@orion-studios/cms 0.5.6 → 0.5.7

package/dist/studio/index.js

@@ -208,6 +208,20 @@ var studioAccess = (role) => ({
 import { createClient } from "@supabase/supabase-js";
 import { useCallback, useEffect, useMemo, useState as useState2 } from "react";
 
+// src/supabase-keys.ts
+var isServerSupabaseKey = (key) => {
+  if (key.startsWith("sb_secret_")) return true;
+  const payload = key.split(".")[1];
+  if (!payload) return false;
+  try {
+    const normalized = payload.replace(/-/g, "+").replace(/_/g, "/");
+    const decoded = JSON.parse(atob(normalized));
+    return decoded.role === "service_role";
+  } catch {
+    return false;
+  }
+};
+
 // src/studio/PasswordInput.tsx
 import { useState } from "react";
 import { jsx, jsxs } from "react/jsx-runtime";
@@ -260,18 +274,24 @@ function PasswordInput({ className, ...props }) {
 // src/studio/auth.tsx
 import { jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
 var browserClient = null;
+var publicSupabaseKey = () => process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY || process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY || "";
 function getBrowserSupabase() {
   if (!browserClient) {
     const url = process.env.NEXT_PUBLIC_SUPABASE_URL || "";
-    const anonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY || "";
-    if (!url || !anonKey) {
-      throw new Error("Orion Studio: NEXT_PUBLIC_SUPABASE_URL and NEXT_PUBLIC_SUPABASE_ANON_KEY must be set.");
+    const publishableKey = publicSupabaseKey();
+    if (!url || !publishableKey) {
+      throw new Error(
+        "Orion Studio: NEXT_PUBLIC_SUPABASE_URL and NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY must be set. NEXT_PUBLIC_SUPABASE_ANON_KEY remains supported for legacy projects."
+      );
+    }
+    if (isServerSupabaseKey(publishableKey)) {
+      throw new Error("Orion Studio: a Supabase server key cannot be used in a NEXT_PUBLIC variable.");
     }
-    browserClient = createClient(url, anonKey);
+    browserClient = createClient(url, publishableKey);
   }
   return browserClient;
 }
-var isStudioMemoryMode = () => (!process.env.NEXT_PUBLIC_SUPABASE_URL || !process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY) && process.env.NODE_ENV !== "production";
+var isStudioMemoryMode = () => (!process.env.NEXT_PUBLIC_SUPABASE_URL || !publicSupabaseKey()) && process.env.NODE_ENV !== "production";
 var MEMORY_DEV_TOKEN = "orion-dev-token";
 var memorySession = {
   access_token: MEMORY_DEV_TOKEN,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orion-studios/cms",
-  "version": "0.5.6",
+  "version": "0.5.7",
   "description": "Orion CMS v2 core engine \u2014 JSONB content model on Supabase primitives",
   "type": "module",
   "exports": {

package/sql/bootstrap.sql

@@ -213,8 +213,13 @@ create table if not exists cms_globals (
   key text primary key,
   label text not null default '',
   data jsonb not null default '{}'::jsonb,
+  builder_owned boolean not null default false,
   updated_at timestamptz not null default now()
 );
+alter table cms_globals add column if not exists builder_owned boolean;
+update cms_globals set builder_owned = true where builder_owned is null;
+alter table cms_globals alter column builder_owned set not null;
+alter table cms_globals alter column builder_owned set default false;
 
 create table if not exists cms_media (
   id uuid primary key default gen_random_uuid(),
@@ -226,9 +231,14 @@ create table if not exists cms_media (
   width integer,
   height integer,
   filesize integer,
+  builder_owned boolean not null default false,
   created_at timestamptz not null default now(),
   updated_at timestamptz not null default now()
 );
+alter table cms_media add column if not exists builder_owned boolean;
+update cms_media set builder_owned = true where builder_owned is null;
+alter table cms_media alter column builder_owned set not null;
+alter table cms_media alter column builder_owned set default false;
 
