreground uppercase tracking-wider\">Days free, no card</span></p>"},"block_type":"text"}],[{"content":{"html_content":"<p class=\"text-center\"><span class=\"block text-2xl font-extrabold text-foreground\">2</span><span class=\"text-xs text-muted-foreground uppercase tracking-wider\">Checkout providers</span></p>"},"block_type":"text"}],[{"content":{"html_content":"<p class=\"text-center\"><span class=\"block text-2xl font-extrabold text-foreground\">Daily</span><span class=\"text-xs text-muted-foreground uppercase tracking-wider\">Exchange-rate sync</span></p>"},"block_type":"text"}],[{"content":{"html_content":"<p class=\"text-center\"><span class=\"block text-2xl font-extrabold text-foreground\">EN + FR</span><span class=\"text-xs text-muted-foreground uppercase tracking-wider\">Linked storefronts</span></p>"},"block_type":"text"}]],"container_type":"container","responsive_columns":{"mobile":1,"tablet":2,"desktop":4},"vertical_alignment":"center"}$nbcm1en$::jsonb, 1),
+        (v_id, v_lang, 'section', $nbcm2en${"padding":{"top":"xl","bottom":"xl"},"background":{"type":"none"},"column_gap":"lg","column_blocks":[[{"content":{"html_content":"<div class=\"h-full rounded-2xl border border-slate-200 bg-white p-6 shadow-sm transition-colors hover:border-emerald-300 hover:bg-slate-50 dark:border-white/10 dark:bg-slate-950 dark:hover:border-emerald-500 sm:p-7\">\n<div class=\"mb-4 inline-flex h-10 w-10 items-center justify-center rounded-xl bg-emerald-50 text-emerald-700 dark:bg-emerald-950 dark:text-emerald-300\"><svg class=\"h-5 w-5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" viewBox=\"0 0 24 24\" aria-hidden=\"true\"><rect x=\"3\" y=\"5\" width=\"18\" height=\"14\" rx=\"2\"></rect><path d=\"M3 10h18M7 15h3\"></path></svg></div>\n<h4 class=\"text-base font-bold text-slate-900 dark:text-white mb-2\">Headless Stripe Checkout</h4>\n<p class=\"text-sm text-slate-600 dark:text-slate-300 leading-relaxed\">Integrated checkout session creation for single or multiple items. Auto-fulfillment fires via webhook events, with built-in idempotency guards.</p>\n</div>"},"block_type":"text"}],[{"content":{"html_content":"<div class=\"h-full rounded-2xl border border-slate-200 bg-white p-6 shadow-sm transition-colors hover:border-emerald-300 hover:bg-slate-50 dark:border-white/10 dark:bg-slate-950 dark:hover:border-emerald-500 sm:p-7\">\n<div class=\"mb-4 inline-flex h-10 w-10 items-center justify-center rounded-xl bg-emerald-50 text-emerald-700 dark:bg-emerald-950 dark:text-emerald-300\"><svg class=\"h-5 w-5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" viewBox=\"0 0 24 24\" aria-hidden=\"true\"><path d=\"M15 7a4 4 0 1 1-2.83 6.83L7 19H4v-3h3l2.17-2.17A4 4 0 0 1 15 7Z\"></path><path d=\"M17.5 8.5h.01\"></path></svg></div>\n<h4 class=\"text-base font-bold text-slate-900 dark:text-white mb-2\">Freemius Digital Licensing</h4>\n<p class=\"text-sm text-slate-600 dark:text-slate-300 leading-relaxed\">Distribute software downloads, validate license keys, and manage SaaS trial periods natively — no third-party integration layer required.</p>\n</div>"},"block_type":"text"}],[{"content":{"html_content":"<div class=\"h-full rounded-2xl border border-slate-200 bg-white p-6 shadow-sm transition-colors hover:border-emerald-300 hover:bg-slate-50 dark:border-white/10 dark:bg-slate-950 dark:hover:border-emerald-500 sm:p-7\">\n<div class=\"mb-4 inline-flex h-10 w-10 items-center justify-center rounded-xl bg-emerald-50 text-emerald-700 dark:bg-emerald-950 dark:text-emerald-300\"><svg class=\"h-5 w-5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" viewBox=\"0 0 24 24\" aria-hidden=\"true\"><rect x=\"4\" y=\"5\" width=\"16\" height=\"14\" rx=\"2\"></rect><path d=\"m4 15 4-4 4 4 3-3 5 5\"></path><circle cx=\"15\" cy=\"9\" r=\"1\"></circle></svg></div>\n<h4 class=\"text-base font-bold text-slate-900 dark:text-white mb-2\">Visual Merchandising</h4>\n<p class=\"text-sm text-slate-600 dark:text-slate-300 leading-relaxed\">Content creators can add product details pages, highlight promotions, and build full landing pages — all inside the block editor, no code needed.</p>\n</div>"},"block_type":"text"}]],"container_type":"container","responsive_columns":{"mobile":1,"tablet":2,"desktop":3},"vertical_alignment":"stretch"}$nbcm2en$::jsonb, 2),
