@nextblock-cms/db 0.22.0 → 0.22.2

package/supabase/migrations/02023_aal2_for_orders_profiles_site_settings.sql

@@ -0,0 +1,171 @@
+-- 02023: the second factor inside RLS reaches the last ADMIN-only rows: orders, order_items,
+-- profiles (other accounts' rows, admin writes) and the ADMIN tier of site_settings.
+--
+-- 02022 (sections 5 and 14) introduced public.is_admin_mfa() -- ADMIN, and an aal2 session
+-- whenever the account has a verified MFA factor; an admin who never enrolled one always
+-- passes -- and applied it where the app never reads with the cookie client (mcp_access_tokens,
+-- package_activations, coupons, coupon_redemptions). It deliberately left orders, order_items,
+-- profiles and the site_settings secret tier on the plain public.is_admin() check: the CMS read
+-- them with the cookie-scoped client, and an ADMIN who signed in with "remember this device"
+-- passes the app's own 2FA gate (proxy.ts / app/cms/layout.tsx) while the Supabase session
+-- stays aal1, so gating those rows would have emptied the admin's own screens.
+--
+-- Those reads and writes now go through the service-role client after an in-code role check
+-- (apps/nextblock/lib/auth/cms-actor.ts; libs/ecommerce .../server-actions/require-ecom-role.ts;
+-- docs/04 "Row Level Security Patterns"), so this migration can put is_admin_mfa() in every
+-- ADMIN branch of those tables. DB-side effect: an ADMIN session JWT carrying only a first
+-- factor, used directly against PostgREST, reaches no order, no other account's profile row and
+-- no setting above the staff tier, and cannot write any of them. Nothing else moves:
+--
+--   * owner semantics are unchanged: a customer still reads their own orders and order items,
+--     every signed-in account still reads and edits its own profile row (role pinned, exactly
+--     as 02021 left it);
+--   * WRITER is unchanged: still reads every profiles row (02021), still nothing on orders,
+--     still the public + staff tiers of site_settings and nothing above them;
+--   * the anon read policy on site_settings is untouched, and the staff-tier keys stay
+--     readable and the non-sensitive keys writable by an aal1 ADMIN (the ADMIN branch only
+--     governs what lies above the staff tier);
+--   * user_addresses has no ADMIN policy at all (owner + service role), so there is nothing
+--     to gate there;
+--   * the service-role policies are untouched.
+--
+-- Every policy is dropped by name and recreated, so the file is idempotent and re-runnable.
+-- tools/scripts/security-verify.sql (sections 13-17) checks every assertion above.
+
+-- ---------------------------------------------------------------------------
+-- 1. orders: ADMIN branch requires the second factor; owner branch unchanged
+-- ---------------------------------------------------------------------------
+DROP POLICY IF EXISTS "Users can view own orders" ON public.orders;
+CREATE POLICY "Users can view own orders" ON public.orders
+  FOR SELECT TO authenticated
+  USING (((SELECT public.is_admin_mfa()) IS TRUE) OR (user_id = (SELECT auth.uid())));
+
+DROP POLICY IF EXISTS orders_insert_policy ON public.orders;
+CREATE POLICY orders_insert_policy ON public.orders
+  FOR INSERT TO authenticated
+  WITH CHECK (((SELECT public.is_admin_mfa()) IS TRUE));
+
+DROP POLICY IF EXISTS orders_update_policy ON public.orders;
+CREATE POLICY orders_update_policy ON public.orders
+  FOR UPDATE TO authenticated
+  USING (((SELECT public.is_admin_mfa()) IS TRUE))
+  WITH CHECK (((SELECT public.is_admin_mfa()) IS TRUE));
+
+DROP POLICY IF EXISTS orders_delete_policy ON public.orders;
