@orion-studios/cms 0.5.0 → 0.5.2

package/sql/bootstrap.sql

@@ -35,13 +35,19 @@ create table if not exists cms_pages (
   title text not null default '',
   seo jsonb not null default '{}'::jsonb,
   draft_layout jsonb not null default '[]'::jsonb,
+  published_title text,
+  published_seo jsonb,
   published_layout jsonb,
+  draft_version_id bigint,
+  published_version_id bigint,
+  scheduled_version_id bigint,
   status text not null default 'draft' check (status in ('draft', 'published')),
   -- true once edited in the Studio; content-as-code sync then leaves the layout alone
   builder_owned boolean not null default false,
   created_at timestamptz not null default now(),
   updated_at timestamptz not null default now(),
-  published_at timestamptz
+  published_at timestamptz,
+  publish_at timestamptz
 );
 create index if not exists cms_pages_status_idx on cms_pages (status);
 
@@ -58,6 +64,141 @@ create table if not exists cms_page_versions (
 create index if not exists cms_page_versions_page_idx
   on cms_page_versions (page_id, created_at desc);
 
+-- Additive publication columns for existing databases.
+alter table cms_pages add column if not exists published_title text;
+alter table cms_pages add column if not exists published_seo jsonb;
+alter table cms_pages add column if not exists draft_version_id bigint;
+alter table cms_pages add column if not exists published_version_id bigint;
+alter table cms_pages add column if not exists scheduled_version_id bigint;
+alter table cms_pages add column if not exists publish_at timestamptz;
+
+-- Recover the already-public metadata from matching publication history.
+update cms_pages
+set published_layout = '[]'::jsonb
+where status = 'published' and published_layout is null;
+
+with published_history as (
+  select distinct on (p.id)
+    p.id as page_id,
+    v.id as version_id,
+    v.title,
+    v.seo
+  from cms_pages p
+  join cms_page_versions v
+    on v.page_id = p.id
+   and v.kind in ('publish', 'sync')
+   and v.layout is not distinct from p.published_layout
+  where p.status = 'published'
+  order by p.id, v.created_at desc, v.id desc
+)
+update cms_pages p
+set published_title = h.title,
+    published_seo = h.seo,
+    published_version_id = h.version_id
+from published_history h
+where p.id = h.page_id
+  and p.published_version_id is null;
+
+with inserted as (
+  insert into cms_page_versions (page_id, kind, title, seo, layout)
+  select id, 'publish', title, seo, published_layout
+  from cms_pages
+  where status = 'published'
+    and published_version_id is null
+  returning id, page_id, title, seo
+)
+update cms_pages p
+set published_title = i.title,
+    published_seo = i.seo,
+    published_version_id = i.id
+from inserted i
+where p.id = i.page_id;
+
+with draft_history as (
+  select distinct on (p.id)
+    p.id as page_id,
+    v.id as version_id
+  from cms_pages p
+  join cms_page_versions v
+    on v.page_id = p.id
+   and v.title is not distinct from p.title
+   and v.seo is not distinct from p.seo
+   and v.layout is not distinct from p.draft_layout
+  order by p.id, v.created_at desc, v.id desc
+)
+update cms_pages p
+set draft_version_id = h.version_id
+from draft_history h
+where p.id = h.page_id
+  and p.draft_version_id is null;
+
+with inserted as (
+  insert into cms_page_versions (page_id, kind, title, seo, layout)
+  select id, 'draft', title, seo, draft_layout
+  from cms_pages
+  where draft_version_id is null
+  returning id, page_id
+)
+update cms_pages p
+set draft_version_id = i.id
+from inserted i
+where p.id = i.page_id;
+
+-- A legacy timestamp cannot prove which draft was reviewed. Clear the
+-- incomplete schedule so an editor must explicitly bind an exact version.
+update cms_pages
+set publish_at = null,
+    scheduled_version_id = null
+where publish_at is not null
+  and scheduled_version_id is null;
+
+create unique index if not exists cms_page_versions_page_id_id_idx
+  on cms_page_versions (page_id, id);
+create index if not exists cms_pages_scheduled_publish_due_idx
+  on cms_pages (publish_at)
+  where publish_at is not null and scheduled_version_id is not null;
+
+do $publication_constraints$
+begin
+  if not exists (select 1 from pg_constraint where conname = 'cms_pages_draft_version_fk' and conrelid = 'cms_pages'::regclass) then
+    alter table cms_pages
+      add constraint cms_pages_draft_version_fk
+      foreign key (id, draft_version_id)
+      references cms_page_versions (page_id, id);
+  end if;
+  if not exists (select 1 from pg_constraint where conname = 'cms_pages_published_version_fk' and conrelid = 'cms_pages'::regclass) then
+    alter table cms_pages
+      add constraint cms_pages_published_version_fk
+      foreign key (id, published_version_id)
+      references cms_page_versions (page_id, id);
+  end if;
+  if not exists (select 1 from pg_constraint where conname = 'cms_pages_scheduled_version_fk' and conrelid = 'cms_pages'::regclass) then
+    alter table cms_pages
+      add constraint cms_pages_scheduled_version_fk
+      foreign key (id, scheduled_version_id)
+      references cms_page_versions (page_id, id);
+  end if;
+  if not exists (select 1 from pg_constraint where conname = 'cms_pages_schedule_version_pair' and conrelid = 'cms_pages'::regclass) then
+    alter table cms_pages
+      add constraint cms_pages_schedule_version_pair
+      check ((publish_at is null) = (scheduled_version_id is null));
+  end if;
+  if not exists (select 1 from pg_constraint where conname = 'cms_pages_published_state_complete' and conrelid = 'cms_pages'::regclass) then
+    alter table cms_pages
+      add constraint cms_pages_published_state_complete
+      check (
+        status <> 'published'
+        or (
+          published_title is not null
+          and published_seo is not null
+          and published_layout is not null
+          and published_version_id is not null
+        )
+      );
+  end if;
+end
+$publication_constraints$;
+
 create table if not exists cms_globals (
   key text primary key,
   label text not null default '',
@@ -172,6 +313,13 @@ create table if not exists cms_activity (
 );
 create index if not exists cms_activity_created_idx on cms_activity (created_at desc);
 
