@orion-studios/cms 0.5.0

package/sql/bootstrap.sql

@@ -0,0 +1,458 @@
+-- ============================================================================
+-- Orion CMS v2 — bootstrap schema
+--
+-- Applied once per site (Supabase SQL editor or `npx orion-cms bootstrap`).
+-- Idempotent: safe to re-run. The schema is intentionally small and stable —
+-- block/layout shapes live in JSONB and are validated by the application, so
+-- content-model changes require NO database changes.
+-- ============================================================================
+
+-- 1) Tables ------------------------------------------------------------------
+
+create table if not exists cms_settings (
+  id boolean primary key default true check (id), -- single row
+  site_name text not null default '',
+  data jsonb not null default '{}'::jsonb,
+  updated_at timestamptz not null default now()
+);
+insert into cms_settings (id) values (true) on conflict do nothing;
+
+create table if not exists cms_profiles (
+  -- Points at auth.users(id). No FK on purpose: adding one requires REFERENCES
+  -- on the auth schema, which restricted roles (typical DATABASE_URL users)
+  -- don't have. The API layer owns profile lifecycle and integrity.
+  user_id uuid primary key,
+  role text not null default 'content'
+    check (role in ('admin', 'developer', 'editor', 'content')),
+  name text not null default '',
+  created_at timestamptz not null default now()
+);
+
+create table if not exists cms_pages (
+  id uuid primary key default gen_random_uuid(),
+  slug text not null unique,
+  path text not null unique,
+  title text not null default '',
+  seo jsonb not null default '{}'::jsonb,
+  draft_layout jsonb not null default '[]'::jsonb,
+  published_layout jsonb,
+  status text not null default 'draft' check (status in ('draft', 'published')),
+  -- true once edited in the Studio; content-as-code sync then leaves the layout alone
+  builder_owned boolean not null default false,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  published_at timestamptz
+);
+create index if not exists cms_pages_status_idx on cms_pages (status);
+
+create table if not exists cms_page_versions (
+  id bigint generated always as identity primary key,
+  page_id uuid not null references cms_pages (id) on delete cascade,
+  kind text not null check (kind in ('draft', 'publish', 'restore', 'sync')),
+  title text not null default '',
+  seo jsonb not null default '{}'::jsonb,
+  layout jsonb not null default '[]'::jsonb,
+  created_by uuid,
+  created_at timestamptz not null default now()
+);
+create index if not exists cms_page_versions_page_idx
+  on cms_page_versions (page_id, created_at desc);
+
+create table if not exists cms_globals (
+  key text primary key,
+  label text not null default '',
+  data jsonb not null default '{}'::jsonb,
+  updated_at timestamptz not null default now()
+);
+
+create table if not exists cms_media (
+  id uuid primary key default gen_random_uuid(),
+  storage_path text not null unique,
+  filename text not null,
+  alt text not null default '',
+  caption text not null default '',
+  mime_type text not null default '',
+  width integer,
+  height integer,
+  filesize integer,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+
+create table if not exists cms_forms (
+  id uuid primary key default gen_random_uuid(),
+  slug text not null unique,
+  title text not null default '',
+  config jsonb not null default '{}'::jsonb, -- steps/fields, per forms module contract
+  success_message text not null default '',
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+
+-- Notification settings live OUTSIDE config: config is anon-readable (the
+-- public form renderer needs the field list), notify addresses are not.
+alter table cms_forms add column if not exists notify jsonb not null default '{}'::jsonb;
+update cms_forms
+  set notify = coalesce(config->'notify', '{}'::jsonb),
+      config = config - 'notify'
+  where config ? 'notify';
+
+create table if not exists cms_form_submissions (
+  id bigint generated always as identity primary key,
+  form_id uuid not null references cms_forms (id) on delete cascade,
+  data jsonb not null default '{}'::jsonb,
+  source text not null default 'website',
+  created_at timestamptz not null default now()
+);
+create index if not exists cms_form_submissions_form_idx
+  on cms_form_submissions (form_id, created_at desc);
+
+-- Additive columns (idempotent — bootstrap re-runs safely on existing sites).
