@plutocms/supabase 0.0.1-alpha.8 → 0.1.0

package/public/schema.sql

@@ -106,24 +106,42 @@ alter table public.healthcheck enable row level security;
 do $$
 begin
   if not exists (
-    select 1 from pg_policies where tablename = 'healthcheck' and policyname = 'Enable read access for healthcheck to public and dashboard_user'
+    select 1 from pg_policies where tablename = 'healthcheck' and policyname = 'Enable read access for healthcheck to public'
   ) then
-    create policy "Enable read access for healthcheck to public and dashboard_user"
+    create policy "Enable read access for healthcheck to public"
     on public.healthcheck
     for select
-    to public, dashboard_user
+    to public
     using (true);
   end if;
 end
 $$;
 
+-- Allow update access to healthcheck for authenticated users and dashboard_user
+do $$
+begin
+  if not exists (
+    select 1 from pg_policies where tablename = 'healthcheck' and policyname = 'Enable update for authenticated users on healthcheck'
+  ) then
+    create policy "Enable update for authenticated users on healthcheck"
+    on public.healthcheck
+    for update
+    to authenticated, dashboard_user
+    using (true)
+    with check (true);
+  end if;
+end
+$$;
+
 -- Profiles
 create table if not exists public.profiles (
   id uuid references auth.users on delete cascade not null primary key,
   updated_at timestamp with time zone,
-  first_name text,
-  last_name text,
-  constraint first_name_length check (char_length(first_name) >= 3)
+  email text,
+  username text,
+  display_name text,
+  is_admin boolean not null default false,
+  constraint username_length check (char_length(username) >= 3)
 );
 
 alter table public.profiles enable row level security;
@@ -143,14 +161,29 @@ end
 $$;
 
 --- inserts a row into public.profiles
+--- automatically grants admin to the first user if no profiles exist yet
 create or replace function public.handle_new_user()
 returns trigger
 language plpgsql
 security definer set search_path = ''
 as $$
+declare
+  profile_count int;
+  should_be_admin boolean;
 begin
-  insert into public.profiles (id, first_name, last_name)
-  values (new.id, new.raw_user_meta_data ->> 'first_name', new.raw_user_meta_data ->> 'last_name');
+  select count(*) into profile_count from public.profiles;
+
+  should_be_admin := profile_count = 0
+    or coalesce((new.raw_user_meta_data ->> 'is_admin')::boolean, false);
+
+  insert into public.profiles (id, email, username, display_name, is_admin)
+  values (
+    new.id,
+    new.email,
+    new.raw_user_meta_data ->> 'username',
+    new.raw_user_meta_data ->> 'display_name',
+    should_be_admin
+  );
   return new;
 end;
 $$;
@@ -166,3 +199,28 @@ begin
   end if;
 end
 $$;
+
+-- Migrations tracking
+create table if not exists public.pluto_migrations (
+  id bigint generated by default as identity primary key,
+  layer_name text not null,
+  applied_at timestamptz not null default now(),
+  constraint pluto_migrations_layer_key unique (layer_name)
+);
+
+alter table public.pluto_migrations enable row level security;
+
+-- Only authenticated users can read migrations
+do $$
+begin
+  if not exists (
+    select 1 from pg_policies where tablename = 'pluto_migrations' and policyname = 'Enable read access for authenticated users on pluto_migrations'
+  ) then
+    create policy "Enable read access for authenticated users on pluto_migrations"
+    on public.pluto_migrations
+    for select
+    to authenticated, dashboard_user
+    using (true);
+  end if;
+end
+$$;

package/scripts/supabase-typegen.ts

@@ -1,35 +1,50 @@
-import fs from 'node:fs'
-import path from 'node:path'
 import { cwd } from 'node:process'
-import { $ } from 'bun'
 import { consola } from 'consola'
+import { regenerateSupabaseTypes } from '../server/utils/typegen'
 