+create table if not exists cms_rate_limits (
+  key text primary key,
+  window_start timestamptz not null default now(),
+  count integer not null default 0
+);
+create index if not exists cms_rate_limits_window_idx on cms_rate_limits (window_start);
+
 -- 2) Functions (atomic write paths, called via RPC with service role) --------
 
 create or replace function cms_save_page_draft(
@@ -187,36 +335,51 @@ security definer
 set search_path = public
 as $$
 declare
+  current_page cms_pages;
   result cms_pages;
-  latest cms_page_versions;
+  version_id bigint;
+  next_title text;
+  next_seo jsonb;
+  next_layout jsonb;
 begin
-  update cms_pages
-  set title = coalesce(p_title, title),
-      seo = coalesce(p_seo, seo),
-      draft_layout = coalesce(p_layout, draft_layout),
-      builder_owned = builder_owned or p_mark_builder_owned,
-      updated_at = now()
+  select * into current_page
+  from cms_pages
   where id = p_page_id
-  returning * into result;
+  for update;
 
-  if result.id is null then
+  if current_page.id is null then
     raise exception 'page % not found', p_page_id;
   end if;
 
-  -- Autosave fires every few seconds of editing; only snapshot when the
-  -- content actually changed so history stays meaningful.
-  select * into latest from cms_page_versions
-    where page_id = p_page_id
-    order by created_at desc, id desc limit 1;
+  next_title := coalesce(p_title, current_page.title);
+  next_seo := coalesce(p_seo, current_page.seo);
+  next_layout := coalesce(p_layout, current_page.draft_layout);
+
+  select id into version_id
+  from cms_page_versions
+  where page_id = p_page_id
+    and title is not distinct from next_title
+    and seo is not distinct from next_seo
+    and layout is not distinct from next_layout
+  order by created_at desc, id desc
+  limit 1;
 