+alter table cms_form_submissions add column if not exists read_at timestamptz;
+alter table cms_form_submissions add column if not exists client_key text;
+alter table cms_pages add column if not exists publish_at timestamptz;
+
+-- Snapshots of global values, mirroring cms_page_versions for pages.
+create table if not exists cms_global_versions (
+  id bigint generated always as identity primary key,
+  key text not null,
+  data jsonb not null default '{}'::jsonb,
+  created_by uuid,
+  created_at timestamptz not null default now()
+);
+create index if not exists cms_global_versions_key_idx
+  on cms_global_versions (key, created_at desc);
+
+-- Redirects: consulted by the site on would-be 404s. Auto-populated on
+-- page path renames, manageable in the Studio.
+create table if not exists cms_redirects (
+  id uuid primary key default gen_random_uuid(),
+  from_path text not null unique,
+  to_path text not null,
+  permanent boolean not null default true,
+  created_at timestamptz not null default now()
+);
+
+-- First-party analytics events. Append-only; pruned after the retention
+-- window by the cron route. session_key rotates daily. visitor_key is an
+-- optional server-side HMAC of a consented first-party cookie; the raw cookie
+-- value is never stored.
+create table if not exists cms_events (
+  id bigint generated always as identity primary key,
+  session_key text not null default '',
+  visitor_key text not null default '',
+  type text not null check (type in ('pageview', 'click', 'form', 'not_found')),
+  name text not null default '',
+  path text not null default '',
+  referrer text not null default '',
+  utm jsonb not null default '{}'::jsonb,
+  device text not null default '',
+  region text not null default '',
+  city text not null default '',
+  meta jsonb not null default '{}'::jsonb,
+  created_at timestamptz not null default now()
+);
+create index if not exists cms_events_day_idx on cms_events (created_at desc);
+create index if not exists cms_events_session_idx on cms_events (session_key, created_at);
+create index if not exists cms_events_visitor_idx on cms_events (visitor_key, created_at)
+  where visitor_key <> '';
+
+-- Links a stored lead to the journey that produced it (same hash scheme).
+alter table cms_form_submissions add column if not exists session_key text;
+
+-- Append-only activity log for actions page versions don't cover
+-- (publish/delete/user/media/form/redirect events).
+create table if not exists cms_activity (
+  id bigint generated always as identity primary key,
+  actor uuid,
+  actor_name text not null default '',
+  action text not null,
+  subject text not null default '',
+  created_at timestamptz not null default now()
+);
+create index if not exists cms_activity_created_idx on cms_activity (created_at desc);
+
+-- 2) Functions (atomic write paths, called via RPC with service role) --------
+
+create or replace function cms_save_page_draft(
+  p_page_id uuid,
+  p_title text,
+  p_seo jsonb,
+  p_layout jsonb,
+  p_actor uuid default null,
+  p_mark_builder_owned boolean default true
+) returns cms_pages
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  result cms_pages;
+  latest cms_page_versions;
+begin
+  update cms_pages
+  set title = coalesce(p_title, title),
+      seo = coalesce(p_seo, seo),
+      draft_layout = coalesce(p_layout, draft_layout),
+      builder_owned = builder_owned or p_mark_builder_owned,
+      updated_at = now()
+  where id = p_page_id
+  returning * into result;
+
+  if result.id is null then
+    raise exception 'page % not found', p_page_id;
+  end if;
+
+  -- Autosave fires every few seconds of editing; only snapshot when the
+  -- content actually changed so history stays meaningful.