+CREATE POLICY orders_delete_policy ON public.orders
+  FOR DELETE TO authenticated
+  USING (((SELECT public.is_admin_mfa()) IS TRUE));
+
+-- ---------------------------------------------------------------------------
+-- 2. order_items: same shape; the owner branch still walks through the parent order
+-- ---------------------------------------------------------------------------
+DROP POLICY IF EXISTS "Users can view own order items" ON public.order_items;
+CREATE POLICY "Users can view own order items" ON public.order_items
+  FOR SELECT TO authenticated
+  USING (
+    ((SELECT public.is_admin_mfa()) IS TRUE)
+    OR EXISTS (
+      SELECT 1 FROM public.orders
+      WHERE orders.id = order_items.order_id
+        AND orders.user_id = (SELECT auth.uid())
+    )
+  );
+
+DROP POLICY IF EXISTS order_items_insert_policy ON public.order_items;
+CREATE POLICY order_items_insert_policy ON public.order_items
+  FOR INSERT TO authenticated
+  WITH CHECK (((SELECT public.is_admin_mfa()) IS TRUE));
+
+DROP POLICY IF EXISTS order_items_update_policy ON public.order_items;
+CREATE POLICY order_items_update_policy ON public.order_items
+  FOR UPDATE TO authenticated
+  USING (((SELECT public.is_admin_mfa()) IS TRUE))
+  WITH CHECK (((SELECT public.is_admin_mfa()) IS TRUE));
+
+DROP POLICY IF EXISTS order_items_delete_policy ON public.order_items;
+CREATE POLICY order_items_delete_policy ON public.order_items
+  FOR DELETE TO authenticated
+  USING (((SELECT public.is_admin_mfa()) IS TRUE));
+
+-- ---------------------------------------------------------------------------
+-- 3. profiles: own row as before, WRITER as before (02021), ADMIN needs the second factor
+-- ---------------------------------------------------------------------------
+-- 02021 wrote the staff branch as "role IN (ADMIN, WRITER)". It is split here so that the
+-- WRITER half keeps its plain role check (unchanged visibility for a content role) while the
+-- ADMIN half goes through is_admin_mfa(). The helpers run as the table owner (private schema,
+-- SECURITY DEFINER), so a policy on profiles itself may call them without recursion.
+DROP POLICY IF EXISTS profiles_read_policy ON public.profiles;
+CREATE POLICY profiles_read_policy ON public.profiles
+  FOR SELECT TO authenticated
+  USING (
+    (id = (SELECT auth.uid()))
+    OR ((SELECT public.get_current_user_role()) = 'WRITER'::public.user_role)
+    OR ((SELECT public.is_admin_mfa()) IS TRUE)
+  );
+
+DROP POLICY IF EXISTS profiles_insert_policy ON public.profiles;
+CREATE POLICY profiles_insert_policy ON public.profiles
+  FOR INSERT TO authenticated
+  WITH CHECK (((SELECT public.is_admin_mfa()) IS TRUE));
+
+-- An account edits its own row with `role` pinned to its current value (02021); an ADMIN on a
+-- satisfied second factor edits any row. The protect_profile_role trigger stays behind both.
+DROP POLICY IF EXISTS profiles_update_policy ON public.profiles;
+CREATE POLICY profiles_update_policy ON public.profiles
+  FOR UPDATE TO authenticated
+  USING ((id = (SELECT auth.uid())) OR ((SELECT public.is_admin_mfa()) IS TRUE))
+  WITH CHECK (
+    ((SELECT public.is_admin_mfa()) IS TRUE)
+    OR ((id = (SELECT auth.uid())) AND (role = (SELECT public.get_current_user_role())))
+  );
+
+-- ---------------------------------------------------------------------------
+-- 4. site_settings: the ADMIN tier (reads above staff, writes of the sensitive keys)
+-- ---------------------------------------------------------------------------
+-- The key arrays are verbatim from 02021 (read tiers) and 02022 (write tiers); only the ADMIN
+-- branch changes. The anon read policy is not touched.