 create table if not exists cms_forms (
   id uuid primary key default gen_random_uuid(),
@@ -236,9 +246,14 @@ create table if not exists cms_forms (
   title text not null default '',
   config jsonb not null default '{}'::jsonb, -- steps/fields, per forms module contract
   success_message text not null default '',
+  builder_owned boolean not null default false,
   created_at timestamptz not null default now(),
   updated_at timestamptz not null default now()
 );
+alter table cms_forms add column if not exists builder_owned boolean;
+update cms_forms set builder_owned = true where builder_owned is null;
+alter table cms_forms alter column builder_owned set not null;
+alter table cms_forms alter column builder_owned set default false;
 
 -- Notification settings live OUTSIDE config: config is anon-readable (the
 -- public form renderer needs the field list), notify addresses are not.
@@ -251,6 +266,43 @@ update cms_forms
       config = config - 'notify'
   where config ? 'notify';
 
+create table if not exists cms_preview_grants (
+  id uuid primary key,
+  page_id uuid not null references cms_pages (id) on delete cascade,
+  user_id uuid not null,
+  project_ref text not null check (project_ref ~ '^[a-z0-9][a-z0-9-]{0,63}$'),
+  key_id text not null check (key_id ~ '^[A-Za-z0-9._-]{1,64}$'),
+  expires_at timestamptz not null,
+  revoked_at timestamptz,
+  last_used_at timestamptz,
+  use_count integer not null default 0 check (use_count >= 0),
+  max_uses integer not null check (max_uses between 1 and 32),
+  created_at timestamptz not null default now()
+);
+create index if not exists cms_preview_grants_page_active_idx
+  on cms_preview_grants (page_id, expires_at)
+  where revoked_at is null;
+create index if not exists cms_preview_grants_user_active_idx
+  on cms_preview_grants (user_id, expires_at)
+  where revoked_at is null;
+
+create table if not exists cms_target_identity (
+  singleton boolean primary key default true check (singleton),
+  project_ref text not null check (project_ref ~ '^[a-z0-9][a-z0-9-]{0,63}$'),
+  installed_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+
+create table if not exists cms_sync_runs (
+  manifest_hash text primary key check (manifest_hash ~ '^[a-f0-9]{64}$'),
+  target_receipt_hash text not null check (target_receipt_hash ~ '^[a-f0-9]{64}$'),
+  status text not null check (status in ('active', 'complete', 'failed')),
+  result jsonb,
+  error text,
+  started_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+
 create table if not exists cms_form_submissions (
   id bigint generated always as identity primary key,
   form_id uuid not null references cms_forms (id) on delete cascade,
@@ -284,8 +336,13 @@ create table if not exists cms_redirects (
   from_path text not null unique,
   to_path text not null,
   permanent boolean not null default true,
+  builder_owned boolean not null default false,
   created_at timestamptz not null default now()
 );
+alter table cms_redirects add column if not exists builder_owned boolean;
+update cms_redirects set builder_owned = true where builder_owned is null;
+alter table cms_redirects alter column builder_owned set not null;
+alter table cms_redirects alter column builder_owned set default false;
 
 -- First-party analytics events. Append-only; pruned after the retention
 -- window by the cron route. session_key rotates daily. visitor_key is an
@@ -780,15 +837,16 @@ create or replace function cms_update_global(
 ) returns cms_globals
 language plpgsql
 security definer
-set search_path = public
+set search_path = public, pg_catalog
 as $$
 declare
   result cms_globals;
 begin
-  insert into cms_globals (key, data, updated_at)
-  values (p_key, p_data, now())
+  insert into cms_globals (key, data, builder_owned, updated_at)
+  values (p_key, p_data, true, now())
   on conflict (key) do update
     set data = excluded.data,
+        builder_owned = true,
         updated_at = now()
   returning * into result;
 
@@ -799,6 +857,223 @@ begin
 end;
 $$;
 