-  if latest.id is null
-     or latest.title is distinct from result.title
-     or latest.seo is distinct from result.seo
-     or latest.layout is distinct from result.draft_layout then
+  if version_id is null then
     insert into cms_page_versions (page_id, kind, title, seo, layout, created_by)
-    values (p_page_id, 'draft', result.title, result.seo, result.draft_layout, p_actor);
+    values (p_page_id, 'draft', next_title, next_seo, next_layout, p_actor)
+    returning id into version_id;
   end if;
 
+  update cms_pages
+  set title = next_title,
+      seo = next_seo,
+      draft_layout = next_layout,
+      draft_version_id = version_id,
+      builder_owned = builder_owned or p_mark_builder_owned,
+      updated_at = now()
+  where id = p_page_id
+  returning * into result;
+
   return result;
 end;
 $$;
@@ -229,24 +392,65 @@ language plpgsql
 security definer
 set search_path = public
 as $$
+begin
+  raise exception 'Page version conflict: expected version is required';
+end;
+$$;
+
+create or replace function cms_publish_page(
+  p_page_id uuid,
+  p_expected_version_id bigint,
+  p_actor uuid
+) returns cms_pages
+language plpgsql
+security definer
+set search_path = public
+as $$
 declare
+  current_page cms_pages;
+  reviewed cms_page_versions;
   result cms_pages;
 begin
+  select * into current_page
+  from cms_pages
+  where id = p_page_id
+  for update;
+
+  if current_page.id is null then
+    raise exception 'page % not found', p_page_id;
+  end if;
+
+  select * into reviewed
+  from cms_page_versions
+  where id = p_expected_version_id
+    and page_id = p_page_id;
+
+  if reviewed.id is null
+     or current_page.draft_version_id is distinct from p_expected_version_id
+     or reviewed.title is distinct from current_page.title
+     or reviewed.seo is distinct from current_page.seo
+     or reviewed.layout is distinct from current_page.draft_layout then
+    raise exception 'Page version conflict: expected draft is missing or stale';
+  end if;
+
+  if current_page.status = 'published'
+     and current_page.published_version_id = p_expected_version_id then
+    raise exception 'Page version conflict: expected draft is already published';
+  end if;
+
   update cms_pages
-  set published_layout = draft_layout,
+  set published_title = reviewed.title,
+      published_seo = reviewed.seo,
+      published_layout = reviewed.layout,
+      published_version_id = reviewed.id,
       status = 'published',
       published_at = now(),
+      publish_at = null,
+      scheduled_version_id = null,
       updated_at = now()
   where id = p_page_id
   returning * into result;
 
-  if result.id is null then
-    raise exception 'page % not found', p_page_id;
-  end if;
-
-  insert into cms_page_versions (page_id, kind, title, seo, layout, created_by)
-  values (p_page_id, 'publish', result.title, result.seo, result.published_layout, p_actor);
-
   return result;
 end;
 $$;
@@ -262,24 +466,29 @@ as $$
 declare
   v cms_page_versions;
   result cms_pages;
+  restored_version_id bigint;
 begin
   select * into v from cms_page_versions where id = p_version_id;
   if v.id is null then
     raise exception 'version % not found', p_version_id;
   end if;
 
+  perform 1 from cms_pages where id = v.page_id for update;
+
+  insert into cms_page_versions (page_id, kind, title, seo, layout, created_by)
+  values (v.page_id, 'restore', v.title, v.seo, v.layout, p_actor)
+  returning id into restored_version_id;
+
   update cms_pages
   set draft_layout = v.layout,
       title = v.title,
       seo = v.seo,
+      draft_version_id = restored_version_id,
       builder_owned = true,
       updated_at = now()
   where id = v.page_id
   returning * into result;
 