+  select * into latest from cms_page_versions
+    where page_id = p_page_id
+    order by created_at desc, id desc limit 1;
+
+  if latest.id is null
+     or latest.title is distinct from result.title
+     or latest.seo is distinct from result.seo
+     or latest.layout is distinct from result.draft_layout then
+    insert into cms_page_versions (page_id, kind, title, seo, layout, created_by)
+    values (p_page_id, 'draft', result.title, result.seo, result.draft_layout, p_actor);
+  end if;
+
+  return result;
+end;
+$$;
+
+create or replace function cms_publish_page(
+  p_page_id uuid,
+  p_actor uuid default null
+) returns cms_pages
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  result cms_pages;
+begin
+  update cms_pages
+  set published_layout = draft_layout,
+      status = 'published',
+      published_at = now(),
+      updated_at = now()
+  where id = p_page_id
+  returning * into result;
+
+  if result.id is null then
+    raise exception 'page % not found', p_page_id;
+  end if;
+
+  insert into cms_page_versions (page_id, kind, title, seo, layout, created_by)
+  values (p_page_id, 'publish', result.title, result.seo, result.published_layout, p_actor);
+
+  return result;
+end;
+$$;
+
+create or replace function cms_restore_page_version(
+  p_version_id bigint,
+  p_actor uuid default null
+) returns cms_pages
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  v cms_page_versions;
+  result cms_pages;
+begin
+  select * into v from cms_page_versions where id = p_version_id;
+  if v.id is null then
+    raise exception 'version % not found', p_version_id;
+  end if;
+
+  update cms_pages
+  set draft_layout = v.layout,
+      title = v.title,
+      seo = v.seo,
+      builder_owned = true,
+      updated_at = now()
+  where id = v.page_id
+  returning * into result;
+
+  insert into cms_page_versions (page_id, kind, title, seo, layout, created_by)
+  values (v.page_id, 'restore', v.title, v.seo, v.layout, p_actor);
+
+  return result;
+end;
+$$;
+
+-- Content-as-code sync upsert: creates or updates a page; layout is only
+-- written when the page is not builder-owned (or on create).
+create or replace function cms_sync_page(
+  p_slug text,
+  p_path text,
+  p_title text,
+  p_seo jsonb,
+  p_layout jsonb
+) returns cms_pages
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  result cms_pages;
+  latest cms_page_versions;
+begin
+  -- builder_owned pages belong to the Studio: sync only ensures they exist.
+  -- Overwriting title/seo/path here would silently revert Studio edits
+  -- (SEO drawer, address renames) on the next deploy sync.
+  insert into cms_pages (slug, path, title, seo, draft_layout, published_layout, status, published_at)
+  values (p_slug, p_path, p_title, p_seo, p_layout, p_layout, 'published', now())
+  on conflict (slug) do update
+  set path = case when cms_pages.builder_owned then cms_pages.path else excluded.path end,
+      title = case when cms_pages.builder_owned then cms_pages.title else excluded.title end,
+      seo = case when cms_pages.builder_owned then cms_pages.seo else excluded.seo end,
+      draft_layout = case when cms_pages.builder_owned then cms_pages.draft_layout else excluded.draft_layout end,
+      published_layout = case when cms_pages.builder_owned then cms_pages.published_layout else excluded.published_layout end,
+      updated_at = case when cms_pages.builder_owned then cms_pages.updated_at else now() end
+  returning * into result;
+
+  -- Snapshot only when the sync actually changed something (idempotent
+  -- re-syncs and builder-owned pages would otherwise pile up noise rows).
+  select * into latest from cms_page_versions
+    where page_id = result.id
+    order by created_at desc, id desc limit 1;
+
+  if latest.id is null
+     or latest.title is distinct from result.title
+     or latest.seo is distinct from result.seo
+     or latest.layout is distinct from result.draft_layout then
+    insert into cms_page_versions (page_id, kind, title, seo, layout)
+    values (result.id, 'sync', result.title, result.seo, result.draft_layout);
+  end if;
+
+  return result;
+end;
+$$;
+
+-- 3) Row-level security -------------------------------------------------------
+-- Defense-in-depth. The app's API layer (service role) is the primary
+-- enforcement point; anonymous access is read-only and published-only.