+DROP POLICY IF EXISTS site_settings_read_policy ON public.site_settings;
+CREATE POLICY site_settings_read_policy ON public.site_settings
+  FOR SELECT TO authenticated
+  USING (
+    (key = ANY (ARRAY['site_title','site_description','site_keywords','site_social_image','footer_copyright','footer_show_attribution','global_css','language_detection_settings','seo_robots_settings','bot_protection_public','active_logo_id','is_admin_created','privacy_settings','enabled_payment_providers','ecommerce_inventory_settings','migration_baseline_generation','invoice_settings']::text[]))
+    OR ((key = ANY (ARRAY['security_settings','onboarding_state','email_public','cortex_ai_site_brief']::text[]))
+      AND (SELECT public.get_current_user_role()) = ANY (ARRAY['ADMIN'::public.user_role,'WRITER'::public.user_role]))
+    OR ((SELECT public.is_admin_mfa()) IS TRUE)
+  );
+
+DROP POLICY IF EXISTS site_settings_insert_policy ON public.site_settings;
+CREATE POLICY site_settings_insert_policy ON public.site_settings
+  FOR INSERT TO authenticated
+  WITH CHECK (
+    (key <> ALL (ARRAY['cortex_ai_openrouter_api_key','bot_protection_secret','email_secret','payment_secret','language_detection_settings','cortex_ai_pexels_api_key','cortex_ai_unsplash_access_key','cortex_ai_mcp_settings','seo_robots_settings','privacy_settings','is_admin_created','global_css','security_settings']::text[])
+      AND (SELECT public.get_current_user_role()) = ANY (ARRAY['ADMIN'::public.user_role,'WRITER'::public.user_role]))
+    OR (key = ANY (ARRAY['cortex_ai_openrouter_api_key','bot_protection_secret','email_secret','payment_secret','language_detection_settings','cortex_ai_pexels_api_key','cortex_ai_unsplash_access_key','cortex_ai_mcp_settings','seo_robots_settings','privacy_settings','is_admin_created','global_css','security_settings']::text[])
+      AND ((SELECT public.is_admin_mfa()) IS TRUE))
+  );
+
+DROP POLICY IF EXISTS site_settings_update_policy ON public.site_settings;
+CREATE POLICY site_settings_update_policy ON public.site_settings
+  FOR UPDATE TO authenticated
+  USING (
+    (key <> ALL (ARRAY['cortex_ai_openrouter_api_key','bot_protection_secret','email_secret','payment_secret','language_detection_settings','cortex_ai_pexels_api_key','cortex_ai_unsplash_access_key','cortex_ai_mcp_settings','seo_robots_settings','privacy_settings','is_admin_created','global_css','security_settings']::text[])
+      AND (SELECT public.get_current_user_role()) = ANY (ARRAY['ADMIN'::public.user_role,'WRITER'::public.user_role]))
+    OR (key = ANY (ARRAY['cortex_ai_openrouter_api_key','bot_protection_secret','email_secret','payment_secret','language_detection_settings','cortex_ai_pexels_api_key','cortex_ai_unsplash_access_key','cortex_ai_mcp_settings','seo_robots_settings','privacy_settings','is_admin_created','global_css','security_settings']::text[])
+      AND ((SELECT public.is_admin_mfa()) IS TRUE))
+  )
+  WITH CHECK (
+    (key <> ALL (ARRAY['cortex_ai_openrouter_api_key','bot_protection_secret','email_secret','payment_secret','language_detection_settings','cortex_ai_pexels_api_key','cortex_ai_unsplash_access_key','cortex_ai_mcp_settings','seo_robots_settings','privacy_settings','is_admin_created','global_css','security_settings']::text[])
+      AND (SELECT public.get_current_user_role()) = ANY (ARRAY['ADMIN'::public.user_role,'WRITER'::public.user_role]))
+    OR (key = ANY (ARRAY['cortex_ai_openrouter_api_key','bot_protection_secret','email_secret','payment_secret','language_detection_settings','cortex_ai_pexels_api_key','cortex_ai_unsplash_access_key','cortex_ai_mcp_settings','seo_robots_settings','privacy_settings','is_admin_created','global_css','security_settings']::text[])