+        (v_id, v_lang, 'section', $nbcm3en${"padding":{"top":"xl","bottom":"xl"},"background":{"type":"gradient","gradient":{"type":"linear","stops":[{"color":"#020617","position":0},{"color":"#0f172a","position":100}],"direction":"180deg"}},"column_gap":"xl","column_blocks":[[{"content":{"html_content":"<p class=\"text-xs uppercase tracking-[0.3em] text-emerald-400 font-semibold mb-4\">Under The Hood</p>\n<h3 class=\"text-2xl md:text-3xl font-extrabold text-white mb-4\">Built for Production Scale</h3>\n<p class=\"text-slate-300 leading-relaxed mb-5\">Commerce Pro was designed from day one for high-traffic stores. Store pages come from a public content cache that clears the moment you publish, every database query is indexed, and every webhook handler is idempotent.</p>\n<ul class=\"space-y-3 text-sm text-slate-400\">\n  <li class=\"flex items-start gap-2.5\">\n    <span class=\"text-emerald-400\">→</span>\n    <span>Variant-level inventory with row-locked stock deduction</span>\n  </li>\n  <li class=\"flex items-start gap-2.5\">\n    <span class=\"text-emerald-400\">→</span>\n    <span>Automatic shipping zone calculation and rate tables</span>\n  </li>\n  <li class=\"flex items-start gap-2.5\">\n    <span class=\"text-emerald-400\">→</span>\n    <span>Real-time order status with Stripe webhook sync</span>\n  </li>\n  <li class=\"flex items-start gap-2.5\">\n    <span class=\"text-emerald-400\">→</span>\n    <span>Product attributes and filterable facets system</span>\n  </li>\n</ul>"},"block_type":"text"}],[{"content":{"html_content":"<div class=\"space-y-4\">\n<div class=\"p-5 rounded-xl border border-slate-700 bg-slate-900\">\n  <h4 class=\"text-sm font-bold text-white mb-1\">Order Management</h4>\n  <p class=\"text-xs text-slate-400 leading-relaxed\">Full order lifecycle from cart to fulfillment. Automatic status transitions, printable invoices, and refund handling baked in.</p>\n</div>\n<div class=\"p-5 rounded-xl border border-slate-700 bg-slate-900\">\n  <h4 class=\"text-sm font-bold text-white mb-1\">Product Categories</h4>\n  <p class=\"text-xs text-slate-400 leading-relaxed\">Hierarchical taxonomy with slugs, media attachments, and full i18n support. Categories are managed directly in the CMS dashboard.</p>\n</div>\n<div class=\"p-5 rounded-xl border border-slate-700 bg-slate-900\">\n  <h4 class=\"text-sm font-bold text-white mb-1\">Multi-Language Storefronts</h4>\n  <p class=\"text-xs text-slate-400 leading-relaxed\">Products, categories, and checkout flows are fully translatable. Each language variant keeps its own prices and SEO metadata, and shares stock with its twins through the product SKU.</p>\n</div>\n</div>"},"block_type":"text"}]],"container_type":"container","responsive_columns":{"mobile":1,"tablet":1,"desktop":2},"vertical_alignment":"center"}$nbcm3en$::jsonb, 3),
+        (v_id, v_lang, 'section', $nbcm4en${"padding":{"top":"xl","bottom":"xl"},"background":{"type":"gradient","gradient":{"type":"linear","stops":[{"color":"#064e3b","position":0},{"color":"#022c22","position":100}],"direction":"135deg"}},"column_gap":"none","column_blocks":[[{"content":{"level":2,"textAlign":"center","textColor":"background","text_content":"Ready to launch your storefront?"},"block_type":"heading"},{"content":{"html_content":"<p class=\"text-center text-emerald-100 max-w-xl mx-auto mt-2 mb-6\">Start selling today with Commerce Pro. Multi-currency pricing, automatic tax, and shipping zones are ready out of the box, and the first 30 days are free.</p>"},"block_type":"text"},{"content":{"url":"https://nextblock.dev/product/nextblock-commerce-pro-commerce-license","size":"lg","text":"Start the 30-Day Free Trial","variant":"secondary","position":"center"},"block_type":"button"}]],"container_type":"container","responsive_columns":{"mobile":1,"tablet":1,"desktop":1},"vertical_alignment":"center"}$nbcm4en$::jsonb, 4);
+      UPDATE public.products
+         SET title = $t$NextBlock™ Commerce Pro - Commerce License$t$,
+             short_description = $t$NextBlock™ Commerce Pro turns your CMS into a storefront: products and variants, multi-currency pricing with daily rate sync, automatic tax through Stripe Tax, shipping zones, and checkout with Stripe or Freemius. Free for 30 days, no credit card.$t$,
+             meta_title = $t$NextBlock™ Commerce Pro | Next.js Storefront License$t$,
+             meta_description = $t$Sell products, licences and subscriptions from your Next.js site: multi-currency pricing, Stripe Tax, shipping zones, Stripe or Freemius checkout.$t$,
+             updated_at = now()
+       WHERE id = v_id;
+    ELSIF NOT EXISTS (SELECT 1 FROM public.blocks WHERE product_id = v_id AND content::text LIKE $t$%Days free, no card%$t$) THEN
+      RAISE NOTICE '02020: product nextblock-commerce-pro-commerce-license (en) differs from the shipped copy; left unchanged.';
+    END IF;
+  END IF;
+
+
+  -- French
+  v_id := NULL;
+  SELECT p.id, p.language_id INTO v_id, v_lang
+    FROM public.products AS p JOIN public.languages AS l ON l.id = p.language_id
+   WHERE p.slug = 'nextblock-commerce-pro-commerce-license-fr' AND l.code = 'fr'
+   ORDER BY p.id LIMIT 1;
+  IF v_id IS NOT NULL THEN
+    IF EXISTS (SELECT 1 FROM public.blocks WHERE product_id = v_id AND content::text LIKE $t$%Moteur E-Commerce d'Entreprise%$t$)
+       AND NOT EXISTS (SELECT 1 FROM public.blocks WHERE product_id = v_id AND content::text LIKE $t$%Jours gratuits, sans carte%$t$) THEN
+      DELETE FROM public.blocks WHERE product_id = v_id;
+      INSERT INTO public.blocks (product_id, language_id, block_type, content, "order") VALUES
