@orion-studios/cms 0.5.1 → 0.5.2

package/sql/migrations/20260820033957_sec_003_exact_version_publication.sql

@@ -0,0 +1,575 @@
+-- SEC-003: exact-version publication and published metadata separation.
+
+alter table cms_pages add column if not exists published_title text;
+alter table cms_pages add column if not exists published_seo jsonb;
+alter table cms_pages add column if not exists draft_version_id bigint;
+alter table cms_pages add column if not exists published_version_id bigint;
+alter table cms_pages add column if not exists scheduled_version_id bigint;
+
+-- Existing public metadata comes from the newest publish or sync snapshot
+-- whose layout matches what is already public. This avoids promoting a later
+-- draft title or SEO value during migration.
+update cms_pages
+set published_layout = '[]'::jsonb
+where status = 'published' and published_layout is null;
+
+with published_history as (
+  select distinct on (p.id)
+    p.id as page_id,
+    v.id as version_id,
+    v.title,
+    v.seo
+  from cms_pages p
+  join cms_page_versions v
+    on v.page_id = p.id
+   and v.kind in ('publish', 'sync')
+   and v.layout is not distinct from p.published_layout
+  where p.status = 'published'
+  order by p.id, v.created_at desc, v.id desc
+)
+update cms_pages p
+set published_title = h.title,
+    published_seo = h.seo,
+    published_version_id = h.version_id
+from published_history h
+where p.id = h.page_id
+  and p.published_version_id is null;
+
+-- If no publication history exists, freeze the metadata and layout that were
+-- already public and create an immutable baseline version for them.
+with inserted as (
+  insert into cms_page_versions (page_id, kind, title, seo, layout)
+  select id, 'publish', title, seo, published_layout
+  from cms_pages
+  where status = 'published'
+    and published_version_id is null
+  returning id, page_id, title, seo
+)
+update cms_pages p
+set published_title = i.title,
+    published_seo = i.seo,
+    published_version_id = i.id
+from inserted i
+where p.id = i.page_id;
+
+-- Bind every current draft to an existing exact snapshot when possible.
+with draft_history as (
+  select distinct on (p.id)
+    p.id as page_id,
+    v.id as version_id
+  from cms_pages p
+  join cms_page_versions v
+    on v.page_id = p.id
+   and v.title is not distinct from p.title
+   and v.seo is not distinct from p.seo
+   and v.layout is not distinct from p.draft_layout
+  order by p.id, v.created_at desc, v.id desc
+)
+update cms_pages p
+set draft_version_id = h.version_id
+from draft_history h
+where p.id = h.page_id
+  and p.draft_version_id is null;
+
+with inserted as (
+  insert into cms_page_versions (page_id, kind, title, seo, layout)
+  select id, 'draft', title, seo, draft_layout
+  from cms_pages
+  where draft_version_id is null
+  returning id, page_id
+)
+update cms_pages p
+set draft_version_id = i.id
+from inserted i
+where p.id = i.page_id;
+
+-- A legacy timestamp cannot prove which draft was reviewed. Clear the
+-- incomplete schedule so an editor must explicitly bind an exact version.
