@nextblock-cms/db 0.22.0 → 0.22.1

package/lib/supabase/types.d.ts

@@ -3,7 +3,7 @@ export type Json = string | number | boolean | null | {
 } | Json[];
 export type Database = {
     __InternalSupabase: {
-        PostgrestVersion: "14.5";
+        PostgrestVersion: "14.1";
     };
     public: {
         Tables: {
@@ -119,6 +119,11 @@ export type Database = {
                     type: Database["public"]["Enums"]["interaction_type"];
                     updated_at: string;
                     user_id: string;
+                    author: {
+                        avatar_url: string | null;
+                        full_name: string | null;
+                        id: string | null;
+                    } | null;
                 };
                 Insert: {
                     content: string;
@@ -170,6 +175,13 @@ export type Database = {
                         referencedRelation: "products";
                         referencedColumns: ["id"];
                     },
+                    {
+                        foreignKeyName: "cms_interactions_user_id_profiles_fkey";
+                        columns: ["user_id"];
+                        isOneToOne: false;
+                        referencedRelation: "profile_cards";
+                        referencedColumns: ["id"];
+                    },
                     {
                         foreignKeyName: "cms_interactions_user_id_profiles_fkey";
                         columns: ["user_id"];
@@ -244,6 +256,13 @@ export type Database = {
                     updated_at?: string;
                 };
                 Relationships: [
+                    {
+                        foreignKeyName: "content_drafts_author_id_fkey";
+                        columns: ["author_id"];
+                        isOneToOne: false;
+                        referencedRelation: "profile_cards";
+                        referencedColumns: ["id"];
+                    },
                     {
                         foreignKeyName: "content_drafts_author_id_fkey";
                         columns: ["author_id"];
@@ -297,6 +316,13 @@ export type Database = {
                     tool_name?: string;
                 };
                 Relationships: [
+                    {
+                        foreignKeyName: "cortex_ai_db_mutation_audit_actor_user_id_fkey";
+                        columns: ["actor_user_id"];
+                        isOneToOne: false;
+                        referencedRelation: "profile_cards";
+                        referencedColumns: ["id"];
+                    },
                     {
                         foreignKeyName: "cortex_ai_db_mutation_audit_actor_user_id_fkey";
                         columns: ["actor_user_id"];
@@ -306,6 +332,27 @@ export type Database = {
                     }
                 ];
             };
+            cortex_request_log: {
+                Row: {
+                    created_at: string;
+                    id: string;
+                    route: string;
+                    user_id: string;
+                };
+                Insert: {
+                    created_at?: string;
+                    id?: string;
+                    route: string;
+                    user_id: string;
+                };
+                Update: {
+                    created_at?: string;
+                    id?: string;
+                    route?: string;
+                    user_id?: string;
+                };
+                Relationships: [];
+            };
             coupon_freemius_mappings: {
                 Row: {
                     coupon_id: string;
@@ -596,6 +643,7 @@ export type Database = {
             };
             email_2fa_challenges: {
                 Row: {
+                    attempts: number;
                     consumed_at: string | null;
                     created_at: string;
                     expires_at: string;
@@ -604,6 +652,7 @@ export type Database = {
                     user_id: string;
                 };
                 Insert: {
+                    attempts?: number;
                     consumed_at?: string | null;
                     created_at?: string;
                     expires_at: string;
@@ -612,6 +661,7 @@ export type Database = {
                     user_id: string;
                 };
                 Update: {
+                    attempts?: number;
                     consumed_at?: string | null;
                     created_at?: string;
                     expires_at?: string;
@@ -908,6 +958,13 @@ export type Database = {
                     width?: number | null;
                 };
                 Relationships: [
+                    {
+                        foreignKeyName: "media_uploader_id_fkey";
+                        columns: ["uploader_id"];
+                        isOneToOne: false;
+                        referencedRelation: "profile_cards";
+                        referencedColumns: ["id"];
+                    },
                     {
                         foreignKeyName: "media_uploader_id_fkey";
                         columns: ["uploader_id"];
@@ -1274,6 +1331,13 @@ export type Database = {
                     version?: number;
                 };
                 Relationships: [
+                    {
+                        foreignKeyName: "page_revisions_author_id_fkey";
+                        columns: ["author_id"];
+                        isOneToOne: false;
+                        referencedRelation: "profile_cards";
+                        referencedColumns: ["id"];
+                    },
                     {
                         foreignKeyName: "page_revisions_author_id_fkey";
                         columns: ["author_id"];
@@ -1343,6 +1407,13 @@ export type Database = {
                     version?: number;
                 };
                 Relationships: [
+                    {
+                        foreignKeyName: "pages_author_id_fkey";
+                        columns: ["author_id"];
+                        isOneToOne: false;
+                        referencedRelation: "profile_cards";
+                        referencedColumns: ["id"];
+                    },
                     {
                         foreignKeyName: "pages_author_id_fkey";
                         columns: ["author_id"];
@@ -1395,6 +1466,13 @@ export type Database = {
                     version?: number;
                 };
                 Relationships: [
+                    {
+                        foreignKeyName: "post_revisions_author_id_fkey";
+                        columns: ["author_id"];
+                        isOneToOne: false;
