@orion-studios/cms 0.5.2 → 0.5.4

package/dist/server/index.js

@@ -389,7 +389,7 @@ var MIN_ROLE = {
   "pages.delete": "admin",
   "pages.restore": "editor",
   "globals.read": "content",
-  "globals.write": "content",
+  "globals.write": "editor",
   "media.read": "content",
   "media.upload": "content",
   "media.update": "content",
@@ -663,6 +663,8 @@ var errors = {
 var isRecord2 = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
 var SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var PATH_PATTERN = /^\/(?:[a-z0-9-]+(?:\/[a-z0-9-]+)*)?$/;
+var USER_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var canonicalizeUserId = (value) => USER_ID_PATTERN.test(value) ? value.toLowerCase() : null;
 var DEFAULT_MAX_UPLOAD_BYTES = 15 * 1024 * 1024;
 var ALLOWED_UPLOAD_TYPES = /* @__PURE__ */ new Set([
   "image/jpeg",
@@ -1706,23 +1708,30 @@ function createCmsRoutes(options) {
   const listUsers = async (request) => {
     const auth = await guard(request, "users.manage");
     if (auth instanceof Response) return auth;
-    const { data: authData, error: authError } = await db().auth.admin.listUsers({ perPage: 1e3 });
-    if (authError) return errors.badRequest(authError.message);
     const { data: profiles, error: profileError } = await db().from("cms_profiles").select("user_id, role, name");
     if (profileError) return errors.badRequest(profileError.message);
-    const roleById = new Map(
-      (profiles || []).map((profile) => [profile.user_id, profile])
-    );
-    const users = authData.users.map((user) => {
-      const profile = roleById.get(user.id);
-      return {
+    const profileById = /* @__PURE__ */ new Map();
+    for (const profile of profiles || []) {
+      const userId = typeof profile.user_id === "string" ? canonicalizeUserId(profile.user_id) : null;
+      if (!userId || !isCmsRole(profile.role)) continue;
+      profileById.set(userId, {
+        role: profile.role,
+        name: typeof profile.name === "string" ? profile.name : ""
+      });
+    }
+    const { data: authData, error: authError } = await db().auth.admin.listUsers({ perPage: 1e3 });
+    if (authError) return errors.badRequest(authError.message);
+    const users = authData.users.flatMap((user) => {
+      const canonicalUserId = canonicalizeUserId(user.id);
+      const profile = canonicalUserId ? profileById.get(canonicalUserId) : void 0;
+      return profile ? [{
         id: user.id,
         email: user.email ?? null,
-        name: profile?.name || "",
-        role: profile?.role ?? null,
+        name: profile.name,
+        role: profile.role,
         created_at: user.created_at ?? null,
         last_sign_in_at: user.last_sign_in_at ?? null
-      };
+      }] : [];
     });
     return json({ users, assignableRoles: assignableRoles(auth.user.role) });
   };
@@ -1757,20 +1766,31 @@ function createCmsRoutes(options) {
     await logActivity(auth.user, "user.create", email);
     return json({ user: { id: userId, email, name, role } }, 201);
   };
-  const targetRole = async (userId) => {
-    const { data } = await db().from("cms_profiles").select("role").eq("user_id", userId).maybeSingle();
-    return data?.role ?? null;
+  const loadMembership = async (userId) => {
+    const { data, error } = await db().from("cms_profiles").select("role").eq("user_id", userId).maybeSingle();
+    if (error) return { status: "query-error", message: error.message };
+    if (!data) return { status: "missing" };
+    if (!isCmsRole(data.role)) return { status: "invalid-role" };
+    return { status: "valid", role: data.role };
+  };
+  const membershipError = (membership) => {
+    if (membership.status === "missing") return errors.notFound();
+    if (membership.status === "invalid-role") return errors.badRequest("Invalid CMS profile role.");
+    return errors.badRequest(membership.message);
   };
   const updateUser = async (request, userId) => {
     const auth = await guard(request, "users.manage");
     if (auth instanceof Response) return auth;
+    const canonicalUserId = canonicalizeUserId(userId);
+    if (!canonicalUserId) return errors.badRequest("Invalid user ID.");
     const body = await readJson(request);