+const databaseUrl = process.env.DATABASE_URL
 const projectUrl = process.env.SUPABASE_URL
-const projectId = projectUrl?.split('.supabase.co')[0]?.replace('https://', '')
-const _path = path
-  .resolve(cwd(), './shared/types/supabase.ts')
-  .replace(/\\/g, '/')
 
 ;(async () => {
-  consola.info(`Generating Supabase types for project: ${projectId}`)
-
-  // Create file if it doesn't exist
-  if (!fs.existsSync(_path)) {
-    consola.info('Types file does not exist. Creating a new one.')
+  if (databaseUrl) {
+    consola.info('Generating Supabase types via DATABASE_URL...')
+    await regenerateSupabaseTypes(cwd(), databaseUrl)
+    return
+  }
 
-    fs.mkdirSync(path.dirname(_path), { recursive: true })
-    fs.writeFileSync(_path, '', 'utf-8')
+  if (!projectUrl) {
+    consola.error(
+      'Cannot generate Supabase types: neither DATABASE_URL nor SUPABASE_URL is set.'
+    )
+    return
   }
 
-  const args = [
-    `--project-id=${projectId || ''}`,
-    '--schema=public',
-    '>',
-    `"${_path}"`,
-  ]
+  consola.warn(
+    'DATABASE_URL is not set; falling back to --project-id (requires `supabase login`).'
+  )
+
+  const projectId = projectUrl.split('.supabase.co')[0]?.replace('https://', '')
+  const { execFile } = await import('node:child_process')
+  const { promisify } = await import('node:util')
+  const { writeFileSync } = await import('node:fs')
+  const { join } = await import('node:path')
+
+  consola.info(`Generating Supabase types for project: ${projectId}`)
 
   try {
-    await $`bunx supabase gen types typescript ${{ raw: args.join(' ') }}`
+    const { stdout } = await promisify(execFile)(
+      'supabase',
+      [
+        'gen',
+        'types',
+        'typescript',
+        `--project-id=${projectId}`,
+        '--schema=public',
+      ],
+      { maxBuffer: 1024 * 1024 * 16 }
+    )
+    writeFileSync(join(cwd(), 'shared/types/supabase.ts'), stdout, 'utf-8')
+    consola.success('Supabase types generated.')
   } catch (error) {
     consola.error('Unhandled error:', error)
   }

package/scripts/tsconfig.json

@@ -0,0 +1,18 @@
+{
+  // This folder is excluded from the Nuxt app itself (see `ignore` in
+  // ../nuxt.config.ts), so it needs its own project - otherwise editors have
+  // no tsconfig to resolve against here and Node globals (process, fs, etc.)
+  // won't show up.
+  "compilerOptions": {
+    "target": "ESNext",
+    "lib": ["ESNext"],
+    "moduleDetection": "force",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "types": ["node"],
+    "strict": true,
+    "noEmit": true,
+    "skipLibCheck": true
+  },
+  "include": ["./**/*.ts", "../server/utils/typegen.ts"]
+}

package/server/api/auth/signup.post.ts

@@ -0,0 +1,46 @@
+import { serverSupabaseClient } from '#supabase/server'
+
+interface Payload {
+  username: string
+  display_name: string
+  email: string
+  password: string
+}
+
+export default defineEventHandler(async (event) => {
+  const client = await serverSupabaseClient<Database>(event)
+
+  const body = await readBody<Payload>(event)
+
+  if (!body.username || body.username.length < 3) {
+    return {
+      success: false,
+      message: 'Username must be at least 3 characters.',
+    }
+  }
+
+  const { data, error } = await client.auth.signUp({
+    email: body.email,
+    password: body.password,
+    options: {
+      data: {
+        username: body.username,
+        display_name: body.display_name,
+      },
+    },
+  })
+
+  if (error) {
+    return {
+      success: false,
+      message: error.message,
+      error,
+    }
+  }
+
+  return {
+    success: true,
+    message: 'User registered successfully',
+    data,
+  }
+})