+        (v_id, v_lang, 'section', $nbcm0fr${"padding":{"top":"xl","bottom":"xl"},"background":{"type":"gradient","gradient":{"type":"linear","stops":[{"color":"#022c22","position":0},{"color":"#064e3b","position":40},{"color":"#0f172a","position":100}],"direction":"135deg"}},"column_gap":"xl","column_blocks":[[{"content":{"html_content":"<p class=\"text-xs uppercase tracking-[0.3em] text-emerald-400 font-semibold mb-4\">Moteur E-Commerce d'Entreprise</p>\n<h2 class=\"text-3xl md:text-5xl font-extrabold text-white leading-tight mb-5\">Faites de Next.js une<br/>Boutique Mondiale.</h2>\n<p class=\"text-base md:text-lg text-slate-200 leading-relaxed mb-6\">Commerce Pro est un moteur composable pensé pour les développeurs : catalogues physiques, licences numériques et abonnements — le tout depuis votre stack Next.js existant. Essayez-le gratuitement pendant 30 jours, sans carte de crédit.</p>"},"block_type":"text"},{"content":{"url":"https://nextblock.dev/product/nextblock-commerce-pro-commerce-license-fr","size":"lg","text":"Obtenir Commerce Pro →","variant":"default","position":"left"},"block_type":"button"}],[{"content":{"html_content":"<div class=\"rounded-2xl border border-emerald-700 bg-slate-950 p-6 shadow-xl sm:p-8\">\n<h3 class=\"text-lg font-bold text-white mb-5\">Pourquoi choisir Commerce Pro</h3>\n<ul class=\"space-y-4 text-sm leading-relaxed text-slate-300\">\n  <li class=\"flex items-start gap-3\">\n    <span class=\"flex-shrink-0 w-6 h-6 rounded-full bg-emerald-950 flex items-center justify-center text-emerald-300 text-xs font-bold\">✓</span>\n    <span><strong class=\"text-white\">Multi-Devises</strong> — synchronisation quotidienne des taux de change, arrondis personnalisés et devise suggérée selon la langue du visiteur.</span>\n  </li>\n  <li class=\"flex items-start gap-3\">\n    <span class=\"flex-shrink-0 w-6 h-6 rounded-full bg-emerald-950 flex items-center justify-center text-emerald-300 text-xs font-bold\">✓</span>\n    <span><strong class=\"text-white\">Taxes automatisées</strong> — activez Stripe Tax et le paiement calcule et collecte la taxe pour vous, avec le détail conservé sur chaque commande.</span>\n  </li>\n  <li class=\"flex items-start gap-3\">\n    <span class=\"flex-shrink-0 w-6 h-6 rounded-full bg-emerald-950 flex items-center justify-center text-emerald-300 text-xs font-bold\">✓</span>\n    <span><strong class=\"text-white\">Gestion des Stocks</strong> — verrouillage de l'inventaire au checkout pour éviter les surventes, avec contrôle par variante.</span>\n  </li>\n  <li class=\"flex items-start gap-3\">\n    <span class=\"flex-shrink-0 w-6 h-6 rounded-full bg-emerald-950 flex items-center justify-center text-emerald-300 text-xs font-bold\">✓</span>\n    <span><strong class=\"text-white\">Zones d'expédition flexibles</strong> — tables de tarifs, seuils de livraison gratuite et règles par pays inclus.</span>\n  </li>\n</ul>\n</div>"},"block_type":"text"}]],"container_type":"container","responsive_columns":{"mobile":1,"tablet":1,"desktop":2},"vertical_alignment":"center"}$nbcm0fr$::jsonb, 0),
+        (v_id, v_lang, 'section', $nbcm1fr${"padding":{"top":"lg","bottom":"lg"},"background":{"type":"theme","theme":"muted"},"column_gap":"lg","column_blocks":[[{"content":{"html_content":"<p class=\"text-center\"><span class=\"block text-2xl font-extrabold text-foreground\">30</span><span class=\"text-xs text-muted-foreground uppercase tracking-wider\">Jours gratuits, sans carte</span></p>"},"block_type":"text"}],[{"content":{"html_content":"<p class=\"text-center\"><span class=\"block text-2xl font-extrabold text-foreground\">2</span><span class=\"text-xs text-muted-foreground uppercase tracking-wider\">Fournisseurs de paiement</span></p>"},"block_type":"text"}],[{"content":{"html_content":"<p class=\"text-center\"><span class=\"block text-2xl font-extrabold text-foreground\">Quotidienne</span><span class=\"text-xs text-muted-foreground uppercase tracking-wider\">Synchro des taux</span></p>"},"block_type":"text"}],[{"content":{"html_content":"<p class=\"text-center\"><span class=\"block text-2xl font-extrabold text-foreground\">EN + FR</span><span class=\"text-xs text-muted-foreground uppercase tracking-wider\">Boutiques liées</span></p>"},"block_type":"text"}]],"container_type":"container","responsive_columns":{"mobile":1,"tablet":2,"desktop":4},"vertical_alignment":"center"}$nbcm1fr$::jsonb, 1),