+create or replace function cms_consume_preview_grant(
+  p_grant_id uuid,
+  p_page_id uuid,
+  p_user_id uuid,
+  p_project_ref text,
+  p_key_id text
+) returns boolean
+language plpgsql
+security definer
+set search_path = public, pg_catalog
+as $$
+declare
+  consumed_id uuid;
+begin
+  update cms_preview_grants
+  set use_count = use_count + 1,
+      last_used_at = now()
+  where id = p_grant_id
+    and page_id = p_page_id
+    and user_id = p_user_id
+    and project_ref = p_project_ref
+    and key_id = p_key_id
+    and revoked_at is null
+    and expires_at > now()
+    and use_count < max_uses
+  returning id into consumed_id;
+
+  return consumed_id is not null;
+end;
+$$;
+
+create or replace function cms_sync_global(
+  p_key text,
+  p_data jsonb
+) returns boolean
+language plpgsql
+security definer
+set search_path = public, pg_catalog
+as $$
+declare
+  changed_key text;
+begin
+  insert into cms_globals (key, data, builder_owned, updated_at)
+  values (p_key, p_data, false, now())
+  on conflict (key) do update
+    set data = excluded.data,
+        updated_at = now()
+    where not cms_globals.builder_owned
+  returning key into changed_key;
+
+  return changed_key is not null;
+end;
+$$;
+
+create or replace function cms_sync_form(
+  p_slug text,
+  p_title text,
+  p_config jsonb,
+  p_success_message text
+) returns boolean
+language plpgsql
+security definer
+set search_path = public, pg_catalog
+as $$
+declare
+  changed_slug text;
+begin
+  insert into cms_forms (
+    slug, title, config, success_message, builder_owned, updated_at
+  ) values (
+    p_slug, p_title, p_config - 'notify', p_success_message, false, now()
+  )
+  on conflict (slug) do update
+    set title = excluded.title,
+        config = excluded.config,
+        success_message = excluded.success_message,
+        updated_at = now()
+    where not cms_forms.builder_owned
+  returning slug into changed_slug;
+
+  return changed_slug is not null;
+end;
+$$;
+
+create or replace function cms_sync_media(
+  p_storage_path text,
+  p_filename text,
+  p_alt text,
+  p_caption text,
+  p_mime_type text,
+  p_width integer,
+  p_height integer,
+  p_filesize bigint
+) returns boolean
+language plpgsql
+security definer
+set search_path = public, pg_catalog
+as $$
+declare
+  changed_path text;
+begin
+  insert into cms_media (
+    storage_path, filename, alt, caption, mime_type, width, height, filesize, builder_owned, updated_at
+  ) values (
+    p_storage_path, p_filename, p_alt, p_caption, p_mime_type,
+    p_width, p_height, p_filesize, false, now()
+  )
+  on conflict (storage_path) do update
+    set filename = excluded.filename,
+        alt = excluded.alt,
+        caption = excluded.caption,
+        mime_type = excluded.mime_type,
+        width = excluded.width,
+        height = excluded.height,
+        filesize = excluded.filesize,
+        updated_at = now()
+    where not cms_media.builder_owned
+  returning storage_path into changed_path;
+  return changed_path is not null;
+end;
+$$;
+
+create or replace function cms_sync_redirect(
+  p_from_path text,
+  p_to_path text,
+  p_permanent boolean
+) returns boolean
+language plpgsql
+security definer
+set search_path = public, pg_catalog
+as $$
+declare
+  changed_path text;
+begin
+  insert into cms_redirects (from_path, to_path, permanent, builder_owned)
+  values (p_from_path, p_to_path, p_permanent, false)
+  on conflict (from_path) do update
+    set to_path = excluded.to_path,
+        permanent = excluded.permanent
+    where not cms_redirects.builder_owned
+  returning from_path into changed_path;
+  return changed_path is not null;