+update cms_pages
+set publish_at = null,
+    scheduled_version_id = null
+where publish_at is not null
+  and scheduled_version_id is null;
+
+create unique index if not exists cms_page_versions_page_id_id_idx
+  on cms_page_versions (page_id, id);
+create index if not exists cms_pages_scheduled_publish_due_idx
+  on cms_pages (publish_at)
+  where publish_at is not null and scheduled_version_id is not null;
+
+do $constraints$
+begin
+  if not exists (
+    select 1 from pg_constraint where conname = 'cms_pages_draft_version_fk' and conrelid = 'cms_pages'::regclass
+  ) then
+    alter table cms_pages
+      add constraint cms_pages_draft_version_fk
+      foreign key (id, draft_version_id)
+      references cms_page_versions (page_id, id);
+  end if;
+
+  if not exists (
+    select 1 from pg_constraint where conname = 'cms_pages_published_version_fk' and conrelid = 'cms_pages'::regclass
+  ) then
+    alter table cms_pages
+      add constraint cms_pages_published_version_fk
+      foreign key (id, published_version_id)
+      references cms_page_versions (page_id, id);
+  end if;
+
+  if not exists (
+    select 1 from pg_constraint where conname = 'cms_pages_scheduled_version_fk' and conrelid = 'cms_pages'::regclass
+  ) then
+    alter table cms_pages
+      add constraint cms_pages_scheduled_version_fk
+      foreign key (id, scheduled_version_id)
+      references cms_page_versions (page_id, id);
+  end if;
+
+  if not exists (
+    select 1 from pg_constraint where conname = 'cms_pages_schedule_version_pair' and conrelid = 'cms_pages'::regclass
+  ) then
+    alter table cms_pages
+      add constraint cms_pages_schedule_version_pair
+      check ((publish_at is null) = (scheduled_version_id is null));
+  end if;
+
+  if not exists (
+    select 1 from pg_constraint where conname = 'cms_pages_published_state_complete' and conrelid = 'cms_pages'::regclass
+  ) then
+    alter table cms_pages
+      add constraint cms_pages_published_state_complete
+      check (
+        status <> 'published'
+        or (
+          published_title is not null
+          and published_seo is not null
+          and published_layout is not null
+          and published_version_id is not null
+        )
+      );
+  end if;
+end
+$constraints$;
+
+create or replace function cms_save_page_draft(
+  p_page_id uuid,
+  p_title text,
+  p_seo jsonb,
+  p_layout jsonb,
+  p_actor uuid default null,
+  p_mark_builder_owned boolean default true
+) returns cms_pages
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  current_page cms_pages;
+  result cms_pages;
+  version_id bigint;
+  next_title text;
+  next_seo jsonb;
+  next_layout jsonb;
+begin
+  select * into current_page
+  from cms_pages
+  where id = p_page_id
+  for update;
+
+  if current_page.id is null then
+    raise exception 'page % not found', p_page_id;
+  end if;
+
+  next_title := coalesce(p_title, current_page.title);
+  next_seo := coalesce(p_seo, current_page.seo);
+  next_layout := coalesce(p_layout, current_page.draft_layout);
+
+  select id into version_id
+  from cms_page_versions
+  where page_id = p_page_id
+    and title is not distinct from next_title
+    and seo is not distinct from next_seo
+    and layout is not distinct from next_layout
+  order by created_at desc, id desc
+  limit 1;
+
+  if version_id is null then
+    insert into cms_page_versions (page_id, kind, title, seo, layout, created_by)
+    values (p_page_id, 'draft', next_title, next_seo, next_layout, p_actor)
+    returning id into version_id;
+  end if;
+
+  update cms_pages
+  set title = next_title,
+      seo = next_seo,
+      draft_layout = next_layout,
+      draft_version_id = version_id,
+      builder_owned = builder_owned or p_mark_builder_owned,
+      updated_at = now()
+  where id = p_page_id
+  returning * into result;
+
+  return result;
+end;
+$$;
+
+-- The old signature remains only to fail closed for stale application code.