+        (v_id, v_lang, 'section', $nbcm2fr${"padding":{"top":"xl","bottom":"xl"},"background":{"type":"none"},"column_gap":"lg","column_blocks":[[{"content":{"html_content":"<div class=\"h-full rounded-2xl border border-slate-200 bg-white p-6 shadow-sm transition-colors hover:border-emerald-300 hover:bg-slate-50 dark:border-white/10 dark:bg-slate-950 dark:hover:border-emerald-500 sm:p-7\">\n<div class=\"mb-4 inline-flex h-10 w-10 items-center justify-center rounded-xl bg-emerald-50 text-emerald-700 dark:bg-emerald-950 dark:text-emerald-300\"><svg class=\"h-5 w-5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" viewBox=\"0 0 24 24\" aria-hidden=\"true\"><rect x=\"3\" y=\"5\" width=\"18\" height=\"14\" rx=\"2\"></rect><path d=\"M3 10h18M7 15h3\"></path></svg></div>\n<h4 class=\"text-base font-bold text-slate-900 dark:text-white mb-2\">Checkout Stripe Headless</h4>\n<p class=\"text-sm text-slate-600 dark:text-slate-300 leading-relaxed\">Création de sessions Stripe Checkout pour un ou plusieurs articles. Traitement automatique des commandes par webhooks avec protection d'idempotence.</p>\n</div>"},"block_type":"text"}],[{"content":{"html_content":"<div class=\"h-full rounded-2xl border border-slate-200 bg-white p-6 shadow-sm transition-colors hover:border-emerald-300 hover:bg-slate-50 dark:border-white/10 dark:bg-slate-950 dark:hover:border-emerald-500 sm:p-7\">\n<div class=\"mb-4 inline-flex h-10 w-10 items-center justify-center rounded-xl bg-emerald-50 text-emerald-700 dark:bg-emerald-950 dark:text-emerald-300\"><svg class=\"h-5 w-5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" viewBox=\"0 0 24 24\" aria-hidden=\"true\"><path d=\"M15 7a4 4 0 1 1-2.83 6.83L7 19H4v-3h3l2.17-2.17A4 4 0 0 1 15 7Z\"></path><path d=\"M17.5 8.5h.01\"></path></svg></div>\n<h4 class=\"text-base font-bold text-slate-900 dark:text-white mb-2\">Licences Numériques Freemius</h4>\n<p class=\"text-sm text-slate-600 dark:text-slate-300 leading-relaxed\">Distribuez vos logiciels, validez les clés de licence et gérez les périodes d'essai SaaS — aucune intégration tierce requise.</p>\n</div>"},"block_type":"text"}],[{"content":{"html_content":"<div class=\"h-full rounded-2xl border border-slate-200 bg-white p-6 shadow-sm transition-colors hover:border-emerald-300 hover:bg-slate-50 dark:border-white/10 dark:bg-slate-950 dark:hover:border-emerald-500 sm:p-7\">\n<div class=\"mb-4 inline-flex h-10 w-10 items-center justify-center rounded-xl bg-emerald-50 text-emerald-700 dark:bg-emerald-950 dark:text-emerald-300\"><svg class=\"h-5 w-5\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2\" viewBox=\"0 0 24 24\" aria-hidden=\"true\"><rect x=\"4\" y=\"5\" width=\"16\" height=\"14\" rx=\"2\"></rect><path d=\"m4 15 4-4 4 4 3-3 5 5\"></path><circle cx=\"15\" cy=\"9\" r=\"1\"></circle></svg></div>\n<h4 class=\"text-base font-bold text-slate-900 dark:text-white mb-2\">Merchandising Visuel</h4>\n<p class=\"text-sm text-slate-600 dark:text-slate-300 leading-relaxed\">Vos équipes éditoriales enrichissent les fiches produits de landing pages, promotions et galeries — directement dans l'éditeur de blocs.</p>\n</div>"},"block_type":"text"}]],"container_type":"container","responsive_columns":{"mobile":1,"tablet":2,"desktop":3},"vertical_alignment":"stretch"}$nbcm2fr$::jsonb, 2),
+        (v_id, v_lang, 'section', $nbcm3fr${"padding":{"top":"xl","bottom":"xl"},"background":{"type":"gradient","gradient":{"type":"linear","stops":[{"color":"#020617","position":0},{"color":"#0f172a","position":100}],"direction":"180deg"}},"column_gap":"xl","column_blocks":[[{"content":{"html_content":"<p class=\"text-xs uppercase tracking-[0.3em] text-emerald-400 font-semibold mb-4\">Sous le capot</p>\n<h3 class=\"text-2xl md:text-3xl font-extrabold text-white mb-4\">Conçu pour la production à grande échelle</h3>\n<p class=\"text-slate-300 leading-relaxed mb-5\">Commerce Pro a été conçu dès le départ pour les boutiques à fort trafic. Les pages de la boutique proviennent d'un cache de contenu public vidé dès la publication, chaque requête est indexée, et chaque gestionnaire de webhook est idempotent.</p>\n<ul class=\"space-y-3 text-sm text-slate-400\">\n  <li class=\"flex items-start gap-2.5\">\n    <span class=\"text-emerald-400\">→</span>\n    <span>Inventaire par variante avec déduction du stock sous verrou de ligne</span>\n  </li>\n  <li class=\"flex items-start gap-2.5\">\n    <span class=\"text-emerald-400\">→</span>\n    <span>Calcul automatique des zones d'expédition et tables de tarifs</span>\n  </li>\n  <li class=\"flex items-start gap-2.5\">\n    <span class=\"text-emerald-400\">→</span>\n    <span>Statut des commandes en temps réel via synchronisation Stripe webhook</span>\n  </li>\n  <li class=\"flex items-start gap-2.5\">\n    <span class=\"text-emerald-400\">→</span>\n    <span>Système d'attributs produits et de facettes filtrables</span>\n  </li>\n</ul>"},"block_type":"text"}],[{"content":{"html_content":"<div class=\"space-y-4\">\n<div class=\"p-5 rounded-xl border border-slate-700 bg-slate-900\">\n  <h4 class=\"text-sm font-bold text-white mb-1\">Gestion des commandes</h4>\n  <p class=\"text-xs text-slate-400 leading-relaxed\">Cycle de vie complet : du panier à la livraison. Transitions automatiques, factures imprimables et gestion des remboursements intégrées.</p>\n</div>\n<div class=\"p-5 rounded-xl border border-slate-700 bg-slate-900\">\n  <h4 class=\"text-sm font-bold text-white mb-1\">Catégories de produits</h4>\n  <p class=\"text-xs text-slate-400 leading-relaxed\">Taxonomie hiérarchique avec slugs, médias associés et support i18n complet. Les catégories sont gérées directement dans le tableau de bord du CMS.</p>\n</div>\n<div class=\"p-5 rounded-xl border border-slate-700 bg-slate-900\">\n  <h4 class=\"text-sm font-bold text-white mb-1\">Boutiques multilingues</h4>\n  <p class=\"text-xs text-slate-400 leading-relaxed\">Produits, catégories et flux de paiement entièrement traduisibles. Chaque variante linguistique garde ses propres prix et métadonnées SEO, et partage le stock avec ses jumelles grâce au SKU du produit.</p>\n</div>\n</div>"},"block_type":"text"}]],"container_type":"container","responsive_columns":{"mobile":1,"tablet":1,"desktop":2},"vertical_alignment":"center"}$nbcm3fr$::jsonb, 3),