+end;
+$$;
+
+create or replace function cms_begin_sync(
+  p_manifest_hash text,
+  p_target_receipt_hash text
+) returns jsonb
+language plpgsql
+security definer
+set search_path = public, pg_catalog
+as $$
+declare
+  active_run cms_sync_runs;
+  requested_run cms_sync_runs;
+begin
+  if p_manifest_hash !~ '^[a-f0-9]{64}$' or p_target_receipt_hash !~ '^[a-f0-9]{64}$' then
+    raise exception 'Invalid sync receipt.';
+  end if;
+  -- Serialize lease decisions across every manifest. Row locks cannot protect
+  -- the empty set when two new manifests start at the same time.
+  perform pg_advisory_xact_lock(hashtextextended('orion_cms_content_sync', 0));
+  select * into requested_run from cms_sync_runs where manifest_hash = p_manifest_hash for update;
+  if requested_run.status = 'complete' then
+    return jsonb_build_object('status', 'complete', 'result', requested_run.result);
+  end if;
+  if requested_run.status = 'active' and requested_run.updated_at > now() - interval '15 minutes' then
+    return jsonb_build_object('status', 'busy');
+  end if;
+  select * into active_run
+  from cms_sync_runs
+  where status = 'active' and manifest_hash <> p_manifest_hash
+  order by updated_at desc
+  limit 1
+  for update;
+  if active_run.manifest_hash is not null and active_run.updated_at > now() - interval '15 minutes' then
+    return jsonb_build_object('status', 'busy');
+  end if;
+  if active_run.manifest_hash is not null then
+    update cms_sync_runs
+    set status = 'failed', error = 'Sync lease expired.', updated_at = now()
+    where manifest_hash = active_run.manifest_hash;
+  end if;
+  insert into cms_sync_runs (manifest_hash, target_receipt_hash, status)
+  values (p_manifest_hash, p_target_receipt_hash, 'active')
+  on conflict (manifest_hash) do update
+    set target_receipt_hash = excluded.target_receipt_hash,
+        status = 'active', result = null, error = null, updated_at = now();
+  return jsonb_build_object('status', case when requested_run.manifest_hash is null then 'started' else 'resume' end);
+end;
+$$;
+
+create or replace function cms_finish_sync(
+  p_manifest_hash text,
+  p_status text,
+  p_result jsonb default null,
+  p_error text default null
+) returns boolean
+language plpgsql
+security definer
+set search_path = public, pg_catalog
+as $$
+begin
+  if p_status not in ('complete', 'failed') then
+    raise exception 'Invalid sync completion status.';
+  end if;
+  update cms_sync_runs
+  set status = p_status,
+      result = case when p_status = 'complete' then p_result else null end,
+      error = case when p_status = 'failed' then left(coalesce(p_error, 'Sync failed.'), 500) else null end,
+      updated_at = now()
+  where manifest_hash = p_manifest_hash and status = 'active';
+  return found;
+end;
+$$;
+
 -- 3) Row-level security -------------------------------------------------------
 -- Defense-in-depth. The app's API layer (service role) is the primary
 -- enforcement point; anonymous access is read-only and published-only.
@@ -816,6 +1091,11 @@ alter table cms_redirects enable row level security;
 alter table cms_activity enable row level security;
 alter table cms_events enable row level security;
 alter table cms_rate_limits enable row level security;
+alter table cms_preview_grants enable row level security;
+alter table cms_target_identity enable row level security;
+alter table cms_sync_runs enable row level security;
+alter table cms_preview_grants enable row level security;
+alter table cms_target_identity enable row level security;
 -- cms_events: no anon policies or grants — ingest and reads go through the
 -- API layer only.
 