     if (!body) return errors.badRequest("Invalid body.");
-    const current = await targetRole(userId);
-    if (current && !outranksOrEqual(auth.user.role, current)) return errors.forbidden();
+    const membership = await loadMembership(canonicalUserId);
+    if (membership.status !== "valid") return membershipError(membership);
+    if (!outranksOrEqual(auth.user.role, membership.role)) return errors.forbidden();
     if (body.role !== void 0) {
       if (!isCmsRole(body.role)) return errors.badRequest("Invalid role.");
-      if (userId === auth.user.id && body.role !== auth.user.role) {
+      if (canonicalUserId === auth.user.id && body.role !== auth.user.role) {
         return errors.badRequest("You can't change your own role.");
       }
       if (!outranksOrEqual(auth.user.role, body.role)) {
@@ -1779,32 +1799,37 @@ function createCmsRoutes(options) {
     }
     if (typeof body.password === "string") {
       if (body.password.length < 8) return errors.badRequest("Password must be at least 8 characters.");
-      const { error: passwordError } = await db().auth.admin.updateUserById(userId, {
+      const { error: passwordError } = await db().auth.admin.updateUserById(canonicalUserId, {
         password: body.password
       });
       if (passwordError) return errors.badRequest(passwordError.message);
     }
     if (body.role !== void 0 || typeof body.name === "string") {
-      const patch = { user_id: userId };
+      const patch = {};
       if (body.role !== void 0) patch.role = body.role;
       if (typeof body.name === "string") patch.name = body.name.trim();
-      const { error: profileError } = await db().from("cms_profiles").upsert(patch, { onConflict: "user_id" });
+      const { error: profileError } = await db().from("cms_profiles").update(patch).eq("user_id", canonicalUserId);
       if (profileError) return errors.badRequest(profileError.message);
     }
-    await logActivity(auth.user, "user.update", userId);
+    await logActivity(auth.user, "user.update", canonicalUserId);
     return json({ success: true });
   };
   const deleteUser = async (request, userId) => {
     const auth = await guard(request, "users.manage");
     if (auth instanceof Response) return auth;
-    if (userId === auth.user.id) return errors.badRequest("You can't remove your own account.");
-    const current = await targetRole(userId);
-    if (current && !outranksOrEqual(auth.user.role, current)) return errors.forbidden();
-    const { error: authError } = await db().auth.admin.deleteUser(userId);
+    const canonicalUserId = canonicalizeUserId(userId);
+    if (!canonicalUserId) return errors.badRequest("Invalid user ID.");
+    const membership = await loadMembership(canonicalUserId);
+    if (membership.status !== "valid") return membershipError(membership);
+    if (canonicalUserId === auth.user.id) {
+      return errors.badRequest("You can't remove your own account.");
+    }
+    if (!outranksOrEqual(auth.user.role, membership.role)) return errors.forbidden();
+    const { error: authError } = await db().auth.admin.deleteUser(canonicalUserId);
     if (authError) return errors.badRequest(authError.message);
-    const { error: profileError } = await db().from("cms_profiles").delete().eq("user_id", userId);
+    const { error: profileError } = await db().from("cms_profiles").delete().eq("user_id", canonicalUserId);
     if (profileError) return errors.badRequest(profileError.message);
-    await logActivity(auth.user, "user.delete", userId);
+    await logActivity(auth.user, "user.delete", canonicalUserId);
     return json({ success: true });
   };
   const runSync = async (request) => {
@@ -2204,6 +2229,9 @@ function runRpc(store, fn, args = {}) {
       }
       const version = reviewedVersion(page, args.p_expected_version_id);
       if (!version) return versionConflict("the expected draft is missing or stale");
+      if (page.published_version_id === version.id) {
+        return versionConflict("the expected draft is already published");
+      }
       page.publish_at = args.p_publish_at;
       page.scheduled_version_id = version.id;
       page.updated_at = nowIso();