package/server/api/setup/create.post.ts

@@ -1,92 +1,13 @@
+import { readFile, writeFile } from 'node:fs/promises'
+import { resolve } from 'node:path'
 import postgres from 'postgres'
+import { splitStatements } from '../../utils/sql'
 
 interface Payload {
   baseUrl: string
   connectionString: string
 }
 
-/**
- * Splits a SQL string into individual statements, correctly handling
- * $$ dollar-quoted blocks, single-quoted strings, and -- comments.
- */
-function splitStatements(sql: string): string[] {
-  const statements: string[] = []
-  let current = ''
-  let i = 0
-
-  while (i < sql.length) {
-    // Check for dollar-quoting ($$)
-    if (sql[i] === '$' && sql[i + 1] === '$') {
-      current += '$$'
-      i += 2
-      // Read until closing $$
-      while (i < sql.length) {
-        if (sql[i] === '$' && sql[i + 1] === '$') {
-          current += '$$'
-          i += 2
-          break
-        }
-        current += sql[i]
-        i++
-      }
-      continue
-    }
-
-    // Check for single-quoted strings (handle '' escapes)
-    if (sql[i] === `'`) {
-      current += sql[i]
-      i++
-      while (i < sql.length) {
-        if (sql[i] === `'` && sql[i + 1] === `'`) {
-          // Escaped quote
-          current += `''`
-          i += 2
-          continue
-        }
-        if (sql[i] === `'`) {
-          current += sql[i]
-          i++
-          break
-        }
-        current += sql[i]
-        i++
-      }
-      continue
-    }
-
-    // Check for single-line comments
-    if (sql[i] === '-' && sql[i + 1] === '-') {
-      while (i < sql.length && sql[i] !== '\n') {
-        current += sql[i]
-        i++
-      }
-      continue
-    }
-
-    // Statement terminator
-    if (sql[i] === ';') {
-      current += ';'
-      const trimmed = current.trim()
-      if (trimmed && trimmed !== ';') {
-        statements.push(trimmed)
-      }
-      current = ''
-      i++
-      continue
-    }
-
-    current += sql[i]
-    i++
-  }
-
-  const trimmed = current.trim()
-  if (trimmed && trimmed !== ';') {
-    statements.push(trimmed)
-  }
-
-  return statements
-}
-
 export default defineEventHandler(async (event) => {
   const body = await readBody<Payload>(event)
 
@@ -118,12 +39,41 @@ export default defineEventHandler(async (event) => {
       await sql.unsafe(statement)
     }
 
-    // Set the first_setup flag in the healthcheck table to false
-    await sql`
-      UPDATE healthcheck
-      SET config_value = 'false'
-      WHERE config_name = 'first_setup';
-    `
+    // Mark first_setup as complete
+    await sql.unsafe(
+      `UPDATE public.healthcheck SET config_value = 'false' WHERE config_name = 'first_setup'`
+    )
+
+    // Record the core schema migration
+    await sql.unsafe(
+      `INSERT INTO public.pluto_migrations (layer_name)
+       VALUES ('core')
+       ON CONFLICT (layer_name) DO NOTHING`
+    )
+
+    // Persist connection string to .env for future layer migrations
+    const envPath = resolve(process.cwd(), '.env')
+    let envContent = ''
+    try {
+      envContent = await readFile(envPath, 'utf-8')
+    } catch {
+      // .env doesn't exist yet
+    }
+
+    if (envContent.includes('DATABASE_URL=')) {
+      envContent = envContent.replace(
+        /^DATABASE_URL=.*$/m,
+        `DATABASE_URL="${connectionString}"`
+      )
+    } else {
+      // Ensure there's a trailing newline before appending
+      if (envContent.length > 0 && !envContent.endsWith('\n')) {
+        envContent += '\n'
+      }
+      envContent += `DATABASE_URL="${connectionString}"\n`
+    }
+
+    await writeFile(envPath, envContent, 'utf-8')
 
