@plutocms/supabase 0.0.1-alpha.1 → 0.0.1-alpha.11

package/public/schema.sql

@@ -14,7 +14,7 @@ end
 $$;
 
 --- Create settings table
-create table public.settings (
+create table if not exists public.settings (
   id bigint generated by default as identity not null,
   setting_name public.TSettings not null,
   setting_value text not null,
@@ -26,21 +26,60 @@ create table public.settings (
 insert into public.settings (setting_name, setting_value) values
 ('website_title', 'My Website'),
 ('website_url', 'https://mywebsite.test'),
-('website_description', 'This is my website.');
+('website_description', 'This is my website.')
+on conflict (setting_name) do nothing;
 
 alter table public.settings enable row level security;
 
 -- Policies for settings table
-create policy "Enable insert for authenticated users only"
-on public.settings
-to authenticated, dashboard_user
-with check (true);
+do $$
+begin
+  if not exists (
+    select 1 from pg_policies where tablename = 'settings' and policyname = 'Enable insert for authenticated users only'
+  ) then
+    create policy "Enable insert for authenticated users only"
+    on public.settings
+    for insert
+    to authenticated, dashboard_user
+    with check (true);
+  end if;
+end
+$$;
+
+do $$
+begin
+  if not exists (
+    select 1 from pg_policies where tablename = 'settings' and policyname = 'Enable read access for authenticated users on settings'
+  ) then
+    create policy "Enable read access for authenticated users on settings"
+    on public.settings
+    for select
+    to authenticated, dashboard_user
+    using (true);
+  end if;
+end
+$$;
+
+do $$
+begin
+  if not exists (
+    select 1 from pg_policies where tablename = 'settings' and policyname = 'Enable update for authenticated users on settings'
+  ) then
+    create policy "Enable update for authenticated users on settings"
+    on public.settings
+    for update
+    to authenticated, dashboard_user
+    using (true)
+    with check (true);
+  end if;
+end
+$$;
 
 --- Create enum type for healthcheck names
 do $$
 begin
   if not exists (select 1 from pg_type where typname = 'thealthcheck') then
-    create type Healthcheck as enum (
+    create type THealthcheck as enum (
       'first_setup'
     );
   end if;
@@ -48,56 +87,140 @@ end
 $$;
 
 --- Create healthcheck table (name/value format like settings)
-create table public.healthcheck (
+create table if not exists public.healthcheck (
   id bigint generated by default as identity not null,
-  check_name public.Healthcheck not null,
-  check_value text not null,
+  config_name public.THealthcheck not null,
+  config_value text not null,
   constraint healthcheck_pkey primary key (id),
-  constraint healthcheck_check_name_key unique (check_name)
+  constraint healthcheck_config_name_key unique (config_name)
 ) TABLESPACE pg_default;
 
 --- Insert default healthcheck values
-insert into public.healthcheck (check_name, check_value) values
-('first_setup', 'true');
+insert into public.healthcheck (config_name, config_value) values
+('first_setup', 'true')
+on conflict (config_name) do nothing;
 
 alter table public.healthcheck enable row level security;
 
 -- Allow read access to healthcheck for public and dashboard_user (no login required)
-create policy "Enable read access for healthcheck to public and dashboard_user"
-on public.healthcheck
-for select
-to public, dashboard_user
-using (true);
+do $$
+begin
+  if not exists (
+    select 1 from pg_policies where tablename = 'healthcheck' and policyname = 'Enable read access for healthcheck to public'
+  ) then
+    create policy "Enable read access for healthcheck to public"
+    on public.healthcheck
+    for select
+    to public
+    using (true);
+  end if;
+end
+$$;
+
+-- Allow update access to healthcheck for authenticated users and dashboard_user
+do $$
+begin
+  if not exists (
+    select 1 from pg_policies where tablename = 'healthcheck' and policyname = 'Enable update for authenticated users on healthcheck'
+  ) then
+    create policy "Enable update for authenticated users on healthcheck"
+    on public.healthcheck
+    for update
+    to authenticated, dashboard_user
+    using (true)
+    with check (true);
+  end if;
+end
+$$;
 
