@oktis-works/database 0.7.1 → 0.8.0

package/dist/schema/schema.sql

@@ -536,6 +536,34 @@ CREATE TABLE IF NOT EXISTS webhooks (
 -- mantidos para que instalações existentes migrem sem perder seus segredos.
 ALTER TABLE webhooks ADD COLUMN IF NOT EXISTS auth_type VARCHAR(30) NOT NULL DEFAULT 'hmac_sha256';
 ALTER TABLE webhooks ADD COLUMN IF NOT EXISTS auth_config JSONB NOT NULL DEFAULT '{}'::jsonb;
+
+-- ============================================================
+-- Webhook hardening (Item 19 — rotação de segredos + dead-letter)
+-- ============================================================
+CREATE TABLE IF NOT EXISTS webhook_secrets (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  webhook_id UUID NOT NULL REFERENCES webhooks(id) ON DELETE CASCADE,
+  secret VARCHAR(255) NOT NULL,
+  version INT NOT NULL DEFAULT 1,
+  is_active BOOLEAN NOT NULL DEFAULT true,
+  rotated_at TIMESTAMPTZ,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  UNIQUE(webhook_id, version)
+);
+
+CREATE INDEX IF NOT EXISTS idx_webhook_secrets_webhook ON webhook_secrets(webhook_id, is_active);
+
+CREATE TABLE IF NOT EXISTS webhook_dead_letters (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  webhook_id UUID NOT NULL REFERENCES webhooks(id) ON DELETE CASCADE,
+  event VARCHAR(191) NOT NULL,
+  payload JSONB NOT NULL,
+  error TEXT,
+  attempts INT NOT NULL DEFAULT 1,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_webhook_dead_letters_webhook ON webhook_dead_letters(webhook_id, created_at);
 UPDATE webhooks
 SET auth_config = jsonb_build_object('secret', secret)
 WHERE auth_type = 'hmac_sha256' AND auth_config = '{}'::jsonb AND secret <> '';
@@ -779,6 +807,103 @@ CREATE TABLE IF NOT EXISTS content_taxonomy_terms (
 CREATE INDEX IF NOT EXISTS idx_content_terms_content ON content_taxonomy_terms(content_id);
 CREATE INDEX IF NOT EXISTS idx_content_terms_term ON content_taxonomy_terms(term_id);
 
+-- ============================================================
+-- Comments (Item 11 — paridade WordPress: comentários moderados, thread)
+-- ============================================================
+CREATE TABLE IF NOT EXISTS comments (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
+  content_id UUID NOT NULL REFERENCES content(id) ON DELETE CASCADE,
+  parent_id UUID REFERENCES comments(id) ON DELETE CASCADE,
+  author_name VARCHAR(255) NOT NULL,
+  author_email VARCHAR(255),
+  author_url VARCHAR(500),
+  author_id UUID REFERENCES users(id) ON DELETE SET NULL,
+  body TEXT NOT NULL,
+  status VARCHAR(20) NOT NULL DEFAULT 'PENDING',
+  ip_address VARCHAR(64),
+  user_agent VARCHAR(500),
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_comments_content_status ON comments(content_id, status);
+CREATE INDEX IF NOT EXISTS idx_comments_tenant_status ON comments(tenant_id, status);
+CREATE INDEX IF NOT EXISTS idx_comments_parent ON comments(parent_id);
+
+CREATE TABLE IF NOT EXISTS comment_meta (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  comment_id UUID NOT NULL REFERENCES comments(id) ON DELETE CASCADE,
+  key VARCHAR(191) NOT NULL,
+  value JSONB,
+  UNIQUE(comment_id, key)
+);
+
+ALTER TABLE comments ENABLE ROW LEVEL SECURITY;
+ALTER TABLE comments FORCE ROW LEVEL SECURITY;
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_policies
+    WHERE policyname = 'tenant_isolation_comments' AND tablename = 'comments'
+  ) THEN
+    CREATE POLICY tenant_isolation_comments ON comments
+      USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid OR tenant_id IS NULL);
+  END IF;
+END $$;
+
+ALTER TABLE comment_meta ENABLE ROW LEVEL SECURITY;
+ALTER TABLE comment_meta FORCE ROW LEVEL SECURITY;
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_policies
+    WHERE policyname = 'tenant_isolation_comment_meta' AND tablename = 'comment_meta'
+  ) THEN
+    CREATE POLICY tenant_isolation_comment_meta ON comment_meta
+      USING (EXISTS (
+        SELECT 1 FROM comments c
+        WHERE c.id = comment_meta.comment_id
+          AND (c.tenant_id = current_setting('app.current_tenant_id', true)::uuid OR c.tenant_id IS NULL)
+      ));
+  END IF;
+END $$;
+
+-- ============================================================
+-- Mails (Item 12 — paridade WordPress: outbox durável para api.mail.send)
+-- ============================================================
+CREATE TABLE IF NOT EXISTS mails (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  tenant_id UUID REFERENCES tenants(id) ON DELETE CASCADE,
+  plugin_name VARCHAR(255) NOT NULL,
+  to_email VARCHAR(320) NOT NULL,
+  subject VARCHAR(998) NOT NULL,
+  html TEXT,
+  text TEXT,
+  template VARCHAR(191),
+  params JSONB,
+  status VARCHAR(20) NOT NULL DEFAULT 'QUEUED',
+  attempts INT NOT NULL DEFAULT 0,
+  error TEXT,
+  sent_at TIMESTAMPTZ,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_mails_tenant_status ON mails(tenant_id, status);
+
+ALTER TABLE mails ENABLE ROW LEVEL SECURITY;
+ALTER TABLE mails FORCE ROW LEVEL SECURITY;
+DO $$
+BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_policies
+    WHERE policyname = 'tenant_isolation_mails' AND tablename = 'mails'
+  ) THEN
+    CREATE POLICY tenant_isolation_mails ON mails
+      USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid OR tenant_id IS NULL);
+  END IF;
+END $$;
+
 ALTER TABLE taxonomy_terms ENABLE ROW LEVEL SECURITY;
 ALTER TABLE taxonomy_terms FORCE ROW LEVEL SECURITY;
 ALTER TABLE content_taxonomy_terms ENABLE ROW LEVEL SECURITY;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oktis-works/database",
-  "version": "0.7.1",
+  "version": "0.8.0",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",
@@ -19,8 +19,8 @@
     "db:rollback": "node --loader ts-node/esm src/migrations/runner.ts rollback"
   },
   "dependencies": {
-    "@oktis-works/types": "^0.8.0",
-    "@oktis-works/config": "^0.6.3",
+    "@oktis-works/types": "^0.9.0",
+    "@oktis-works/config": "^0.6.4",
     "postgres": "3.4.0"
   },
   "devDependencies": {