     return {
       success: true,

package/server/plugins/migrations.ts

@@ -0,0 +1,60 @@
+import { runLayerMigration } from '../utils/migrations'
+import { regenerateSupabaseTypes } from '../utils/typegen'
+
+export default defineNitroPlugin(async () => {
+  // Only run if DATABASE_URL is configured (setup already completed)
+  if (!process.env.DATABASE_URL) {
+    return
+  }
+
+  const config = useRuntimeConfig()
+  const layerSchemas = config.plutoLayerSchemas ?? {}
+
+  const layerNames = Object.keys(layerSchemas)
+
+  if (layerNames.length === 0) {
+    return
+  }
+
+  let anyApplied = false
+
+  for (const layerName of layerNames) {
+    const schemaSql = layerSchemas[layerName]
+
+    if (!schemaSql) {
+      continue
+    }
+
+    try {
+      const result = await runLayerMigration({
+        layerName,
+        schemaSql,
+      })
+
+      if (result.skipped) {
+        console.warn(
+          `[migrations] Layer "${layerName}" already applied, skipped.`
+        )
+      } else if (result.success) {
+        console.warn(`[migrations] Layer "${layerName}" migrated successfully.`)
+        anyApplied = true
+      } else {
+        console.error(`[migrations] Layer "${layerName}" failed:`, result.error)
+      }
+    } catch (error) {
+      console.error(
+        `[migrations] Error running migration for "${layerName}":`,
+        error
+      )
+    }
+  }
+
+  // Regenerate Database types from the live schema whenever a layer schema
+  // was newly applied, so `Database` stays in sync without a manual step.
+  // Re-editing an already-applied layer schema is a no-op here (it's
+  // recorded as `skipped`); use the `supabase-types` script to force a
+  // refresh in that case.
+  if (import.meta.dev && anyApplied && config.plutoRootDir) {
+    await regenerateSupabaseTypes(config.plutoRootDir)
+  }
+})

package/server/utils/migrations.ts

@@ -0,0 +1,88 @@
+import postgres from 'postgres'
+import { splitStatements } from './sql'
+
+/**
+ * Retrieves the database connection string from environment variables.
+ * Stored in .env during initial setup.
+ */
+export function getConnectionString(): string | null {
+  return process.env.DATABASE_URL ?? null
+}
+
+/**
+ * Checks if a specific layer migration has already been applied.
+ */
+async function isMigrationApplied(
+  sql: postgres.Sql,
+  layerName: string
+): Promise<boolean> {
+  const result = await sql.unsafe(
+    `SELECT 1 FROM public.pluto_migrations WHERE layer_name = $1`,
+    [layerName]
+  )
+  return result.length > 0
+}
+
+/**
+ * Records a migration as applied.
+ */
+async function recordMigration(
+  sql: postgres.Sql,
+  layerName: string
+): Promise<void> {
+  await sql.unsafe(
+    `INSERT INTO public.pluto_migrations (layer_name)
+     VALUES ($1)
+     ON CONFLICT (layer_name) DO NOTHING`,
+    [layerName]
+  )
+}
+
+interface LayerMigrationResult {
+  success: boolean
+  skipped?: boolean
+  error?: string
+}
+
+/**
+ * Runs a layer's schema SQL if not already applied.
+ * Splits and executes statements, then records the migration.
+ */
+export async function runLayerMigration(opts: {
+  layerName: string
+  schemaSql: string
+  connectionString?: string
+}): Promise<LayerMigrationResult> {
+  const connStr = opts.connectionString ?? getConnectionString()
+
+  if (!connStr) {
+    return {
+      success: false,
+      error: 'No DATABASE_URL configured. Re-run setup or add it to .env.',
+    }
+  }
+
+  const sql = postgres(connStr)
+
+  try {
+    const applied = await isMigrationApplied(sql, opts.layerName)
+    if (applied) {
+      return { success: true, skipped: true }
+    }
+
+    const statements = splitStatements(opts.schemaSql)
+
+    for (const statement of statements) {
+      await sql.unsafe(statement)
+    }
+
+    await recordMigration(sql, opts.layerName)
+
+    return { success: true }
+  } catch (error: any) {
+    console.error(`Migration error [${opts.layerName}]:`, error)
+    return { success: false, error: error.message }
+  } finally {
+    await sql.end()
+  }
+}