 -- Profiles
-create table profiles (
+create table if not exists public.profiles (
   id uuid references auth.users on delete cascade not null primary key,
   updated_at timestamp with time zone,
-  first_name text,
-  last_name text,
-  constraint first_name_length check (char_length(first_name) >= 3)
+  email text,
+  username text,
+  display_name text,
+  is_admin boolean not null default false,
+  constraint username_length check (char_length(username) >= 3)
 );
 
 alter table public.profiles enable row level security;
 
-create policy "Enable read access for authenticated users"
-on public.profiles
-to authenticated, dashboard_user
-for select using (true);
+do $$
+begin
+  if not exists (
+    select 1 from pg_policies where tablename = 'profiles' and policyname = 'Enable read access for authenticated users'
+  ) then
+    create policy "Enable read access for authenticated users"
+    on public.profiles
+    for select
+    to authenticated, dashboard_user
+    using (true);
+  end if;
+end
+$$;
 
 --- inserts a row into public.profiles
-create function public.handle_new_user()
+--- automatically grants admin to the first user if no profiles exist yet
+create or replace function public.handle_new_user()
 returns trigger
 language plpgsql
 security definer set search_path = ''
 as $$
+declare
+  profile_count int;
+  should_be_admin boolean;
 begin
-  insert into public.profiles (id, first_name, last_name)
-  values (new.id, new.raw_user_meta_data ->> 'first_name', new.raw_user_meta_data ->> 'last_name');
+  select count(*) into profile_count from public.profiles;
+
+  should_be_admin := profile_count = 0
+    or coalesce((new.raw_user_meta_data ->> 'is_admin')::boolean, false);
+
+  insert into public.profiles (id, email, username, display_name, is_admin)
+  values (
+    new.id,
+    new.email,
+    new.raw_user_meta_data ->> 'username',
+    new.raw_user_meta_data ->> 'display_name',
+    should_be_admin
+  );
   return new;
 end;
 $$;
 --- trigger the function every time a user is created
-create trigger on_auth_user_created
-  after insert on auth.users
-  for each row execute procedure public.handle_new_user();
+do $$
+begin
+  if not exists (
+    select 1 from pg_trigger where tgname = 'on_auth_user_created'
+  ) then
+    create trigger on_auth_user_created
+      after insert on auth.users
+      for each row execute procedure public.handle_new_user();
+  end if;
+end
+$$;
+
+-- Migrations tracking
+create table if not exists public.pluto_migrations (
+  id bigint generated by default as identity primary key,
+  layer_name text not null,
+  applied_at timestamptz not null default now(),
+  constraint pluto_migrations_layer_key unique (layer_name)
+);
+
+alter table public.pluto_migrations enable row level security;
+
+-- Only authenticated users can read migrations
+do $$
+begin
+  if not exists (
+    select 1 from pg_policies where tablename = 'pluto_migrations' and policyname = 'Enable read access for authenticated users on pluto_migrations'
+  ) then
+    create policy "Enable read access for authenticated users on pluto_migrations"
+    on public.pluto_migrations
+    for select
+    to authenticated, dashboard_user
+    using (true);
+  end if;
+end
+$$;

package/server/api/settings/first_setup.get.ts

@@ -10,7 +10,7 @@ export default defineEventHandler(async (event) => {
 
   if (error) {
     return {
-      success: false,
+      success: false as const,
       message: 'Error retrieving healthcheck settings',
       error: error.message,
     }
@@ -32,7 +32,7 @@ export default defineEventHandler(async (event) => {
   })
 
   return {
-    success: true,
+    success: true as const,
     message: 'Healthcheck settings retrieved successfully',
     is_first_setup: isFirstSetup.first_setup === 'true',
   }

package/server/api/setup/create.post.ts

@@ -1,4 +1,7 @@
+import { readFile, writeFile } from 'node:fs/promises'
+import { resolve } from 'node:path'
 import postgres from 'postgres'
+import { splitStatements } from '../../utils/sql'
 
 interface Payload {
   baseUrl: string
@@ -30,16 +33,47 @@ export default defineEventHandler(async (event) => {
   const sql = postgres(connectionString)
 
