@orion-studios/cms 0.5.6 → 0.5.8

package/sql/migrations/20260829032027_cms_security_and_sync_contracts.sql

@@ -0,0 +1,390 @@
+-- Purpose-bound preview grants, conflict-safe non-page sync, and target identity.
+
+alter table cms_globals add column if not exists builder_owned boolean;
+update cms_globals set builder_owned = true where builder_owned is null;
+alter table cms_globals alter column builder_owned set not null;
+alter table cms_globals alter column builder_owned set default false;
+
+alter table cms_forms add column if not exists builder_owned boolean;
+update cms_forms set builder_owned = true where builder_owned is null;
+alter table cms_forms alter column builder_owned set not null;
+alter table cms_forms alter column builder_owned set default false;
+
+alter table cms_media add column if not exists builder_owned boolean;
+update cms_media set builder_owned = true where builder_owned is null;
+alter table cms_media alter column builder_owned set not null;
+alter table cms_media alter column builder_owned set default false;
+
+alter table cms_redirects add column if not exists builder_owned boolean;
+update cms_redirects set builder_owned = true where builder_owned is null;
+alter table cms_redirects alter column builder_owned set not null;
+alter table cms_redirects alter column builder_owned set default false;
+
+create table if not exists cms_preview_grants (
+  id uuid primary key,
+  page_id uuid not null references cms_pages (id) on delete cascade,
+  user_id uuid not null,
+  project_ref text not null check (project_ref ~ '^[a-z0-9][a-z0-9-]{0,63}$'),
+  key_id text not null check (key_id ~ '^[A-Za-z0-9._-]{1,64}$'),
+  expires_at timestamptz not null,
+  revoked_at timestamptz,
+  last_used_at timestamptz,
+  use_count integer not null default 0 check (use_count >= 0),
+  max_uses integer not null check (max_uses between 1 and 32),
+  created_at timestamptz not null default now()
+);
+create index if not exists cms_preview_grants_page_active_idx
+  on cms_preview_grants (page_id, expires_at)
+  where revoked_at is null;
+create index if not exists cms_preview_grants_user_active_idx
+  on cms_preview_grants (user_id, expires_at)
+  where revoked_at is null;
+
+create table if not exists cms_target_identity (
+  singleton boolean primary key default true check (singleton),
+  project_ref text not null check (project_ref ~ '^[a-z0-9][a-z0-9-]{0,63}$'),
+  installed_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+
+create table if not exists cms_sync_runs (
+  manifest_hash text primary key check (manifest_hash ~ '^[a-f0-9]{64}$'),
+  target_receipt_hash text not null check (target_receipt_hash ~ '^[a-f0-9]{64}$'),
+  status text not null check (status in ('active', 'complete', 'failed')),
+  result jsonb,
+  error text,
+  started_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+
+create or replace function cms_consume_preview_grant(
+  p_grant_id uuid,
+  p_page_id uuid,
+  p_user_id uuid,
+  p_project_ref text,
+  p_key_id text
+) returns boolean
+language plpgsql
+security definer
+set search_path = public, pg_catalog
+as $$
+declare
+  consumed_id uuid;
+begin
+  update cms_preview_grants
+  set use_count = use_count + 1,
+      last_used_at = now()
+  where id = p_grant_id
+    and page_id = p_page_id
+    and user_id = p_user_id
+    and project_ref = p_project_ref
+    and key_id = p_key_id
+    and revoked_at is null
+    and expires_at > now()
+    and use_count < max_uses
+  returning id into consumed_id;
+
+  return consumed_id is not null;
+end;
+$$;
+
+create or replace function cms_sync_global(
+  p_key text,
+  p_data jsonb
+) returns boolean
+language plpgsql
+security definer
+set search_path = public, pg_catalog
+as $$
+declare
+  changed_key text;
+begin
+  insert into cms_globals (key, data, builder_owned, updated_at)
+  values (p_key, p_data, false, now())
+  on conflict (key) do update
+    set data = excluded.data,
+        updated_at = now()
+    where not cms_globals.builder_owned
+  returning key into changed_key;
+
+  return changed_key is not null;
+end;
+$$;
+
+create or replace function cms_sync_form(
+  p_slug text,
+  p_title text,
+  p_config jsonb,
+  p_success_message text
+) returns boolean
+language plpgsql
+security definer
+set search_path = public, pg_catalog
+as $$
+declare
+  changed_slug text;
+begin
+  insert into cms_forms (
+    slug, title, config, success_message, builder_owned, updated_at
+  ) values (
+    p_slug, p_title, p_config - 'notify', p_success_message, false, now()
+  )
+  on conflict (slug) do update
+    set title = excluded.title,
+        config = excluded.config,
+        success_message = excluded.success_message,
+        updated_at = now()
+    where not cms_forms.builder_owned
+  returning slug into changed_slug;
+
+  return changed_slug is not null;
+end;
+$$;
+
+create or replace function cms_sync_media(