-  insert into cms_page_versions (page_id, kind, title, seo, layout, created_by)
-  values (v.page_id, 'restore', v.title, v.seo, v.layout, p_actor);
-
   return result;
 end;
 $$;
@@ -299,36 +508,234 @@ set search_path = public
 as $$
 declare
   result cms_pages;
-  latest cms_page_versions;
+  version_id bigint;
+  is_new boolean := false;
 begin
-  -- builder_owned pages belong to the Studio: sync only ensures they exist.
-  -- Overwriting title/seo/path here would silently revert Studio edits
-  -- (SEO drawer, address renames) on the next deploy sync.
-  insert into cms_pages (slug, path, title, seo, draft_layout, published_layout, status, published_at)
-  values (p_slug, p_path, p_title, p_seo, p_layout, p_layout, 'published', now())
-  on conflict (slug) do update
-  set path = case when cms_pages.builder_owned then cms_pages.path else excluded.path end,
-      title = case when cms_pages.builder_owned then cms_pages.title else excluded.title end,
-      seo = case when cms_pages.builder_owned then cms_pages.seo else excluded.seo end,
-      draft_layout = case when cms_pages.builder_owned then cms_pages.draft_layout else excluded.draft_layout end,
-      published_layout = case when cms_pages.builder_owned then cms_pages.published_layout else excluded.published_layout end,
-      updated_at = case when cms_pages.builder_owned then cms_pages.updated_at else now() end
+  insert into cms_pages (
+    slug, path, title, seo, draft_layout,
+    published_title, published_seo, published_layout,
+    status, published_at
+  )
+  values (
+    p_slug, p_path, p_title, p_seo, p_layout,
+    p_title, p_seo, p_layout,
+    'draft', null
+  )
+  on conflict (slug) do nothing
   returning * into result;
 
-  -- Snapshot only when the sync actually changed something (idempotent
-  -- re-syncs and builder-owned pages would otherwise pile up noise rows).
-  select * into latest from cms_page_versions
-    where page_id = result.id
-    order by created_at desc, id desc limit 1;
+  if result.id is not null then
+    is_new := true;
+  else
+    select * into result
+    from cms_pages
+    where slug = p_slug
+    for update;
+
+    -- Builder-owned pages belong to the Studio. Sync only ensures they exist.
+    if not result.builder_owned then
+      update cms_pages
+      set path = p_path,
+          title = p_title,
+          seo = p_seo,
+          draft_layout = p_layout,
+          published_title = p_title,
+          published_seo = p_seo,
+          published_layout = p_layout,
+          updated_at = now()
+      where id = result.id
+      returning * into result;
+    end if;
+  end if;
+
+  select id into version_id
+  from cms_page_versions
+  where page_id = result.id
+    and title is not distinct from result.title
+    and seo is not distinct from result.seo
+    and layout is not distinct from result.draft_layout
+  order by created_at desc, id desc
+  limit 1;
 
-  if latest.id is null
-     or latest.title is distinct from result.title
-     or latest.seo is distinct from result.seo
-     or latest.layout is distinct from result.draft_layout then
+  if version_id is null then
     insert into cms_page_versions (page_id, kind, title, seo, layout)
-    values (result.id, 'sync', result.title, result.seo, result.draft_layout);
+    values (result.id, 'sync', result.title, result.seo, result.draft_layout)
+    returning id into version_id;
+  end if;
+
+  if not result.builder_owned then
+    update cms_pages
+    set draft_version_id = version_id,
+        published_version_id = version_id,
+        status = case when is_new then 'published' else status end,
+        published_at = case when is_new then now() else published_at end
+    where id = result.id
+    returning * into result;
+  end if;
+
+  return result;
+end;
+$$;
+
+create or replace function cms_schedule_page_publish(
+  p_page_id uuid,
+  p_expected_version_id bigint,
+  p_publish_at timestamptz,
+  p_actor uuid
+) returns cms_pages
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  current_page cms_pages;
+  reviewed cms_page_versions;
+  result cms_pages;
+begin
+  select * into current_page
+  from cms_pages
+  where id = p_page_id
+  for update;
+
+  if current_page.id is null then
+    raise exception 'page % not found', p_page_id;
+  end if;
+
+  if p_publish_at is null then
+    update cms_pages
+    set publish_at = null,
+        scheduled_version_id = null,
+        updated_at = now()
+    where id = p_page_id
+    returning * into result;
+    return result;
   end if;
 