+
+alter table cms_settings enable row level security;
+alter table cms_profiles enable row level security;
+alter table cms_pages enable row level security;
+alter table cms_page_versions enable row level security;
+alter table cms_globals enable row level security;
+alter table cms_media enable row level security;
+alter table cms_forms enable row level security;
+alter table cms_form_submissions enable row level security;
+alter table cms_global_versions enable row level security;
+alter table cms_redirects enable row level security;
+alter table cms_activity enable row level security;
+alter table cms_events enable row level security;
+-- cms_events: no anon policies or grants — ingest and reads go through the
+-- API layer only.
+
+-- Redirects are public data (the site resolves them anonymously).
+drop policy if exists cms_redirects_public_read on cms_redirects;
+create policy cms_redirects_public_read on cms_redirects
+  for select using (true);
+
+-- Public (anon) read policies: published content only.
+drop policy if exists cms_pages_public_read on cms_pages;
+create policy cms_pages_public_read on cms_pages
+  for select using (status = 'published');
+
+drop policy if exists cms_globals_public_read on cms_globals;
+create policy cms_globals_public_read on cms_globals
+  for select using (true);
+
+drop policy if exists cms_media_public_read on cms_media;
+create policy cms_media_public_read on cms_media
+  for select using (true);
+
+drop policy if exists cms_forms_public_read on cms_forms;
+create policy cms_forms_public_read on cms_forms
+  for select using (true);
+
+-- Authenticated users can read their own profile. Optional nicety: Studio
+-- reads profiles through the service role, so nothing depends on this policy.
+-- Referencing auth.uid() requires USAGE on the auth schema, which restricted
+-- roles may lack — skip gracefully instead of failing the whole bootstrap.
+do $profiles_policy$
+begin
+  drop policy if exists cms_profiles_self_read on cms_profiles;
+  execute 'create policy cms_profiles_self_read on cms_profiles '
+    || 'for select using (auth.uid() = user_id)';
+exception when insufficient_privilege then
+  raise notice 'Skipped cms_profiles_self_read policy (no auth schema access).';
+end $profiles_policy$;
+
+-- No anon/authenticated write policies: all writes flow through the API layer
+-- (service role bypasses RLS and enforces the permission matrix in code).
+
+-- 6a) Function execution lockdown ---------------------------------------------
+-- The write-path functions are SECURITY DEFINER (they run with their owner's
+-- table privileges). Postgres grants EXECUTE to PUBLIC on new functions by
+-- default and Supabase exposes public-schema functions as RPC, so without an
+-- explicit revoke the anon key could call them and bypass RLS + the API
+-- permission matrix. Only the API layer (service role) may execute them.
+do $fn_lockdown$
+declare
+  fn text;
+  fns text[] := array[
+    'cms_save_page_draft(uuid, text, jsonb, jsonb, uuid, boolean)',
+    'cms_publish_page(uuid, uuid)',
+    'cms_restore_page_version(bigint, uuid)',
+    'cms_sync_page(text, text, text, jsonb, jsonb)'
+  ];
+begin
+  foreach fn in array fns loop
+    execute format('revoke execute on function %s from public', fn);
+    if exists (select 1 from pg_roles where rolname = 'anon') then
+      execute format('revoke execute on function %s from anon', fn);
+    end if;
+    if exists (select 1 from pg_roles where rolname = 'authenticated') then
+      execute format('revoke execute on function %s from authenticated', fn);
+    end if;
+    if exists (select 1 from pg_roles where rolname = 'service_role') then
+      execute format('grant execute on function %s to service_role', fn);
+    end if;
+  end loop;
+end $fn_lockdown$;
+
+-- 6) Grants -------------------------------------------------------------------
+-- RLS policies FILTER rows but don't grant table access. Supabase's default
+-- privileges only cover tables created by `postgres`; when bootstrap runs as a
+-- site-specific role, the PostgREST roles get nothing — so grant explicitly.