+  p_storage_path text,
+  p_filename text,
+  p_alt text,
+  p_caption text,
+  p_mime_type text,
+  p_width integer,
+  p_height integer,
+  p_filesize bigint
+) returns boolean
+language plpgsql
+security definer
+set search_path = public, pg_catalog
+as $$
+declare
+  changed_path text;
+begin
+  insert into cms_media (
+    storage_path, filename, alt, caption, mime_type, width, height, filesize, builder_owned, updated_at
+  ) values (
+    p_storage_path, p_filename, p_alt, p_caption, p_mime_type,
+    p_width, p_height, p_filesize, false, now()
+  )
+  on conflict (storage_path) do update
+    set filename = excluded.filename,
+        alt = excluded.alt,
+        caption = excluded.caption,
+        mime_type = excluded.mime_type,
+        width = excluded.width,
+        height = excluded.height,
+        filesize = excluded.filesize,
+        updated_at = now()
+    where not cms_media.builder_owned
+  returning storage_path into changed_path;
+  return changed_path is not null;
+end;
+$$;
+
+create or replace function cms_sync_redirect(
+  p_from_path text,
+  p_to_path text,
+  p_permanent boolean
+) returns boolean
+language plpgsql
+security definer
+set search_path = public, pg_catalog
+as $$
+declare
+  changed_path text;
+begin
+  insert into cms_redirects (from_path, to_path, permanent, builder_owned)
+  values (p_from_path, p_to_path, p_permanent, false)
+  on conflict (from_path) do update
+    set to_path = excluded.to_path,
+        permanent = excluded.permanent
+    where not cms_redirects.builder_owned
+  returning from_path into changed_path;
+  return changed_path is not null;
+end;
+$$;
+
+create or replace function cms_begin_sync(
+  p_manifest_hash text,
+  p_target_receipt_hash text
+) returns jsonb
+language plpgsql
+security definer
+set search_path = public, pg_catalog
+as $$
+declare
+  active_run cms_sync_runs;
+  requested_run cms_sync_runs;
+begin
+  if p_manifest_hash !~ '^[a-f0-9]{64}$' or p_target_receipt_hash !~ '^[a-f0-9]{64}$' then
+    raise exception 'Invalid sync receipt.';
+  end if;
+
+  -- Serialize lease decisions across every manifest. Row locks cannot protect
+  -- the empty set when two new manifests start at the same time.
+  perform pg_advisory_xact_lock(hashtextextended('orion_cms_content_sync', 0));
+
+  select * into requested_run from cms_sync_runs where manifest_hash = p_manifest_hash for update;
+  if requested_run.status = 'complete' then
+    return jsonb_build_object('status', 'complete', 'result', requested_run.result);
+  end if;
+  if requested_run.status = 'active' and requested_run.updated_at > now() - interval '15 minutes' then
+    return jsonb_build_object('status', 'busy');
+  end if;
+
+  select * into active_run
+  from cms_sync_runs
+  where status = 'active' and manifest_hash <> p_manifest_hash
+  order by updated_at desc
+  limit 1
+  for update;
+  if active_run.manifest_hash is not null and active_run.updated_at > now() - interval '15 minutes' then
+    return jsonb_build_object('status', 'busy');
+  end if;
+  if active_run.manifest_hash is not null then
+    update cms_sync_runs
+    set status = 'failed', error = 'Sync lease expired.', updated_at = now()
+    where manifest_hash = active_run.manifest_hash;
+  end if;
+
+  insert into cms_sync_runs (manifest_hash, target_receipt_hash, status)
+  values (p_manifest_hash, p_target_receipt_hash, 'active')
+  on conflict (manifest_hash) do update
+    set target_receipt_hash = excluded.target_receipt_hash,
+        status = 'active',
+        result = null,
+        error = null,
+        updated_at = now();
+  return jsonb_build_object('status', case when requested_run.manifest_hash is null then 'started' else 'resume' end);
+end;
+$$;
+
+create or replace function cms_finish_sync(
+  p_manifest_hash text,
+  p_status text,
+  p_result jsonb default null,
+  p_error text default null
+) returns boolean
+language plpgsql
+security definer
+set search_path = public, pg_catalog
+as $$
+begin
+  if p_status not in ('complete', 'failed') then
+    raise exception 'Invalid sync completion status.';
+  end if;
+  update cms_sync_runs
+  set status = p_status,
+      result = case when p_status = 'complete' then p_result else null end,
+      error = case when p_status = 'failed' then left(coalesce(p_error, 'Sync failed.'), 500) else null end,
+      updated_at = now()
+  where manifest_hash = p_manifest_hash and status = 'active';
+  return found;
+end;
+$$;
+
+create or replace function cms_update_global(
+  p_key text,
+  p_data jsonb,
+  p_actor uuid default null
+) returns cms_globals
+language plpgsql
+security definer
+set search_path = public, pg_catalog
+as $$
+declare
+  result cms_globals;
+begin
+  insert into cms_globals (key, data, builder_owned, updated_at)
+  values (p_key, p_data, true, now())
+  on conflict (key) do update
+    set data = excluded.data,