+  select * into reviewed
+  from cms_page_versions
+  where id = p_expected_version_id
+    and page_id = p_page_id;
+
+  if reviewed.id is null
+     or current_page.draft_version_id is distinct from p_expected_version_id
+     or reviewed.title is distinct from current_page.title
+     or reviewed.seo is distinct from current_page.seo
+     or reviewed.layout is distinct from current_page.draft_layout then
+    raise exception 'Page version conflict: expected draft is missing or stale';
+  end if;
+
+  update cms_pages
+  set publish_at = p_publish_at,
+      scheduled_version_id = reviewed.id,
+      updated_at = now()
+  where id = p_page_id
+  returning * into result;
+
+  return result;
+end;
+$$;
+
+create or replace function cms_publish_due_pages()
+returns setof text
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  due record;
+begin
+  for due in
+    select
+      p.id,
+      p.path,
+      v.id as version_id,
+      v.title,
+      v.seo,
+      v.layout
+    from cms_pages p
+    join cms_page_versions v
+      on v.page_id = p.id
+     and v.id = p.scheduled_version_id
+    where p.publish_at is not null
+      and p.publish_at <= now()
+      and p.scheduled_version_id is not null
+    order by p.publish_at
+    for update of p skip locked
+  loop
+    update cms_pages
+    set published_title = due.title,
+        published_seo = due.seo,
+        published_layout = due.layout,
+        published_version_id = due.version_id,
+        status = 'published',
+        published_at = now(),
+        publish_at = null,
+        scheduled_version_id = null,
+        updated_at = now()
+    where id = due.id;
+
+    insert into cms_activity (action, subject)
+    values ('page.publish.scheduled', due.path);
+
+    return next due.path;
+  end loop;
+  return;
+end;
+$$;
+
+create or replace function cms_rate_limit_consume(
+  p_key text,
+  p_max integer,
+  p_window_seconds integer
+) returns boolean
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  v_count integer;
+begin
+  insert into cms_rate_limits (key, window_start, count)
+  values (p_key, now(), 1)
+  on conflict (key) do update
+    set count = case
+          when cms_rate_limits.window_start < now() - make_interval(secs => p_window_seconds)
+          then 1
+          else cms_rate_limits.count + 1
+        end,
+        window_start = case
+          when cms_rate_limits.window_start < now() - make_interval(secs => p_window_seconds)
+          then now()
+          else cms_rate_limits.window_start
+        end
+  returning count into v_count;
+
+  return v_count <= p_max;
+end;
+$$;
+
+create or replace function cms_update_global(
+  p_key text,
+  p_data jsonb,
+  p_actor uuid default null
+) returns cms_globals
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  result cms_globals;
+begin
+  insert into cms_globals (key, data, updated_at)
+  values (p_key, p_data, now())
+  on conflict (key) do update
+    set data = excluded.data,
+        updated_at = now()
+  returning * into result;
+
+  insert into cms_global_versions (key, data, created_by)
+  values (p_key, p_data, p_actor);
+
   return result;
 end;
 $$;
@@ -349,6 +756,7 @@ alter table cms_global_versions enable row level security;
 alter table cms_redirects enable row level security;
 alter table cms_activity enable row level security;
 alter table cms_events enable row level security;
+alter table cms_rate_limits enable row level security;
 -- cms_events: no anon policies or grants — ingest and reads go through the
 -- API layer only.
 