+-- Wrapped per-role so bootstrap also works on plain Postgres (dev/tests).
+do $grants$
+begin
+  if exists (select 1 from pg_roles where rolname = 'service_role') then
+    grant select, insert, update, delete on
+      cms_settings, cms_profiles, cms_pages, cms_page_versions,
+      cms_globals, cms_media, cms_forms, cms_form_submissions,
+      cms_global_versions, cms_redirects, cms_activity, cms_events
+      to service_role;
+  end if;
+
+  -- cms_pages and cms_forms get COLUMN-level read grants: anonymous readers
+  -- must never see draft_layout (unpublished work) or notify (staff emails).
+  if exists (select 1 from pg_roles where rolname = 'anon') then
+    grant select on cms_globals, cms_media, cms_redirects to anon;
+    revoke select on cms_pages from anon;
+    grant select (id, slug, path, title, seo, status, published_layout, published_at, created_at, updated_at)
+      on cms_pages to anon;
+    revoke select on cms_forms from anon;
+    grant select (id, slug, title, config, success_message, created_at, updated_at)
+      on cms_forms to anon;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'authenticated') then
+    grant select on cms_globals, cms_media, cms_profiles, cms_redirects to authenticated;
+    revoke select on cms_pages from authenticated;
+    grant select (id, slug, path, title, seo, status, published_layout, published_at, created_at, updated_at)
+      on cms_pages to authenticated;
+    revoke select on cms_forms from authenticated;
+    grant select (id, slug, title, config, success_message, created_at, updated_at)
+      on cms_forms to authenticated;
+  end if;
+end $grants$;

package/sql/migrations/0001_atomic_scheduled_publish.sql

@@ -0,0 +1,68 @@
+-- Atomic scheduled publishing.
+--
+-- The previous flow read all pages, filtered due ones in JS, then published
+-- and cleared publish_at in separate statements — so two concurrent runs (two
+-- cron invocations, or a cron plus a dashboard open) could publish the same
+-- page twice. This function claims due rows with FOR UPDATE SKIP LOCKED and
+-- publishes + clears + snapshots each in one transaction, so a page is
+-- published at most once no matter how many workers run.
+
+-- Only due, scheduled pages need scanning.
+create index if not exists cms_pages_publish_at_due_idx
+  on cms_pages (publish_at)
+  where publish_at is not null;
+
+create or replace function cms_publish_due_pages()
+returns setof text
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  due record;
+begin
+  for due in
+    select id, path
+    from cms_pages
+    where publish_at is not null
+      and publish_at <= now()
+    order by publish_at
+    for update skip locked
+  loop
+    update cms_pages
+    set published_layout = draft_layout,
+        status = 'published',
+        published_at = now(),
+        publish_at = null,
+        updated_at = now()
+    where id = due.id;
+
+    insert into cms_page_versions (page_id, kind, title, seo, layout, created_by)
+    select id, 'publish', title, seo, published_layout, null
+    from cms_pages
+    where id = due.id;
+
+    insert into cms_activity (action, subject)
+    values ('page.publish.scheduled', due.path);
+
+    return next due.path;
+  end loop;
+  return;
+end;
+$$;
+
+-- Same execution lockdown as the other write functions: only the API's
+-- service role may call it (never anon / authenticated).
+revoke execute on function cms_publish_due_pages() from public;
+do $lockdown$
+begin
+  if exists (select 1 from pg_roles where rolname = 'anon') then
+    revoke execute on function cms_publish_due_pages() from anon;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'authenticated') then
+    revoke execute on function cms_publish_due_pages() from authenticated;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'service_role') then
+    grant execute on function cms_publish_due_pages() to service_role;
+  end if;
+end $lockdown$;

package/sql/migrations/0002_rate_limits.sql

@@ -0,0 +1,62 @@
+-- Durable, atomic rate limiting for public endpoints (form submit, analytics
+-- ingest). The previous limiter counted rows in per-lambda memory (no global
+-- limit across serverless instances) or counted submissions then inserted
+-- separately (a count-then-insert race let N concurrent requests all pass).