package/dist/studio/index.js

@@ -149,7 +149,7 @@ var MIN_ROLE = {
   "pages.delete": "admin",
   "pages.restore": "editor",
   "globals.read": "content",
-  "globals.write": "content",
+  "globals.write": "editor",
   "media.read": "content",
   "media.upload": "content",
   "media.update": "content",
@@ -179,13 +179,14 @@ var SECTION_ACTION = {
   forms: "forms.read",
   submissions: "submissions.read",
   analytics: "analytics.read",
-  globals: "globals.read",
+  globals: "globals.write",
   redirects: "redirects.manage",
   users: "users.manage"
 };
 var userForRole = (role) => ({ id: "", email: null, name: "", role });
 var studioCan = (role, action) => can(userForRole(role), action);
 var canViewStudioSection = (role, section) => studioCan(role, SECTION_ACTION[section]);
+var resolveStudioSection = (role, section) => role && canViewStudioSection(role, section) ? section : "dashboard";
 var studioAccess = (role) => ({
   changePageStructure: studioCan(role, "pages.changeStructure"),
   publishPages: studioCan(role, "pages.publish"),
@@ -3728,11 +3729,15 @@ function Studio({ registry, globals, siteName, logoUrl, supabaseUrl }) {
   useEffect11(() => {
     if (!session) {
       setRole(null);
+      setSection("dashboard");
+      setOpenPageId(null);
+      setSubmissionsFormId(null);
       return;
     }
     api.me().then(
       ({ user }) => {
         setRole(user.role);
+        setSection((currentSection) => resolveStudioSection(user.role, currentSection));
         refreshMedia();
         refreshUnread();
         refreshPages();
@@ -3784,6 +3789,7 @@ function Studio({ registry, globals, siteName, logoUrl, supabaseUrl }) {
   if (!role) return /* @__PURE__ */ jsx12("div", { className: "ost-root ost-loading", children: "Loading Studio\u2026" });
   const access = studioAccess(role);
   const nav = NAV.filter((item) => canViewStudioSection(role, item.key));
+  const selectedSection = resolveStudioSection(role, section);
   const goTo = (key) => {
     setSection(key);
     setOpenPageId(null);
@@ -3806,7 +3812,7 @@ function Studio({ registry, globals, siteName, logoUrl, supabaseUrl }) {
       nav.map((item) => /* @__PURE__ */ jsxs12(
         "button",
         {
-          className: `ost-nav-item${section === item.key && !openPageId ? " is-active" : ""}`,
+          className: `ost-nav-item${selectedSection === item.key && !openPageId ? " is-active" : ""}`,
           onClick: () => goTo(item.key),
           type: "button",
           children: [
@@ -3841,7 +3847,7 @@ function Studio({ registry, globals, siteName, logoUrl, supabaseUrl }) {
         role
       },
       openPageId
-    ) : section === "pages" ? /* @__PURE__ */ jsx12(PagesView, { api, canCreate: access.createPages, onOpen: openPage }) : section === "media" ? /* @__PURE__ */ jsx12(
+    ) : selectedSection === "pages" ? /* @__PURE__ */ jsx12(PagesView, { api, canCreate: access.createPages, onOpen: openPage }) : selectedSection === "media" ? /* @__PURE__ */ jsx12(
       MediaView,
       {
         api,
@@ -3852,7 +3858,7 @@ function Studio({ registry, globals, siteName, logoUrl, supabaseUrl }) {
         onChanged: refreshMedia,
         onUpload: uploadMedia
       }
-    ) : section === "forms" ? /* @__PURE__ */ jsx12(
+    ) : selectedSection === "forms" ? /* @__PURE__ */ jsx12(
       FormsView,
       {
         api,
@@ -3864,7 +3870,7 @@ function Studio({ registry, globals, siteName, logoUrl, supabaseUrl }) {
           setSection("submissions");
         }
       }
-    ) : section === "submissions" && access.readSubmissions ? /* @__PURE__ */ jsx12(
+    ) : selectedSection === "submissions" && access.readSubmissions ? /* @__PURE__ */ jsx12(
       SubmissionsView,
       {
         api,
@@ -3873,7 +3879,7 @@ function Studio({ registry, globals, siteName, logoUrl, supabaseUrl }) {
         onUnreadChanged: refreshUnread
       },
       submissionsFormId || "all"
-    ) : section === "analytics" && access.readAnalytics ? /* @__PURE__ */ jsx12(AnalyticsView, { api }) : section === "globals" ? /* @__PURE__ */ jsx12(
+    ) : selectedSection === "analytics" && access.readAnalytics ? /* @__PURE__ */ jsx12(AnalyticsView, { api }) : selectedSection === "globals" ? /* @__PURE__ */ jsx12(
       GlobalsView,
       {
         api,
@@ -3883,7 +3889,7 @@ function Studio({ registry, globals, siteName, logoUrl, supabaseUrl }) {
         onUploadMedia: uploadMedia,
         pages
       }
-    ) : section === "redirects" && access.manageRedirects ? /* @__PURE__ */ jsx12(RedirectsView, { api }) : section === "users" && access.manageUsers ? /* @__PURE__ */ jsx12(UsersView, { api, meId: session.user.id }) : /* @__PURE__ */ jsx12(
+    ) : selectedSection === "redirects" && access.manageRedirects ? /* @__PURE__ */ jsx12(RedirectsView, { api }) : selectedSection === "users" && access.manageUsers ? /* @__PURE__ */ jsx12(UsersView, { api, meId: session.user.id }) : /* @__PURE__ */ jsx12(
       DashboardView,
       {
         api,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orion-studios/cms",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "Orion CMS v2 core engine \u2014 JSONB content model on Supabase primitives",
   "type": "module",
   "exports": {