+                        referencedRelation: "profile_cards";
+                        referencedColumns: ["id"];
+                    },
                     {
                         foreignKeyName: "post_revisions_author_id_fkey";
                         columns: ["author_id"];
@@ -1473,6 +1551,13 @@ export type Database = {
                     version?: number;
                 };
                 Relationships: [
+                    {
+                        foreignKeyName: "posts_author_id_fkey";
+                        columns: ["author_id"];
+                        isOneToOne: false;
+                        referencedRelation: "profile_cards";
+                        referencedColumns: ["id"];
+                    },
                     {
                         foreignKeyName: "posts_author_id_fkey";
                         columns: ["author_id"];
@@ -1650,6 +1735,13 @@ export type Database = {
                     updated_at?: string;
                 };
                 Relationships: [
+                    {
+                        foreignKeyName: "product_drafts_author_id_fkey";
+                        columns: ["author_id"];
+                        isOneToOne: false;
+                        referencedRelation: "profile_cards";
+                        referencedColumns: ["id"];
+                    },
                     {
                         foreignKeyName: "product_drafts_author_id_fkey";
                         columns: ["author_id"];
@@ -1841,6 +1933,13 @@ export type Database = {
                     version?: number;
                 };
                 Relationships: [
+                    {
+                        foreignKeyName: "product_revisions_author_id_fkey";
+                        columns: ["author_id"];
+                        isOneToOne: false;
+                        referencedRelation: "profile_cards";
+                        referencedColumns: ["id"];
+                    },
                     {
                         foreignKeyName: "product_revisions_author_id_fkey";
                         columns: ["author_id"];
@@ -2509,6 +2608,7 @@ export type Database = {
             };
             ucp_cart_sessions: {
                 Row: {
+                    access_token_hash: string | null;
                     attribution: Json;
                     buyer_identity: Json;
                     checkout_url: string | null;
@@ -2526,6 +2626,7 @@ export type Database = {
                     updated_at: string;
                 };
                 Insert: {
+                    access_token_hash?: string | null;
                     attribution?: Json;
                     buyer_identity?: Json;
                     checkout_url?: string | null;
@@ -2543,6 +2644,7 @@ export type Database = {
                     updated_at?: string;
                 };
                 Update: {
+                    access_token_hash?: string | null;
                     attribution?: Json;
                     buyer_identity?: Json;
                     checkout_url?: string | null;
@@ -2611,6 +2713,13 @@ export type Database = {
                     user_id?: string;
                 };
                 Relationships: [
+                    {
+                        foreignKeyName: "user_addresses_user_id_fkey";
+                        columns: ["user_id"];
+                        isOneToOne: false;
+                        referencedRelation: "profile_cards";
+                        referencedColumns: ["id"];
+                    },
                     {
                         foreignKeyName: "user_addresses_user_id_fkey";
                         columns: ["user_id"];
@@ -2700,7 +2809,24 @@ export type Database = {
             };
         };
         Views: {
-            [_ in never]: never;
+            profile_cards: {
+                Row: {
+                    avatar_url: string | null;
+                    full_name: string | null;
+                    id: string | null;
+                };
+                Insert: {
+                    avatar_url?: string | null;
+                    full_name?: string | null;
+                    id?: string | null;
+                };
+                Update: {
+                    avatar_url?: string | null;
+                    full_name?: string | null;
+                    id?: string | null;
+                };
+                Relationships: [];
+            };
         };
         Functions: {
             apply_order_inventory_deduction: {
@@ -2719,6 +2845,28 @@ export type Database = {
                     paid_at: string;
                 }[];
             };
+            author: {
+                Args: {
+                    "": Database["public"]["Tables"]["cms_interactions"]["Row"];
+                };
+                Returns: {
+                    avatar_url: string | null;
+                    full_name: string | null;
+                    id: string | null;
+                };
+                SetofOptions: {
+                    from: "cms_interactions";
+                    to: "profile_cards";
+                    isOneToOne: true;
+                    isSetofReturn: true;
+                };
+            };
+            bump_email_2fa_attempts: {
+                Args: {
+                    p_user_id: string;
+                };
+                Returns: number;
+            };
             clear_currency_price_overrides: {
                 Args: {
                     target_currency: string;
@@ -2777,6 +2925,10 @@ export type Database = {
                 Args: never;
                 Returns: boolean;
             };
+            is_admin_mfa: {
+                Args: never;
+                Returns: boolean;
+            };
             is_valid_currency_amount_map: {
                 Args: {
                     amounts: Json;
@@ -2808,6 +2960,12 @@ export type Database = {
                 };
                 Returns: Json;
             };
+            redeem_coupon_atomically: {
+                Args: {
+                    p_coupon_id: string;
+                };
+                Returns: boolean;
+            };
             sync_inventory_cache_for_sku: {
                 Args: {
                     p_sku: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextblock-cms/db",
-  "version": "0.22.0",
+  "version": "0.22.1",
   "license": "AGPL-3.0-or-later",
   "repository": {
     "type": "git",

package/supabase/functions/nextblock-migration-ingest/index.ts

@@ -7,6 +7,58 @@ const corsHeaders = {
   'Access-Control-Allow-Headers': 'authorization, x-client-info, apikey, content-type',
 };
 