+      AND ((SELECT public.is_admin_mfa()) IS TRUE))
+  );
+
+DROP POLICY IF EXISTS site_settings_delete_policy ON public.site_settings;
+CREATE POLICY site_settings_delete_policy ON public.site_settings
+  FOR DELETE TO authenticated
+  USING (
+    (key <> ALL (ARRAY['cortex_ai_openrouter_api_key','bot_protection_secret','email_secret','payment_secret','language_detection_settings','cortex_ai_pexels_api_key','cortex_ai_unsplash_access_key','cortex_ai_mcp_settings','seo_robots_settings','privacy_settings','is_admin_created','global_css','security_settings']::text[])
+      AND (SELECT public.get_current_user_role()) = ANY (ARRAY['ADMIN'::public.user_role,'WRITER'::public.user_role]))
+    OR (key = ANY (ARRAY['cortex_ai_openrouter_api_key','bot_protection_secret','email_secret','payment_secret','language_detection_settings','cortex_ai_pexels_api_key','cortex_ai_unsplash_access_key','cortex_ai_mcp_settings','seo_robots_settings','privacy_settings','is_admin_created','global_css','security_settings']::text[])
+      AND ((SELECT public.is_admin_mfa()) IS TRUE))
+  );

package/supabase/migrations/02024_advisor_trigger_grants_and_pg_net_schema.sql

@@ -0,0 +1,113 @@
+-- 02024: clear the Supabase Security Advisor warnings that came back after the 02022/02023
+-- deploys, and move a `pg_net` that was installed in `public` into `extensions`.
+--
+-- Why the SECURITY DEFINER warnings (lints 0028/0029) returned
+--   02013 revoked anon/authenticated EXECUTE on the two SECURITY DEFINER trigger functions
+--   (handle_new_user(), update_product_ratings()) and the advisor was clean. But every
+--   production build runs apps/nextblock/tools/build-migrate.mjs, whose migrate-core.mjs
+--   ends with a blanket `grant execute on all functions in schema public to anon,
+--   authenticated, service_role` and, unlike lib/setup/schema-apply.ts (the /setup path),
+--   had no pass taking that EXECUTE back off trigger functions or re-applying the API-role
+--   revokes of 02021/02022. So each deploy silently handed the privilege back. The hook is
+--   fixed in the same change (and a test now keeps the two files' SQL identical); this
+--   migration repairs the databases that were already re-granted. Postgres checks EXECUTE
+--   on a trigger function only at CREATE TRIGGER time, never when the trigger fires, and
+--   PostgREST cannot call a `RETURNS trigger` function via /rpc, so nothing loses access.
+--
+-- Why `pg_net` (lint 0014, "Extension in Public")
+--   A bare `create extension pg_net` lands in `public` (the first search_path entry), which
+--   exposes its objects through the API schema. pg_net is NOT relocatable, so the lint's
+--   `alter extension … set schema` is refused; the only way out is drop + re-create WITH
+--   SCHEMA extensions. Its own objects live in the `net` schema either way; only the
+--   extension's registration moves, and the request queue / response log are transient.
+--   pg_cron job commands are plain text (no dependency), so a scheduled `net.http_get`
+--   keeps working. Guarded: a database without pg_net, or with it already outside
+--   `public`, is untouched. Same statement tools/scripts/schedule-sandbox-reset.js runs.
+--
+-- Everything here is idempotent and safe on a fresh install, the sandbox replay and a
+-- /setup-installed database. The two Auth-dashboard warnings (leaked password protection,
+-- MFA options) are project settings, not schema, and are not addressed here.