package/sql/bootstrap.sql

@@ -152,6 +152,16 @@ set publish_at = null,
 where publish_at is not null
   and scheduled_version_id is null;
 
+-- A published version is not a future publication candidate. Clear invalid
+-- schedules left by versions of the scheduling function that omitted this
+-- guard, so repeated bootstrap runs repair existing databases fail closed.
+update cms_pages
+set publish_at = null,
+    scheduled_version_id = null,
+    updated_at = now()
+where scheduled_version_id is not null
+  and scheduled_version_id = published_version_id;
+
 create unique index if not exists cms_page_versions_page_id_id_idx
   on cms_page_versions (page_id, id);
 create index if not exists cms_pages_scheduled_publish_due_idx
@@ -624,6 +634,10 @@ begin
     raise exception 'Page version conflict: expected draft is missing or stale';
   end if;
 
+  if current_page.published_version_id = p_expected_version_id then
+    raise exception 'Page version conflict: expected draft is already published';
+  end if;
+
   update cms_pages
   set publish_at = p_publish_at,
       scheduled_version_id = reviewed.id,

package/sql/migrations/20260820170000_sec_005_reject_published_version_schedule.sql

@@ -0,0 +1,88 @@
+-- SEC-005: reject scheduling a version that is already published.
+
+-- Repair schedules accepted by the 0.5.2 function. The version is already
+-- public, so there is no future immutable draft to publish. Editors must
+-- explicitly select a newer draft.
+update cms_pages
+set publish_at = null,
+    scheduled_version_id = null,
+    updated_at = now()
+where scheduled_version_id is not null
+  and scheduled_version_id = published_version_id;
+
+create or replace function cms_schedule_page_publish(
+  p_page_id uuid,
+  p_expected_version_id bigint,
+  p_publish_at timestamptz,
+  p_actor uuid
+) returns cms_pages
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  current_page cms_pages;
+  reviewed cms_page_versions;
+  result cms_pages;
+begin
+  select * into current_page
+  from cms_pages
+  where id = p_page_id
+  for update;
+
+  if current_page.id is null then
+    raise exception 'page % not found', p_page_id;
+  end if;
+
+  if p_publish_at is null then
+    update cms_pages
+    set publish_at = null,
+        scheduled_version_id = null,
+        updated_at = now()
+    where id = p_page_id
+    returning * into result;
+    return result;
+  end if;
+
+  select * into reviewed
+  from cms_page_versions
+  where id = p_expected_version_id
+    and page_id = p_page_id;
+
+  if reviewed.id is null
+     or current_page.draft_version_id is distinct from p_expected_version_id
+     or reviewed.title is distinct from current_page.title
+     or reviewed.seo is distinct from current_page.seo
+     or reviewed.layout is distinct from current_page.draft_layout then
+    raise exception 'Page version conflict: expected draft is missing or stale';
+  end if;
+
+  if current_page.published_version_id = p_expected_version_id then
+    raise exception 'Page version conflict: expected draft is already published';
+  end if;
+
+  update cms_pages
+  set publish_at = p_publish_at,
+      scheduled_version_id = reviewed.id,
+      updated_at = now()
+  where id = p_page_id
+  returning * into result;
+
+  return result;
+end;
+$$;
+
+do $fn_lockdown$
+begin
+  revoke execute on function cms_schedule_page_publish(uuid, bigint, timestamptz, uuid) from public;
+  if exists (select 1 from pg_roles where rolname = 'anon') then
+    revoke execute on function cms_schedule_page_publish(uuid, bigint, timestamptz, uuid) from anon;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'authenticated') then
+    revoke execute on function cms_schedule_page_publish(uuid, bigint, timestamptz, uuid) from authenticated;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'service_role') then
+    grant execute on function cms_schedule_page_publish(uuid, bigint, timestamptz, uuid) to service_role;
+  end if;
+end
+$fn_lockdown$;