+        (v_id, v_lang, 'section', $nbcm4fr${"padding":{"top":"xl","bottom":"xl"},"background":{"type":"gradient","gradient":{"type":"linear","stops":[{"color":"#064e3b","position":0},{"color":"#022c22","position":100}],"direction":"135deg"}},"column_gap":"none","column_blocks":[[{"content":{"level":2,"textAlign":"center","textColor":"background","text_content":"Prêt à lancer votre boutique ?"},"block_type":"heading"},{"content":{"html_content":"<p class=\"text-center text-emerald-100 max-w-xl mx-auto mt-2 mb-6\">Commencez à vendre dès aujourd'hui avec Commerce Pro. Prix multi-devises, taxes automatiques et zones de livraison sont prêts dès l'installation, et les 30 premiers jours sont gratuits.</p>"},"block_type":"text"},{"content":{"url":"https://nextblock.dev/product/nextblock-commerce-pro-commerce-license-fr","size":"lg","text":"Commencer l'essai gratuit de 30 jours","variant":"secondary","position":"center"},"block_type":"button"}]],"container_type":"container","responsive_columns":{"mobile":1,"tablet":1,"desktop":1},"vertical_alignment":"center"}$nbcm4fr$::jsonb, 4);
+      UPDATE public.products
+         SET title = $t$Licence NextBlock™ Commerce Pro$t$,
+             short_description = $t$NextBlock™ Commerce Pro transforme votre CMS en boutique : produits et variantes, prix multi-devises avec synchronisation quotidienne des taux, taxes automatiques via Stripe Tax, zones de livraison et paiement Stripe ou Freemius. Gratuit pendant 30 jours, sans carte de crédit.$t$,
+             meta_title = $t$NextBlock™ Commerce Pro | Licence boutique Next.js$t$,
+             meta_description = $t$Vendez produits, licences et abonnements depuis votre site Next.js : prix multi-devises, Stripe Tax, zones de livraison, paiement Stripe ou Freemius.$t$,
+             updated_at = now()
+       WHERE id = v_id;
+    ELSIF NOT EXISTS (SELECT 1 FROM public.blocks WHERE product_id = v_id AND content::text LIKE $t$%Jours gratuits, sans carte%$t$) THEN
+      RAISE NOTICE '02020: product nextblock-commerce-pro-commerce-license-fr (fr) differs from the shipped copy; left unchanged.';
+    END IF;
+  END IF;
+
+END
+$nb_02020_products$;

package/supabase/migrations/02021_profiles_staff_read_and_role_guard.sql

@@ -0,0 +1,362 @@
+-- 02021: profiles are readable by their owner and staff only, `role` is admin-only, and the
+-- revision tables are staff-only.
+--
+-- Reported 2026-10-17 and reproduced 2026-10-19 on a local replay of this folder. The baseline
+-- shipped three holes:
+--
+-- * profiles_read_policy was FOR SELECT USING (true) with no TO clause, so it applied to every
+--   role. The anon key that ships in the site bundle could list every account's full_name,
+--   phone, website, avatar_url and role (no e-mail: that stays in auth.users).
+-- * profiles_update_policy let any signed-in account update its own row with no column
+--   restriction, and nothing guarded `role`. One PATCH from a self-registered session set
+--   role = 'ADMIN'; get_current_user_role(), proxy.ts and app/cms/layout.tsx all trust that
+--   column, so the account became a full CMS admin.
+-- * page_revisions, post_revisions and product_revisions were FOR SELECT TO authenticated
+--   USING (true): any customer account could read every historical version of every page, post
+--   and product, published or not.
+--
+-- The fix:
+--
+-- 1. The role lookup moves to private.current_user_role(), a SECURITY DEFINER function in a
+--    schema PostgREST does not expose. Running as the table owner makes it independent of the
+--    profiles policies below, which now call it themselves (as SECURITY INVOKER it would only
+--    work because the OR in the new SELECT policy short-circuits on the caller's own row and a
+--    function with a SET clause is never inlined). public.get_current_user_role() and
+--    public.is_admin() keep their names and signatures as SECURITY INVOKER wrappers, so the
+--    150 policies that call them are untouched, and the Supabase advisor lints
+--    0028/0029 (SECURITY DEFINER function executable by anon/authenticated in an exposed
+--    schema) stay quiet: policies run with the querying role's rights, so anon, authenticated
+--    and service_role get USAGE on private and EXECUTE on the helper, but /rest/v1/rpc cannot
+--    reach it. Both helpers pin search_path.