+
+-- ---------------------------------------------------------------------------
+-- 1. Trigger functions: the API roles never need EXECUTE
+--    (identical to the post-apply pass in migrate-core.mjs / schema-apply.ts)
+-- ---------------------------------------------------------------------------
+do $nb_trg$
+declare r record;
+begin
+  for r in
+    select p.oid::regprocedure as sig
+      from pg_proc p
+      join pg_type t on t.oid = p.prorettype
+     where p.pronamespace = 'public'::regnamespace and t.typname = 'trigger'
+  loop
+    execute format('revoke execute on function %s from public, anon, authenticated', r.sig);
+  end loop;
+end $nb_trg$;
+
+-- The two the advisor names, stated explicitly so the intent survives a grep (02013 parity).
+REVOKE EXECUTE ON FUNCTION public.handle_new_user() FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.handle_new_user() TO service_role;
+
+REVOKE EXECUTE ON FUNCTION public.update_product_ratings() FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.update_product_ratings() TO service_role;
+
+-- ---------------------------------------------------------------------------
+-- 2. The API-role revokes of 02021 / 02022 that the same blanket grant handed back
+--    (identical to API_ROLE_REVOKE_SQL in migrate-core.mjs / schema-apply.ts)
+-- ---------------------------------------------------------------------------
+do $nb_api$
+begin
+  revoke truncate on all tables in schema public from anon, authenticated;
+  if to_regprocedure('public.generate_order_invoice_number()') is not null then
+    revoke execute on function public.generate_order_invoice_number() from public, anon, authenticated;
+  end if;
+  if to_regprocedure('public.assign_order_invoice_metadata(uuid, timestamp with time zone)') is not null then
+    revoke execute on function public.assign_order_invoice_metadata(uuid, timestamp with time zone) from public, anon, authenticated;
+  end if;
+  if to_regclass('public.order_invoice_number_seq') is not null then
+    revoke all on sequence public.order_invoice_number_seq from anon, authenticated;
+  end if;
+  if to_regprocedure('public.upsert_product_with_variants(jsonb)') is not null then
+    revoke execute on function public.upsert_product_with_variants(jsonb) from public, anon;
+  end if;
+  if to_regprocedure('public.bump_email_2fa_attempts(uuid)') is not null then
+    revoke execute on function public.bump_email_2fa_attempts(uuid) from public, anon, authenticated;
+  end if;
+  if to_regprocedure('public.redeem_coupon_atomically(uuid)') is not null then
+    revoke execute on function public.redeem_coupon_atomically(uuid) from public, anon, authenticated;
+  end if;
+end $nb_api$;
+
+-- ---------------------------------------------------------------------------
+-- 3. pg_net out of `public` (not relocatable: drop + re-create WITH SCHEMA extensions)
+-- ---------------------------------------------------------------------------
+do $nb_pg_net$
+declare
+  v_version text;
+begin
+  select e.extversion
+    into v_version
+    from pg_extension e
+   where e.extname = 'pg_net'
+     and e.extnamespace = 'public'::regnamespace;
+
+  if v_version is null then
+    return; -- not installed, or already registered outside public
+  end if;
+
+  if to_regnamespace('extensions') is null then
+    raise notice '02024: pg_net % is registered in schema public and this database has no extensions schema; reinstall it by hand with `create extension pg_net with schema <schema>`', v_version;
+    return;
+  end if;
+
+  -- The pg_net worker holds net.http_request_queue while a request is in flight. Fail fast
+  -- rather than queue behind it; re-running the migration is cheap.
+  perform set_config('lock_timeout', '15s', true);
+
+  drop extension pg_net;
+  create extension pg_net with schema extensions;
+
+  raise notice '02024: pg_net re-registered in schema extensions (was % in public, now %)',
+    v_version, (select extversion from pg_extension where extname = 'pg_net');
+end $nb_pg_net$;