+        builder_owned = true,
+        updated_at = now()
+  returning * into result;
+
+  insert into cms_global_versions (key, data, created_by)
+  values (p_key, p_data, p_actor);
+
+  return result;
+end;
+$$;
+
+alter table cms_preview_grants enable row level security;
+alter table cms_target_identity enable row level security;
+alter table cms_sync_runs enable row level security;
+
+alter default privileges revoke execute on functions from public;
+
+do $cms_safe_function_paths$
+declare
+  fn regprocedure;
+begin
+  for fn in
+    select p.oid::regprocedure
+    from pg_proc p
+    join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'public'
+      and p.proname like 'cms_%'
+      and p.prosecdef
+  loop
+    execute format('alter function %s set search_path to public, pg_catalog', fn);
+  end loop;
+end
+$cms_safe_function_paths$;
+
+revoke all on cms_preview_grants from public;
+revoke all on cms_target_identity from public;
+revoke all on cms_sync_runs from public;
+revoke execute on function cms_consume_preview_grant(uuid, uuid, uuid, text, text) from public;
+revoke execute on function cms_sync_global(text, jsonb) from public;
+revoke execute on function cms_sync_form(text, text, jsonb, text) from public;
+revoke execute on function cms_sync_media(text, text, text, text, text, integer, integer, bigint) from public;
+revoke execute on function cms_sync_redirect(text, text, boolean) from public;
+revoke execute on function cms_begin_sync(text, text) from public;
+revoke execute on function cms_finish_sync(text, text, jsonb, text) from public;
+
+do $cms_security_contracts$
+begin
+  if exists (select 1 from pg_roles where rolname = 'anon') then
+    execute 'alter default privileges in schema public revoke all on tables from anon';
+    execute 'alter default privileges in schema public revoke all on sequences from anon';
+    execute 'alter default privileges in schema public revoke execute on functions from anon';
+    revoke all on cms_preview_grants from anon;
+    revoke all on cms_target_identity from anon;
+    revoke all on cms_sync_runs from anon;
+    revoke execute on function cms_consume_preview_grant(uuid, uuid, uuid, text, text) from anon;
+    revoke execute on function cms_sync_global(text, jsonb) from anon;
+    revoke execute on function cms_sync_form(text, text, jsonb, text) from anon;
+    revoke execute on function cms_sync_media(text, text, text, text, text, integer, integer, bigint) from anon;
+    revoke execute on function cms_sync_redirect(text, text, boolean) from anon;
+    revoke execute on function cms_begin_sync(text, text) from anon;
+    revoke execute on function cms_finish_sync(text, text, jsonb, text) from anon;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'authenticated') then
+    execute 'alter default privileges in schema public revoke all on tables from authenticated';
+    execute 'alter default privileges in schema public revoke all on sequences from authenticated';
+    execute 'alter default privileges in schema public revoke execute on functions from authenticated';
+    revoke all on cms_preview_grants from authenticated;
+    revoke all on cms_target_identity from authenticated;
+    revoke all on cms_sync_runs from authenticated;
+    revoke execute on function cms_consume_preview_grant(uuid, uuid, uuid, text, text) from authenticated;
+    revoke execute on function cms_sync_global(text, jsonb) from authenticated;
+    revoke execute on function cms_sync_form(text, text, jsonb, text) from authenticated;
+    revoke execute on function cms_sync_media(text, text, text, text, text, integer, integer, bigint) from authenticated;
+    revoke execute on function cms_sync_redirect(text, text, boolean) from authenticated;
+    revoke execute on function cms_begin_sync(text, text) from authenticated;
+    revoke execute on function cms_finish_sync(text, text, jsonb, text) from authenticated;
+  end if;
+  if exists (select 1 from pg_roles where rolname = 'service_role') then
+    grant select, insert, update, delete on cms_preview_grants to service_role;
+    grant select on cms_target_identity to service_role;
+    grant select, insert, update on cms_sync_runs to service_role;
+    grant execute on function cms_consume_preview_grant(uuid, uuid, uuid, text, text) to service_role;
+    grant execute on function cms_sync_global(text, jsonb) to service_role;
+    grant execute on function cms_sync_form(text, text, jsonb, text) to service_role;
+    grant execute on function cms_sync_media(text, text, text, text, text, integer, integer, bigint) to service_role;
+    grant execute on function cms_sync_redirect(text, text, boolean) to service_role;
+    grant execute on function cms_begin_sync(text, text) to service_role;
+    grant execute on function cms_finish_sync(text, text, jsonb, text) to service_role;
+  end if;
+end
+$cms_security_contracts$;