+-- 2. profiles SELECT is TO authenticated: own row, or every row for ADMIN and WRITER (the users
+--    screen, author pickers, revision history, dashboard counts). anon reads nothing. The
+--    UPDATE policy keeps "own row or ADMIN", and its WITH CHECK pins `role` to its current
+--    value unless the caller is ADMIN.
+-- 3. A BEFORE UPDATE trigger rejects a role change made by a request that carries a user
+--    session (auth.uid() is set) unless that user is an ADMIN. It keys off the session, not
+--    the SQL role, so a future SECURITY DEFINER helper called from a USER session cannot
+--    slip past it. service_role and postgres carry no session: the users screen, /setup, the
+--    MCP route, the sandbox reset and migrations all write through them.
+-- 4. The three revision tables read for ADMIN and WRITER only. Their writers were already
+--    staff-only; no USER-role or anonymous code path reads them.
+-- 5. The public site still shows who wrote an approved review, comment or staff reply.
+--    ProductReviewsSection, PostCommentsSection and StaffReplies embed the name and avatar
+--    from the browser client, i.e. as anon, so that read moves off profiles onto author(): a
+--    PostgREST computed relationship on cms_interactions (`select=*,author(full_name,avatar_url)`)
+--    that returns id, full_name and avatar_url, and only for an interaction that is approved.
+--    Its row type is the profile_cards view, which is security_invoker: querying the view
+--    directly yields exactly what profiles allows the caller, nothing more.
+-- 6. user_security_settings loses its owner INSERT/UPDATE policies. evaluateTwoFactor()
+--    trusts mfa_enabled / mfa_type to decide whether /cms asks for a second factor, and the
+--    owner could rewrite both over REST with a first-factor-only session. The security
+--    actions verify the code or TOTP first and write through the service role.
+-- 7. Scheduled content stays private until its time. posts already checked published_at;
+--    pages and products now do too, and products no longer list draft or archived rows (nor
+--    their variants) to anyone but staff. The app already filtered these itself; the Data API
+--    did not.
+-- 8. generate_order_invoice_number() and assign_order_invoice_metadata() become service-role
+--    only (any visitor, or any account, could burn a number from order_invoice_number_seq per
+--    call; every real caller already goes through the service role), and anon loses EXECUTE
+--    on upsert_product_with_variants(), whose is_admin() guard is NULL without a session and
+--    relies on RLS. /setup's post-apply grant pass (lib/setup/schema-apply.ts) re-applies
+--    these revokes after its blanket grants.
+-- 9. TRUNCATE is revoked from anon and authenticated on every table: row-level security does
+--    not govern it, and no API role has a reason to hold it.
+-- 10. site_settings reads become an allow-list. The baseline denied seven secret keys and
+--    published everything else to the public key: staff notification addresses, the business
+--    invoice identity, SMTP host and sender, the 2FA posture, onboarding state, payment
+--    public config. Now anon reads the keys the public site renders or routes on
+--    (`is_admin_created` drives the /setup redirect in proxy.ts, `enabled_payment_providers`
+--    every Buy button); a signed-in customer additionally reads `invoice_settings` for their
+--    own invoices; ADMIN and WRITER read the keys the CMS shell loads; ADMIN reads
+--    everything, so a key a future feature adds is ADMIN-only until this policy lists it.
+--    Writes are unchanged.
+--
+-- Idempotent, and safe on a database that recorded the baseline without running it (docs/04 →
+-- "How a squash crosses live databases"): every SELECT policy on profiles is dropped by name
+-- from pg_policies before the replacement is created, so a generation-1 policy under another
+-- name cannot keep the table open.
+
+-- ---------------------------------------------------------------------------
+-- 1. Role helpers: owner-privileged lookup in a non-exposed schema, invoker wrappers in public
+-- ---------------------------------------------------------------------------
+CREATE SCHEMA IF NOT EXISTS private;
+REVOKE ALL ON SCHEMA private FROM PUBLIC;
+-- Policies evaluate with the querying role's rights, and policies without a TO clause run
+-- for anon too, so every API role can call the helper from inside a policy.
+GRANT USAGE ON SCHEMA private TO anon, authenticated, service_role;
+
+CREATE OR REPLACE FUNCTION private.current_user_role() RETURNS public.user_role
+    LANGUAGE sql STABLE SECURITY DEFINER
+    SET search_path TO ''
+    AS $$
+  SELECT role FROM public.profiles WHERE id = auth.uid();
+$$;
+
+REVOKE ALL ON FUNCTION private.current_user_role() FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION private.current_user_role() TO anon, authenticated, service_role;
+
+-- Same names, same signatures, same NULL-without-a-session semantics as the baseline.