   try {
-    /* await sql.begin(async (sql) => {
-      await sql.unsafe(schema)
-    }) */
-
-    // Set the first_setup flag in the healthcheck table to false
-    await sql`
-      UPDATE healthcheck
-      SET config_value = 'false'
-      WHERE config_name = 'first_setup';
-    `
+    const statements = splitStatements(schema)
+
+    for (const statement of statements) {
+      await sql.unsafe(statement)
+    }
+
+    // Mark first_setup as complete
+    await sql.unsafe(
+      `UPDATE public.healthcheck SET config_value = 'false' WHERE config_name = 'first_setup'`
+    )
+
+    // Record the core schema migration
+    await sql.unsafe(
+      `INSERT INTO public.pluto_migrations (layer_name)
+       VALUES ('core')
+       ON CONFLICT (layer_name) DO NOTHING`
+    )
+
+    // Persist connection string to .env for future layer migrations
+    const envPath = resolve(process.cwd(), '.env')
+    let envContent = ''
+    try {
+      envContent = await readFile(envPath, 'utf-8')
+    } catch {
+      // .env doesn't exist yet
+    }
+
+    if (envContent.includes('DATABASE_URL=')) {
+      envContent = envContent.replace(
+        /^DATABASE_URL=.*$/m,
+        `DATABASE_URL="${connectionString}"`
+      )
+    } else {
+      // Ensure there's a trailing newline before appending
+      if (envContent.length > 0 && !envContent.endsWith('\n')) {
+        envContent += '\n'
+      }
+      envContent += `DATABASE_URL="${connectionString}"\n`
+    }
+
+    await writeFile(envPath, envContent, 'utf-8')
 
     return {
       success: true,

package/server/api/signup.post.ts

@@ -1,28 +1,46 @@
 import { serverSupabaseClient } from '#supabase/server'
 
+interface Payload {
+  username: string
+  display_name: string
+  email: string
+  password: string
+}
+
 export default defineEventHandler(async (event) => {
   const client = await serverSupabaseClient<Database>(event)
 
-  const body = await readBody(event)
+  const body = await readBody<Payload>(event)
+
+  if (!body.username || body.username.length < 3) {
+    return {
+      success: false,
+      message: 'Username must be at least 3 characters.',
+    }
+  }
 
   const { data, error } = await client.auth.signUp({
     email: body.email,
     password: body.password,
     options: {
       data: {
-        first_name: body.first_name,
-        last_name: body.last_name,
+        username: body.username,
+        display_name: body.display_name,
       },
     },
   })
 
   if (error) {
-    throw createError({
-      statusCode: Number.parseInt(error.code ?? '500'),
-      cause: error.cause,
+    return {
+      success: false,
       message: error.message,
-    })
+      error,
+    }
   }
 
-  return { message: 'User registered successfully', data }
+  return {
+    success: true,
+    message: 'User registered successfully',
+    data,
+  }
 })

package/server/plugins/migrations.ts

@@ -0,0 +1,48 @@
+import { runLayerMigration } from '../utils/migrations'
+
+export default defineNitroPlugin(async () => {
+  // Only run if DATABASE_URL is configured (setup already completed)
+  if (!process.env.DATABASE_URL) {
+    return
+  }
+
+  const config = useRuntimeConfig()
+  const layerSchemas: Record<string, string> =
+    (config as any).plutoLayerSchemas ?? {}
+
+  const layerNames = Object.keys(layerSchemas)
+
+  if (layerNames.length === 0) {
+    return
+  }
+
+  for (const layerName of layerNames) {
+    const schemaSql = layerSchemas[layerName]
+
+    if (!schemaSql) {
+      continue
+    }
+
+    try {
+      const result = await runLayerMigration({
+        layerName,
+        schemaSql,
+      })
+
+      if (result.skipped) {
+        console.warn(
+          `[migrations] Layer "${layerName}" already applied, skipped.`
+        )
+      } else if (result.success) {
+        console.warn(`[migrations] Layer "${layerName}" migrated successfully.`)
+      } else {
+        console.error(`[migrations] Layer "${layerName}" failed:`, result.error)
+      }
+    } catch (error) {
+      console.error(
+        `[migrations] Error running migration for "${layerName}":`,
+        error
+      )
+    }
+  }
+})