+create or replace function cms_publish_page(
+  p_page_id uuid,
+  p_actor uuid default null
+) returns cms_pages
+language plpgsql
+security definer
+set search_path = public
+as $$
+begin
+  raise exception 'Page version conflict: expected version is required';
+end;
+$$;
+
+create or replace function cms_publish_page(
+  p_page_id uuid,
+  p_expected_version_id bigint,
+  p_actor uuid
+) returns cms_pages
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  current_page cms_pages;
+  reviewed cms_page_versions;
+  result cms_pages;
+begin
+  select * into current_page
+  from cms_pages
+  where id = p_page_id
+  for update;
+
+  if current_page.id is null then
+    raise exception 'page % not found', p_page_id;
+  end if;
+
+  select * into reviewed
+  from cms_page_versions
+  where id = p_expected_version_id
+    and page_id = p_page_id;
+
+  if reviewed.id is null
+     or current_page.draft_version_id is distinct from p_expected_version_id
+     or reviewed.title is distinct from current_page.title
+     or reviewed.seo is distinct from current_page.seo
+     or reviewed.layout is distinct from current_page.draft_layout then
+    raise exception 'Page version conflict: expected draft is missing or stale';
+  end if;
+
+  if current_page.status = 'published'
+     and current_page.published_version_id = p_expected_version_id then
+    raise exception 'Page version conflict: expected draft is already published';
+  end if;
+
+  update cms_pages
+  set published_title = reviewed.title,
+      published_seo = reviewed.seo,
+      published_layout = reviewed.layout,
+      published_version_id = reviewed.id,
+      status = 'published',
+      published_at = now(),
+      publish_at = null,
+      scheduled_version_id = null,
+      updated_at = now()
+  where id = p_page_id
+  returning * into result;
+
+  return result;
+end;
+$$;
+
+create or replace function cms_schedule_page_publish(
+  p_page_id uuid,
+  p_expected_version_id bigint,
+  p_publish_at timestamptz,
+  p_actor uuid
+) returns cms_pages
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  current_page cms_pages;
+  reviewed cms_page_versions;
+  result cms_pages;
+begin
+  select * into current_page
+  from cms_pages
+  where id = p_page_id
+  for update;
+
+  if current_page.id is null then
+    raise exception 'page % not found', p_page_id;
+  end if;
+
+  if p_publish_at is null then
+    update cms_pages
+    set publish_at = null,
+        scheduled_version_id = null,
+        updated_at = now()
+    where id = p_page_id
+    returning * into result;
+    return result;
+  end if;
+
+  select * into reviewed
+  from cms_page_versions
+  where id = p_expected_version_id
+    and page_id = p_page_id;
+
+  if reviewed.id is null
+     or current_page.draft_version_id is distinct from p_expected_version_id
+     or reviewed.title is distinct from current_page.title
+     or reviewed.seo is distinct from current_page.seo
+     or reviewed.layout is distinct from current_page.draft_layout then
+    raise exception 'Page version conflict: expected draft is missing or stale';
+  end if;
+
+  update cms_pages
+  set publish_at = p_publish_at,
+      scheduled_version_id = reviewed.id,
+      updated_at = now()
+  where id = p_page_id
+  returning * into result;
+
+  return result;
+end;
+$$;
+
+create or replace function cms_restore_page_version(
+  p_version_id bigint,
+  p_actor uuid default null
+) returns cms_pages
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  v cms_page_versions;
+  result cms_pages;
+  restored_version_id bigint;
+begin
+  select * into v from cms_page_versions where id = p_version_id;
+  if v.id is null then
+    raise exception 'version % not found', p_version_id;
+  end if;
+
+  perform 1 from cms_pages where id = v.page_id for update;
+
+  insert into cms_page_versions (page_id, kind, title, seo, layout, created_by)
+  values (v.page_id, 'restore', v.title, v.seo, v.layout, p_actor)
+  returning id into restored_version_id;
+
+  update cms_pages
+  set draft_layout = v.layout,
+      title = v.title,
+      seo = v.seo,
+      draft_version_id = restored_version_id,
+      builder_owned = true,
+      updated_at = now()
+  where id = v.page_id
+  returning * into result;
+
+  return result;
+end;
+$$;
+
+create or replace function cms_sync_page(
+  p_slug text,
+  p_path text,
+  p_title text,
+  p_seo jsonb,
+  p_layout jsonb
+) returns cms_pages
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  result cms_pages;
+  version_id bigint;
+  is_new boolean := false;
+begin
+  insert into cms_pages (
+    slug, path, title, seo, draft_layout,
+    published_title, published_seo, published_layout,
+    status, published_at
+  )
+  values (
+    p_slug, p_path, p_title, p_seo, p_layout,
+    p_title, p_seo, p_layout,
+    'draft', null
+  )
+  on conflict (slug) do nothing