+CREATE OR REPLACE FUNCTION public.get_current_user_role() RETURNS public.user_role
+    LANGUAGE sql STABLE SECURITY INVOKER
+    SET search_path TO 'public'
+    AS $$
+  SELECT private.current_user_role();
+$$;
+
+CREATE OR REPLACE FUNCTION public.is_admin() RETURNS boolean
+    LANGUAGE sql STABLE SECURITY INVOKER
+    SET search_path TO 'public'
+    AS $$
+  SELECT private.current_user_role() = 'ADMIN'::public.user_role;
+$$;
+
+REVOKE ALL ON FUNCTION public.get_current_user_role() FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.get_current_user_role() TO anon, authenticated, service_role;
+REVOKE ALL ON FUNCTION public.is_admin() FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.is_admin() TO anon, authenticated, service_role;
+
+-- ---------------------------------------------------------------------------
+-- 2. profiles: own row or staff reads, no anon, role pinned for non-admins
+-- ---------------------------------------------------------------------------
+DO $$
+DECLARE p record;
+BEGIN
+  FOR p IN
+    SELECT policyname FROM pg_policies
+    WHERE schemaname = 'public' AND tablename = 'profiles' AND cmd = 'SELECT'
+  LOOP
+    EXECUTE format('DROP POLICY IF EXISTS %I ON public.profiles', p.policyname);
+  END LOOP;
+END $$;
+
+CREATE POLICY profiles_read_policy ON public.profiles
+  FOR SELECT TO authenticated
+  USING (
+    id = (SELECT auth.uid())
+    OR (SELECT public.get_current_user_role()) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role])
+  );
+
+DROP POLICY IF EXISTS profiles_update_policy ON public.profiles;
+CREATE POLICY profiles_update_policy ON public.profiles
+  FOR UPDATE TO authenticated
+  USING (
+    id = (SELECT auth.uid())
+    OR (SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role
+  )
+  WITH CHECK (
+    (SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role
+    OR (id = (SELECT auth.uid()) AND role = (SELECT public.get_current_user_role()))
+  );
+
+-- ---------------------------------------------------------------------------
+-- 3. role changes from a user session are admin-only (backstop for the policy above)
+-- ---------------------------------------------------------------------------
+CREATE OR REPLACE FUNCTION public.protect_profile_role() RETURNS trigger
+    LANGUAGE plpgsql
+    SET search_path TO 'public'
+    AS $$
+BEGIN
+  IF NEW.role IS DISTINCT FROM OLD.role
+     AND auth.uid() IS NOT NULL
+     AND (SELECT public.get_current_user_role()) IS DISTINCT FROM 'ADMIN'::public.user_role
+  THEN
+    RAISE EXCEPTION 'Only an administrator can change a user''s role'
+      USING ERRCODE = 'insufficient_privilege';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+-- Trigger functions are never called by API roles (02013).
+REVOKE ALL ON FUNCTION public.protect_profile_role() FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.protect_profile_role() TO service_role;
+
+DROP TRIGGER IF EXISTS protect_profile_role ON public.profiles;
+CREATE TRIGGER protect_profile_role
+  BEFORE UPDATE ON public.profiles
+  FOR EACH ROW
+  WHEN (OLD.role IS DISTINCT FROM NEW.role)
+  EXECUTE FUNCTION public.protect_profile_role();
+
+-- ---------------------------------------------------------------------------
+-- 4. Revision tables: staff read only
+-- ---------------------------------------------------------------------------
+DROP POLICY IF EXISTS page_revisions_read_policy ON public.page_revisions;
+CREATE POLICY page_revisions_read_policy ON public.page_revisions
+  FOR SELECT TO authenticated
+  USING (
+    (SELECT public.get_current_user_role()) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role])
+  );
+
+DROP POLICY IF EXISTS post_revisions_read_policy ON public.post_revisions;
+CREATE POLICY post_revisions_read_policy ON public.post_revisions
+  FOR SELECT TO authenticated
+  USING (
+    (SELECT public.get_current_user_role()) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role])
+  );
+
+DROP POLICY IF EXISTS product_revisions_read_policy ON public.product_revisions;
+CREATE POLICY product_revisions_read_policy ON public.product_revisions
+  FOR SELECT TO authenticated
+  USING (
+    (SELECT public.get_current_user_role()) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role])
+  );
+
+-- ---------------------------------------------------------------------------
+-- 5. Public author card: cms_interactions?select=*,author(full_name,avatar_url)
+-- ---------------------------------------------------------------------------
+CREATE OR REPLACE VIEW public.profile_cards
+  WITH (security_invoker = true) AS
+  SELECT id, full_name, avatar_url FROM public.profiles;
+
+GRANT SELECT ON public.profile_cards TO anon, authenticated, service_role;
+
+-- One card per interaction row the caller can already see. The EXISTS re-reads the row so a
+-- hand-built argument cannot turn the function into a name lookup for arbitrary ids. The
+-- owner-privileged read lives in private (advisor lints 0028/0029, as in section 1); the
+-- public function is the invoker wrapper PostgREST embeds as a computed relationship.