package/server/utils/migrations.ts

@@ -0,0 +1,88 @@
+import postgres from 'postgres'
+import { splitStatements } from './sql'
+
+/**
+ * Retrieves the database connection string from environment variables.
+ * Stored in .env during initial setup.
+ */
+export function getConnectionString(): string | null {
+  return process.env.DATABASE_URL ?? null
+}
+
+/**
+ * Checks if a specific layer migration has already been applied.
+ */
+async function isMigrationApplied(
+  sql: postgres.Sql,
+  layerName: string
+): Promise<boolean> {
+  const result = await sql.unsafe(
+    `SELECT 1 FROM public.pluto_migrations WHERE layer_name = $1`,
+    [layerName]
+  )
+  return result.length > 0
+}
+
+/**
+ * Records a migration as applied.
+ */
+async function recordMigration(
+  sql: postgres.Sql,
+  layerName: string
+): Promise<void> {
+  await sql.unsafe(
+    `INSERT INTO public.pluto_migrations (layer_name)
+     VALUES ($1)
+     ON CONFLICT (layer_name) DO NOTHING`,
+    [layerName]
+  )
+}
+
+interface LayerMigrationResult {
+  success: boolean
+  skipped?: boolean
+  error?: string
+}
+
+/**
+ * Runs a layer's schema SQL if not already applied.
+ * Splits and executes statements, then records the migration.
+ */
+export async function runLayerMigration(opts: {
+  layerName: string
+  schemaSql: string
+  connectionString?: string
+}): Promise<LayerMigrationResult> {
+  const connStr = opts.connectionString ?? getConnectionString()
+
+  if (!connStr) {
+    return {
+      success: false,
+      error: 'No DATABASE_URL configured. Re-run setup or add it to .env.',
+    }
+  }
+
+  const sql = postgres(connStr)
+
+  try {
+    const applied = await isMigrationApplied(sql, opts.layerName)
+    if (applied) {
+      return { success: true, skipped: true }
+    }
+
+    const statements = splitStatements(opts.schemaSql)
+
+    for (const statement of statements) {
+      await sql.unsafe(statement)
+    }
+
+    await recordMigration(sql, opts.layerName)
+
+    return { success: true }
+  } catch (error: any) {
+    console.error(`Migration error [${opts.layerName}]:`, error)
+    return { success: false, error: error.message }
+  } finally {
+    await sql.end()
+  }
+}

package/server/utils/sql.ts

@@ -0,0 +1,81 @@
+/**
+ * Splits a SQL string into individual statements, correctly handling
+ * $$ dollar-quoted blocks, single-quoted strings, and -- comments.
+ */
+export function splitStatements(sql: string): string[] {
+  const statements: string[] = []
+  let current = ''
+  let i = 0
+
+  while (i < sql.length) {
+    // Check for dollar-quoting ($$)
+    if (sql[i] === '$' && sql[i + 1] === '$') {
+      current += '$$'
+      i += 2
+      // Read until closing $$
+      while (i < sql.length) {
+        if (sql[i] === '$' && sql[i + 1] === '$') {
+          current += '$$'
+          i += 2
+          break
+        }
+        current += sql[i]
+        i++
+      }
+      continue
+    }
+
+    // Check for single-quoted strings (handle '' escapes)
+    if (sql[i] === `'`) {
+      current += sql[i]
+      i++
+      while (i < sql.length) {
+        if (sql[i] === `'` && sql[i + 1] === `'`) {
+          // Escaped quote
+          current += `''`
+          i += 2
+          continue
+        }
+        if (sql[i] === `'`) {
+          current += sql[i]
+          i++
+          break
+        }
+        current += sql[i]
+        i++
+      }
+      continue
+    }
+
+    // Check for single-line comments
+    if (sql[i] === '-' && sql[i + 1] === '-') {
+      while (i < sql.length && sql[i] !== '\n') {
+        current += sql[i]
+        i++
+      }
+      continue
+    }
+
+    // Statement terminator
+    if (sql[i] === ';') {
+      current += ';'
+      const trimmed = current.trim()
+      if (trimmed && trimmed !== ';') {
+        statements.push(trimmed)
+      }
+      current = ''
+      i++
+      continue
+    }
+
+    current += sql[i]
+    i++
+  }
+
+  const trimmed = current.trim()
+  if (trimmed && trimmed !== ';') {
+    statements.push(trimmed)
+  }
+
+  return statements
+}