+  returning * into result;
+
+  if result.id is not null then
+    is_new := true;
+  else
+    select * into result
+    from cms_pages
+    where slug = p_slug
+    for update;
+
+    if not result.builder_owned then
+      update cms_pages
+      set path = p_path,
+          title = p_title,
+          seo = p_seo,
+          draft_layout = p_layout,
+          published_title = p_title,
+          published_seo = p_seo,
+          published_layout = p_layout,
+          updated_at = now()
+      where id = result.id
+      returning * into result;
+    end if;
+  end if;
+
+  select id into version_id
+  from cms_page_versions
+  where page_id = result.id
+    and title is not distinct from result.title
+    and seo is not distinct from result.seo
+    and layout is not distinct from result.draft_layout
+  order by created_at desc, id desc
+  limit 1;
+
+  if version_id is null then
+    insert into cms_page_versions (page_id, kind, title, seo, layout)
+    values (result.id, 'sync', result.title, result.seo, result.draft_layout)
+    returning id into version_id;
+  end if;
+
+  if not result.builder_owned then
+    update cms_pages
+    set draft_version_id = version_id,
+        published_version_id = version_id,
+        status = case when is_new then 'published' else status end,
+        published_at = case when is_new then now() else published_at end
+    where id = result.id
+    returning * into result;
+  end if;
+
+  return result;
+end;
+$$;
+
+create or replace function cms_publish_due_pages()
+returns setof text
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  due record;
+begin
+  for due in
+    select
+      p.id,
+      p.path,
+      v.id as version_id,
+      v.title,
+      v.seo,
+      v.layout
+    from cms_pages p
+    join cms_page_versions v
+      on v.page_id = p.id
+     and v.id = p.scheduled_version_id
+    where p.publish_at is not null
+      and p.publish_at <= now()
+      and p.scheduled_version_id is not null
+    order by p.publish_at
+    for update of p skip locked
+  loop
+    update cms_pages
+    set published_title = due.title,
+        published_seo = due.seo,
+        published_layout = due.layout,
+        published_version_id = due.version_id,
+        status = 'published',
+        published_at = now(),
+        publish_at = null,
+        scheduled_version_id = null,
+        updated_at = now()
+    where id = due.id;
+
+    insert into cms_activity (action, subject)
+    values ('page.publish.scheduled', due.path);
+
+    return next due.path;
+  end loop;
+  return;
+end;
+$$;
+
+do $fn_lockdown$
+declare
+  fn text;
+  fns text[] := array[
+    'cms_save_page_draft(uuid, text, jsonb, jsonb, uuid, boolean)',
+    'cms_publish_page(uuid, uuid)',
+    'cms_publish_page(uuid, bigint, uuid)',
+    'cms_schedule_page_publish(uuid, bigint, timestamptz, uuid)',
+    'cms_restore_page_version(bigint, uuid)',
+    'cms_sync_page(text, text, text, jsonb, jsonb)',
+    'cms_publish_due_pages()'
+  ];
+begin
+  foreach fn in array fns loop
+    execute format('revoke execute on function %s from public', fn);
+    if exists (select 1 from pg_roles where rolname = 'anon') then
+      execute format('revoke execute on function %s from anon', fn);
+    end if;
+    if exists (select 1 from pg_roles where rolname = 'authenticated') then
+      execute format('revoke execute on function %s from authenticated', fn);
+    end if;
+    if exists (select 1 from pg_roles where rolname = 'service_role') then
+      execute format('grant execute on function %s to service_role', fn);
+    end if;
+  end loop;
+end
+$fn_lockdown$;
+
+revoke update, delete on cms_page_versions from public;
+do $version_grants$
+begin
+  if exists (select 1 from pg_roles where rolname = 'anon') then
+    revoke all on cms_page_versions from anon;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'authenticated') then
+    revoke all on cms_page_versions from authenticated;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'service_role') then
+    revoke update, delete on cms_page_versions from service_role;
+    grant select, insert on cms_page_versions to service_role;
+  end if;
+end
+$version_grants$;
+
+do $public_page_grants$
+begin
+  if exists (select 1 from pg_roles where rolname = 'anon') then
+    revoke select on cms_pages from anon;
+    grant select (
+      id, slug, path, published_title, published_seo, status,
+      published_layout, published_at, created_at, updated_at
+    ) on cms_pages to anon;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'authenticated') then
+    revoke select on cms_pages from authenticated;
+    grant select (
+      id, slug, path, published_title, published_seo, status,
+      published_layout, published_at, created_at, updated_at
+    ) on cms_pages to authenticated;
+  end if;
+end
+$public_page_grants$;