@@ -848,7 +1128,7 @@ begin
   drop policy if exists cms_profiles_self_read on cms_profiles;
   execute 'create policy cms_profiles_self_read on cms_profiles '
     || 'for select using (auth.uid() = user_id)';
-exception when insufficient_privilege then
+exception when insufficient_privilege or invalid_schema_name or undefined_function then
   raise notice 'Skipped cms_profiles_self_read policy (no auth schema access).';
 end $profiles_policy$;
 
@@ -861,6 +1141,8 @@ end $profiles_policy$;
 -- default and Supabase exposes public-schema functions as RPC, so without an
 -- explicit revoke the anon key could call them and bypass RLS + the API
 -- permission matrix. Only the API layer (service role) may execute them.
+alter default privileges revoke execute on functions from public;
+
 do $fn_lockdown$
 declare
   fn text;
@@ -875,10 +1157,28 @@ declare
     'cms_rate_limit_consume(text, integer, integer)',
     'cms_rate_limit_consume(text, integer, integer, integer)',
     'cms_prune_rate_limits(timestamptz)',
-    'cms_update_global(text, jsonb, uuid)'
+    'cms_update_global(text, jsonb, uuid)',
+    'cms_consume_preview_grant(uuid, uuid, uuid, text, text)',
+    'cms_sync_global(text, jsonb)',
+    'cms_sync_form(text, text, jsonb, text)',
+    'cms_sync_media(text, text, text, text, text, integer, integer, bigint)',
+    'cms_sync_redirect(text, text, boolean)',
+    'cms_begin_sync(text, text)',
+    'cms_finish_sync(text, text, jsonb, text)'
   ];
 begin
+  if exists (select 1 from pg_roles where rolname = 'anon') then
+    execute 'alter default privileges in schema public revoke all on tables from anon';
+    execute 'alter default privileges in schema public revoke all on sequences from anon';
+    execute 'alter default privileges in schema public revoke execute on functions from anon';
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'authenticated') then
+    execute 'alter default privileges in schema public revoke all on tables from authenticated';
+    execute 'alter default privileges in schema public revoke all on sequences from authenticated';
+    execute 'alter default privileges in schema public revoke execute on functions from authenticated';
+  end if;
   foreach fn in array fns loop
+    execute format('alter function %s set search_path to public, pg_catalog', fn);
     execute format('revoke execute on function %s from public', fn);
     if exists (select 1 from pg_roles where rolname = 'anon') then
       execute format('revoke execute on function %s from anon', fn);
@@ -901,14 +1201,19 @@ revoke update, delete on cms_page_versions from public;
 revoke select on cms_forms from public;
 revoke select (notify) on cms_forms from public;
 revoke select on cms_media from public;
+revoke all on cms_preview_grants from public;
+revoke all on cms_target_identity from public;
+revoke all on cms_sync_runs from public;
 do $grants$
 begin
   if exists (select 1 from pg_roles where rolname = 'service_role') then
     grant select, insert, update, delete on
       cms_settings, cms_profiles, cms_pages,
       cms_globals, cms_media, cms_forms, cms_form_submissions,
-      cms_global_versions, cms_redirects, cms_activity, cms_events
+      cms_global_versions, cms_redirects, cms_activity, cms_events,
+      cms_preview_grants, cms_sync_runs
       to service_role;
+    grant select on cms_target_identity to service_role;
     revoke update, delete on cms_page_versions from service_role;
     grant select, insert on cms_page_versions to service_role;
   end if;
@@ -926,6 +1231,7 @@ begin
     revoke select (notify) on cms_forms from anon;
     grant select (id, slug, title, config, success_message, created_at, updated_at)
       on cms_forms to anon;
+    revoke all on cms_preview_grants, cms_target_identity, cms_sync_runs from anon;
   end if;
   if exists (select 1 from pg_roles where rolname = 'authenticated') then
     grant select on cms_globals, cms_profiles, cms_redirects to authenticated;
@@ -938,5 +1244,6 @@ begin
     revoke select (notify) on cms_forms from authenticated;
     grant select (id, slug, title, config, success_message, created_at, updated_at)
       on cms_forms to authenticated;
+    revoke all on cms_preview_grants, cms_target_identity, cms_sync_runs from authenticated;
   end if;
 end $grants$;