+CREATE OR REPLACE FUNCTION private.author_card(p_interaction_id uuid, p_user_id uuid)
+    RETURNS SETOF public.profile_cards ROWS 1
+    LANGUAGE sql STABLE SECURITY DEFINER
+    SET search_path TO ''
+    AS $$
+  SELECT p.id, p.full_name, p.avatar_url
+  FROM public.profiles p
+  WHERE p.id = p_user_id
+    AND EXISTS (
+      SELECT 1 FROM public.cms_interactions ci
+      WHERE ci.id = p_interaction_id
+        AND ci.user_id = p_user_id
+        AND ci.status = 'approved'::public.approval_status
+    );
+$$;
+
+REVOKE ALL ON FUNCTION private.author_card(uuid, uuid) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION private.author_card(uuid, uuid) TO anon, authenticated, service_role;
+
+CREATE OR REPLACE FUNCTION public.author(public.cms_interactions)
+    RETURNS SETOF public.profile_cards ROWS 1
+    LANGUAGE sql STABLE SECURITY INVOKER
+    SET search_path TO 'public'
+    AS $$
+  SELECT * FROM private.author_card($1.id, $1.user_id);
+$$;
+
+REVOKE ALL ON FUNCTION public.author(public.cms_interactions) FROM PUBLIC;
+GRANT EXECUTE ON FUNCTION public.author(public.cms_interactions) TO anon, authenticated, service_role;
+
+-- ---------------------------------------------------------------------------
+-- 6. user_security_settings: written by the server only, read by its owner
+-- ---------------------------------------------------------------------------
+DROP POLICY IF EXISTS user_security_settings_insert_own_policy ON public.user_security_settings;
+DROP POLICY IF EXISTS user_security_settings_update_own_policy ON public.user_security_settings;
+
+-- ---------------------------------------------------------------------------
+-- 7. Scheduled, draft and archived content is staff-only until it is live
+-- ---------------------------------------------------------------------------
+DROP POLICY IF EXISTS pages_anon_read_policy ON public.pages;
+CREATE POLICY pages_anon_read_policy ON public.pages
+  FOR SELECT TO anon
+  USING (
+    status = 'published'::public.page_status
+    AND (published_at IS NULL OR published_at <= now())
+  );
+
+DROP POLICY IF EXISTS pages_read_policy ON public.pages;
+CREATE POLICY pages_read_policy ON public.pages
+  FOR SELECT TO authenticated
+  USING (
+    (status = 'published'::public.page_status AND (published_at IS NULL OR published_at <= now()))
+    OR (author_id = (SELECT auth.uid()) AND status <> 'published'::public.page_status)
+    OR (SELECT public.get_current_user_role()) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role])
+  );
+
+DROP POLICY IF EXISTS "Public can view products" ON public.products;
+CREATE POLICY "Public can view products" ON public.products
+  FOR SELECT TO anon, authenticated
+  USING (
+    (status = 'active' AND (published_at IS NULL OR published_at <= now()))
+    OR (SELECT public.get_current_user_role()) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role])
+  );
+
+DROP POLICY IF EXISTS "Public read product_variants" ON public.product_variants;
+CREATE POLICY "Public read product_variants" ON public.product_variants
+  FOR SELECT TO anon, authenticated
+  USING (
+    EXISTS (
+      SELECT 1 FROM public.products p
+      WHERE p.id = product_variants.product_id
+        AND p.status = 'active'
+        AND (p.published_at IS NULL OR p.published_at <= now())
+    )
+    OR (SELECT public.get_current_user_role()) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role])
+  );
+
+-- ---------------------------------------------------------------------------
+-- 8. Invoice numbering and the product upsert are not public RPCs
+-- ---------------------------------------------------------------------------
+REVOKE EXECUTE ON FUNCTION public.generate_order_invoice_number() FROM PUBLIC, anon, authenticated;
+REVOKE EXECUTE ON FUNCTION public.assign_order_invoice_metadata(uuid, timestamp with time zone) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON SEQUENCE public.order_invoice_number_seq FROM anon, authenticated;
+REVOKE EXECUTE ON FUNCTION public.upsert_product_with_variants(jsonb) FROM PUBLIC, anon;
+
+-- ---------------------------------------------------------------------------
+-- 9. API roles never truncate
+-- ---------------------------------------------------------------------------
+REVOKE TRUNCATE ON ALL TABLES IN SCHEMA public FROM anon, authenticated;
+
+-- ---------------------------------------------------------------------------
+-- 10. site_settings: read tiers instead of a deny-list
+-- ---------------------------------------------------------------------------
+-- Every SELECT policy goes, by name, so a generation-1 policy under another name cannot keep
+-- the table open (same reasoning as profiles above).
+DO $$
+DECLARE p record;
+BEGIN
+  FOR p IN
+    SELECT policyname FROM pg_policies
+    WHERE schemaname = 'public' AND tablename = 'site_settings' AND cmd = 'SELECT'
+  LOOP
+    EXECUTE format('DROP POLICY IF EXISTS %I ON public.site_settings', p.policyname);
+  END LOOP;
+END $$;
+
+-- Keys the public site renders or routes on. Each one has an anonymous reader:
+-- app/lib/site-settings.ts, app/layout.tsx, proxy.ts (language detection, is_admin_created),
+-- app/robots.txt, app/llms.txt, components/BlockRenderer.tsx (bot protection), the logo
+-- loader, libs/ecommerce payments/queries.ts and tax-calculation.ts, and the history-repair
+-- tool's anon fallback for migration_baseline_generation.
+CREATE POLICY site_settings_anon_read_policy ON public.site_settings
+  FOR SELECT TO anon
+  USING (
+    key = ANY (ARRAY[
+      'site_title', 'site_description', 'site_keywords', 'site_social_image',
+      'footer_copyright', 'footer_show_attribution', 'global_css',
+      'language_detection_settings', 'seo_robots_settings', 'bot_protection_public',
+      'active_logo_id', 'is_admin_created', 'privacy_settings',
+      'enabled_payment_providers', 'ecommerce_inventory_settings',
+      'migration_baseline_generation'
+    ])
+  );
+
+CREATE POLICY site_settings_read_policy ON public.site_settings
+  FOR SELECT TO authenticated
+  USING (
+    key = ANY (ARRAY[
+      'site_title', 'site_description', 'site_keywords', 'site_social_image',
+      'footer_copyright', 'footer_show_attribution', 'global_css',
+      'language_detection_settings', 'seo_robots_settings', 'bot_protection_public',
+      'active_logo_id', 'is_admin_created', 'privacy_settings',
+      'enabled_payment_providers', 'ecommerce_inventory_settings',
+      'migration_baseline_generation',
+      -- a customer's own invoice carries the seller block (libs/ecommerce invoice-server.ts)
+      'invoice_settings'
+    ])
+    OR (
+      -- loaded by the CMS shell and dashboard for every staff role
+      key = ANY (ARRAY['security_settings', 'onboarding_state', 'email_public', 'cortex_ai_site_brief'])
+      AND (SELECT public.get_current_user_role()) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role])
+    )
+    OR (SELECT public.get_current_user_role()) = 'ADMIN'::public.user_role
+  );