@@ -402,8 +810,13 @@ declare
   fns text[] := array[
     'cms_save_page_draft(uuid, text, jsonb, jsonb, uuid, boolean)',
     'cms_publish_page(uuid, uuid)',
+    'cms_publish_page(uuid, bigint, uuid)',
+    'cms_schedule_page_publish(uuid, bigint, timestamptz, uuid)',
     'cms_restore_page_version(bigint, uuid)',
-    'cms_sync_page(text, text, text, jsonb, jsonb)'
+    'cms_sync_page(text, text, text, jsonb, jsonb)',
+    'cms_publish_due_pages()',
+    'cms_rate_limit_consume(text, integer, integer)',
+    'cms_update_global(text, jsonb, uuid)'
   ];
 begin
   foreach fn in array fns loop
@@ -425,23 +838,27 @@ end $fn_lockdown$;
 -- privileges only cover tables created by `postgres`; when bootstrap runs as a
 -- site-specific role, the PostgREST roles get nothing — so grant explicitly.
 -- Wrapped per-role so bootstrap also works on plain Postgres (dev/tests).
+revoke update, delete on cms_page_versions from public;
 do $grants$
 begin
   if exists (select 1 from pg_roles where rolname = 'service_role') then
     grant select, insert, update, delete on
-      cms_settings, cms_profiles, cms_pages, cms_page_versions,
+      cms_settings, cms_profiles, cms_pages,
       cms_globals, cms_media, cms_forms, cms_form_submissions,
       cms_global_versions, cms_redirects, cms_activity, cms_events
       to service_role;
+    revoke update, delete on cms_page_versions from service_role;
+    grant select, insert on cms_page_versions to service_role;
   end if;
 
-  -- cms_pages and cms_forms get COLUMN-level read grants: anonymous readers
-  -- must never see draft_layout (unpublished work) or notify (staff emails).
+  -- cms_pages and cms_forms get column-level read grants. Anonymous readers
+  -- see published page state only and never form notification addresses.
   if exists (select 1 from pg_roles where rolname = 'anon') then
     grant select on cms_globals, cms_media, cms_redirects to anon;
     revoke select on cms_pages from anon;
-    grant select (id, slug, path, title, seo, status, published_layout, published_at, created_at, updated_at)
+    grant select (id, slug, path, published_title, published_seo, status, published_layout, published_at, created_at, updated_at)
       on cms_pages to anon;
+    revoke all on cms_page_versions from anon;
     revoke select on cms_forms from anon;
     grant select (id, slug, title, config, success_message, created_at, updated_at)
       on cms_forms to anon;
@@ -449,8 +866,9 @@ begin
   if exists (select 1 from pg_roles where rolname = 'authenticated') then
     grant select on cms_globals, cms_media, cms_profiles, cms_redirects to authenticated;
     revoke select on cms_pages from authenticated;
-    grant select (id, slug, path, title, seo, status, published_layout, published_at, created_at, updated_at)
+    grant select (id, slug, path, published_title, published_seo, status, published_layout, published_at, created_at, updated_at)
       on cms_pages to authenticated;
+    revoke all on cms_page_versions from authenticated;
     revoke select on cms_forms from authenticated;
     grant select (id, slug, title, config, success_message, created_at, updated_at)
       on cms_forms to authenticated;

package/sql/migrations/0005_rls_bookkeeping.sql

@@ -0,0 +1,17 @@
+-- Enable RLS on the two bookkeeping tables the original schema missed.
+-- Neither has policies on purpose: no client role has any business touching
+-- them. cms_rate_limits is only written via cms_rate_limit_consume(), which is
+-- SECURITY DEFINER and service-role-execute-only; cms_migrations is only
+-- touched by the migration runner over a direct Postgres connection. With RLS
+-- off, both tables were fully readable/writable by anon via the Data API
+-- (Supabase security advisor: rls_disabled, critical).
+
+alter table cms_rate_limits enable row level security;
+
+do $rls$
+begin
+  if to_regclass('public.cms_migrations') is not null then
+    execute 'alter table cms_migrations enable row level security';
+  end if;
+end
+$rls$;