+--
+-- cms_rate_limit_consume() consumes one token and reports whether the caller is
+-- still within budget in a single atomic upsert — no read-modify-write gap.
+
+create table if not exists cms_rate_limits (
+  key          text primary key,
+  window_start timestamptz not null default now(),
+  count        integer not null default 0
+);
+
+create or replace function cms_rate_limit_consume(
+  p_key text,
+  p_max integer,
+  p_window_seconds integer
+) returns boolean  -- true = allowed, false = over the limit
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  v_count integer;
+begin
+  insert into cms_rate_limits (key, window_start, count)
+  values (p_key, now(), 1)
+  on conflict (key) do update
+    set count = case
+          when cms_rate_limits.window_start < now() - make_interval(secs => p_window_seconds)
+          then 1
+          else cms_rate_limits.count + 1
+        end,
+        window_start = case
+          when cms_rate_limits.window_start < now() - make_interval(secs => p_window_seconds)
+          then now()
+          else cms_rate_limits.window_start
+        end
+  returning count into v_count;
+
+  return v_count <= p_max;
+end;
+$$;
+
+-- Lets the cron prune stale rows so the table stays small.
+create index if not exists cms_rate_limits_window_idx on cms_rate_limits (window_start);
+
+-- Service-role only, like the other write functions.
+revoke execute on function cms_rate_limit_consume(text, integer, integer) from public;
+do $lockdown$
+begin
+  if exists (select 1 from pg_roles where rolname = 'anon') then
+    revoke execute on function cms_rate_limit_consume(text, integer, integer) from anon;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'authenticated') then
+    revoke execute on function cms_rate_limit_consume(text, integer, integer) from authenticated;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'service_role') then
+    grant execute on function cms_rate_limit_consume(text, integer, integer) to service_role;
+  end if;
+end $lockdown$;

package/sql/migrations/0003_atomic_global_update.sql

@@ -0,0 +1,46 @@
+-- Atomic global update + version snapshot.
+--
+-- Previously updateGlobal upserted cms_globals then inserted the version
+-- snapshot in a separate statement: if the snapshot failed, the global was
+-- changed with no recoverable history. This function does both in one
+-- transaction, so a global is always snapshotted exactly when it changes.
+
+create or replace function cms_update_global(
+  p_key text,
+  p_data jsonb,
+  p_actor uuid default null
+) returns cms_globals
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  result cms_globals;
+begin
+  insert into cms_globals (key, data, updated_at)
+  values (p_key, p_data, now())
+  on conflict (key) do update
+    set data = excluded.data,
+        updated_at = now()
+  returning * into result;
+
+  insert into cms_global_versions (key, data, created_by)
+  values (p_key, p_data, p_actor);
+
+  return result;
+end;
+$$;
+
+revoke execute on function cms_update_global(text, jsonb, uuid) from public;
+do $lockdown$
+begin
+  if exists (select 1 from pg_roles where rolname = 'anon') then
+    revoke execute on function cms_update_global(text, jsonb, uuid) from anon;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'authenticated') then
+    revoke execute on function cms_update_global(text, jsonb, uuid) from authenticated;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'service_role') then
+    grant execute on function cms_update_global(text, jsonb, uuid) to service_role;
+  end if;
+end $lockdown$;

package/sql/migrations/0004_analytics_visitor_tracking.sql

@@ -0,0 +1,8 @@
+-- Add the pseudonymous, consented cross-day identity used by analytics v0.5.
+-- The browser's raw UUID is HMAC-hashed by the API before this table is touched.
+alter table cms_events
+  add column if not exists visitor_key text not null default '';
+
+create index if not exists cms_events_visitor_idx
+  on cms_events (visitor_key, created_at)
+  where visitor_key <> '';