+/**
+ * Dedicated bearer for this function. It runs with the service-role key (which bypasses RLS) and
+ * can wipe content, mint confirmed users and fetch arbitrary URLs, so it must NEVER be reachable
+ * with the public anon JWT (the platform `verify_jwt` default accepts the anon key, which ships in
+ * every site bundle). The operator sets MIGRATION_INGEST_BEARER to a high-entropy secret that is
+ * NOT the anon or service key; the function is fail-closed — with the var unset it rejects every
+ * request, because this is a maintainer migration tool, not a public endpoint.
+ */
+function isAuthorizedIngestRequest(req: Request): boolean {
+  const expected = (Deno.env.get('MIGRATION_INGEST_BEARER') ?? '').trim();
+  if (!expected) return false;
+  const provided = (req.headers.get('Authorization') ?? '').replace(/^Bearer\s+/i, '').trim();
+  if (!provided || provided.length !== expected.length) return false;
+  // constant-time compare
+  let diff = 0;
+  for (let i = 0; i < expected.length; i += 1) diff |= provided.charCodeAt(i) ^ expected.charCodeAt(i);
+  return diff === 0;
+}
+
+/**
+ * SSRF guard for the outbound media fetch. Blocks obvious private, loopback, link-local and
+ * cloud-metadata destinations and requires http(s). Defence in depth behind the bearer: an
+ * authorized caller still should not be able to turn this into an internal port scanner or a
+ * cloud-credential exfiltrator. (DNS rebinding is further limited by redirect:'error' on the
+ * fetch; full rebind protection would require pinning the resolved IP, which the edge runtime
+ * does not expose.)
+ */
+function isBlockedFetchTarget(rawUrl: string): boolean {
+  let u: URL;
+  try {
+    u = new URL(rawUrl);
+  } catch {
+    return true;
+  }
+  if (u.protocol !== 'http:' && u.protocol !== 'https:') return true;
+  const host = u.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+  if (host === 'localhost' || host.endsWith('.localhost') || host.endsWith('.internal')) return true;
+  // IPv6 loopback / link-local / unique-local
+  if (host === '::1' || host.startsWith('fe80:') || host.startsWith('fc') || host.startsWith('fd')) return true;
+  // IPv4 literals in private / loopback / link-local / metadata ranges
+  const m = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (m) {
+    const [a, b] = [Number(m[1]), Number(m[2])];
+    if (a === 10 || a === 127 || a === 0) return true;
+    if (a === 169 && b === 254) return true; // link-local incl. 169.254.169.254 metadata
+    if (a === 172 && b >= 16 && b <= 31) return true;
+    if (a === 192 && b === 168) return true;
+    if (a === 100 && b >= 64 && b <= 127) return true; // CGNAT
+  }
+  return false;
+}
+
 // Upload S3 / R2 Proxy Handler
 async function processMediaUpload(url: string, r2Config: any, warnings: string[]): Promise<{ publicUrl: string; objectKey: string; contentType: string } | null> {
    if (!r2Config || !r2Config.account_id) {
@@ -37,11 +89,15 @@ async function processMediaUpload(url: string, r2Config: any, warnings: string[]
            const extension = contentType.split('/')[1] || 'jpg';
            filename = `upload_${crypto.randomUUID()}.${extension}`;
        } else {
+           if (isBlockedFetchTarget(url)) {
+               warnings.push(`Refused to fetch blocked/internal URL: ${url}`);
+               return null;
+           }
            const controller = new AbortController();
            const timeoutId = setTimeout(() => controller.abort(), 6000); // 6-second timeout
            let fileResponse;
            try {
-               fileResponse = await fetch(url, { signal: controller.signal });
+               fileResponse = await fetch(url, { signal: controller.signal, redirect: 'error' });
                clearTimeout(timeoutId);
            } catch (err: any) {
                clearTimeout(timeoutId);
@@ -91,6 +147,13 @@ Deno.serve(async (req: Request) => {
     return new Response('ok', { headers: corsHeaders });
   }
 
+  if (!isAuthorizedIngestRequest(req)) {
+    return new Response(JSON.stringify({ error: 'Unauthorized' }), {
+      headers: { ...corsHeaders, 'Content-Type': 'application/json', 'WWW-Authenticate': 'Bearer' },
+      status: 401,
+    });
+  }
+
   try {
     const supabaseClient = createClient(
       Deno.env.get('SUPABASE_URL') ?? '',