@orion-studios/cms 0.5.2 → 0.5.3

package/dist/server/index.js

@@ -2204,6 +2204,9 @@ function runRpc(store, fn, args = {}) {
       }
       const version = reviewedVersion(page, args.p_expected_version_id);
       if (!version) return versionConflict("the expected draft is missing or stale");
+      if (page.published_version_id === version.id) {
+        return versionConflict("the expected draft is already published");
+      }
       page.publish_at = args.p_publish_at;
       page.scheduled_version_id = version.id;
       page.updated_at = nowIso();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orion-studios/cms",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "Orion CMS v2 core engine \u2014 JSONB content model on Supabase primitives",
   "type": "module",
   "exports": {

package/sql/bootstrap.sql

@@ -152,6 +152,16 @@ set publish_at = null,
 where publish_at is not null
   and scheduled_version_id is null;
 
+-- A published version is not a future publication candidate. Clear invalid
+-- schedules left by versions of the scheduling function that omitted this
+-- guard, so repeated bootstrap runs repair existing databases fail closed.
+update cms_pages
+set publish_at = null,
+    scheduled_version_id = null,
+    updated_at = now()
+where scheduled_version_id is not null
+  and scheduled_version_id = published_version_id;
+
 create unique index if not exists cms_page_versions_page_id_id_idx
   on cms_page_versions (page_id, id);
 create index if not exists cms_pages_scheduled_publish_due_idx
@@ -624,6 +634,10 @@ begin
     raise exception 'Page version conflict: expected draft is missing or stale';
   end if;
 
+  if current_page.published_version_id = p_expected_version_id then
+    raise exception 'Page version conflict: expected draft is already published';
+  end if;
+
   update cms_pages
   set publish_at = p_publish_at,
       scheduled_version_id = reviewed.id,

package/sql/migrations/20260820170000_sec_005_reject_published_version_schedule.sql

@@ -0,0 +1,88 @@
+-- SEC-005: reject scheduling a version that is already published.
+
+-- Repair schedules accepted by the 0.5.2 function. The version is already
+-- public, so there is no future immutable draft to publish. Editors must
+-- explicitly select a newer draft.
+update cms_pages
+set publish_at = null,
+    scheduled_version_id = null,
+    updated_at = now()
+where scheduled_version_id is not null
+  and scheduled_version_id = published_version_id;
+
+create or replace function cms_schedule_page_publish(
+  p_page_id uuid,
+  p_expected_version_id bigint,
+  p_publish_at timestamptz,
+  p_actor uuid
+) returns cms_pages
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  current_page cms_pages;
+  reviewed cms_page_versions;
+  result cms_pages;
+begin
+  select * into current_page
+  from cms_pages
+  where id = p_page_id
+  for update;
+
+  if current_page.id is null then
+    raise exception 'page % not found', p_page_id;
+  end if;
+
+  if p_publish_at is null then
+    update cms_pages
+    set publish_at = null,
+        scheduled_version_id = null,
+        updated_at = now()
+    where id = p_page_id
+    returning * into result;
+    return result;
+  end if;
+
+  select * into reviewed
+  from cms_page_versions
+  where id = p_expected_version_id
+    and page_id = p_page_id;
+
+  if reviewed.id is null
+     or current_page.draft_version_id is distinct from p_expected_version_id
+     or reviewed.title is distinct from current_page.title
+     or reviewed.seo is distinct from current_page.seo
+     or reviewed.layout is distinct from current_page.draft_layout then
+    raise exception 'Page version conflict: expected draft is missing or stale';
+  end if;
+
+  if current_page.published_version_id = p_expected_version_id then
+    raise exception 'Page version conflict: expected draft is already published';
+  end if;
+
+  update cms_pages
+  set publish_at = p_publish_at,
+      scheduled_version_id = reviewed.id,
+      updated_at = now()
+  where id = p_page_id
+  returning * into result;
+
+  return result;
+end;
+$$;
+
+do $fn_lockdown$
+begin
+  revoke execute on function cms_schedule_page_publish(uuid, bigint, timestamptz, uuid) from public;
+  if exists (select 1 from pg_roles where rolname = 'anon') then
+    revoke execute on function cms_schedule_page_publish(uuid, bigint, timestamptz, uuid) from anon;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'authenticated') then
+    revoke execute on function cms_schedule_page_publish(uuid, bigint, timestamptz, uuid) from authenticated;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'service_role') then
+    grant execute on function cms_schedule_page_publish(uuid, bigint, timestamptz, uuid) to service_role;
+  end if;
+end
+$fn_lockdown$;