package/server/utils/sql.ts

@@ -0,0 +1,81 @@
+/**
+ * Splits a SQL string into individual statements, correctly handling
+ * $$ dollar-quoted blocks, single-quoted strings, and -- comments.
+ */
+export function splitStatements(sql: string): string[] {
+  const statements: string[] = []
+  let current = ''
+  let i = 0
+
+  while (i < sql.length) {
+    // Check for dollar-quoting ($$)
+    if (sql[i] === '$' && sql[i + 1] === '$') {
+      current += '$$'
+      i += 2
+      // Read until closing $$
+      while (i < sql.length) {
+        if (sql[i] === '$' && sql[i + 1] === '$') {
+          current += '$$'
+          i += 2
+          break
+        }
+        current += sql[i]
+        i++
+      }
+      continue
+    }
+
+    // Check for single-quoted strings (handle '' escapes)
+    if (sql[i] === `'`) {
+      current += sql[i]
+      i++
+      while (i < sql.length) {
+        if (sql[i] === `'` && sql[i + 1] === `'`) {
+          // Escaped quote
+          current += `''`
+          i += 2
+          continue
+        }
+        if (sql[i] === `'`) {
+          current += sql[i]
+          i++
+          break
+        }
+        current += sql[i]
+        i++
+      }
+      continue
+    }
+
+    // Check for single-line comments
+    if (sql[i] === '-' && sql[i + 1] === '-') {
+      while (i < sql.length && sql[i] !== '\n') {
+        current += sql[i]
+        i++
+      }
+      continue
+    }
+
+    // Statement terminator
+    if (sql[i] === ';') {
+      current += ';'
+      const trimmed = current.trim()
+      if (trimmed && trimmed !== ';') {
+        statements.push(trimmed)
+      }
+      current = ''
+      i++
+      continue
+    }
+
+    current += sql[i]
+    i++
+  }
+
+  const trimmed = current.trim()
+  if (trimmed && trimmed !== ';') {
+    statements.push(trimmed)
+  }
+
+  return statements
+}

package/server/utils/typegen.ts

@@ -0,0 +1,68 @@
+import { execFile } from 'node:child_process'
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { promisify } from 'node:util'
+
+const execFileAsync = promisify(execFile)
+
+/**
+ * Resolves the local `supabase` CLI binary from node_modules/.bin so
+ * generation works from within the Nitro dev server without relying on
+ * `bunx`/`npx` (and without requiring `supabase login`, since we connect
+ * directly via --db-url).
+ */
+function resolveSupabaseBin(rootDir: string): string {
+  const binName = process.platform === 'win32' ? 'supabase.cmd' : 'supabase'
+  const localBin = join(rootDir, 'node_modules/.bin', binName)
+  return existsSync(localBin) ? localBin : 'supabase'
+}
+
+/**
+ * Regenerates the Supabase `Database` types from the live database schema
+ * and writes them to <rootDir>/shared/types/supabase.ts, only touching the
+ * file if the content actually changed (avoids needless dev-server reloads).
+ *
+ * Never throws — failures are logged and swallowed so this can safely run
+ * as a side effect of the migrations plugin without breaking server boot.
+ */
+export async function regenerateSupabaseTypes(
+  rootDir: string,
+  connectionString?: string
+): Promise<void> {
+  const connStr = connectionString ?? process.env.DATABASE_URL
+
+  if (!connStr) {
+    console.warn(
+      '[typegen] Skipping Supabase type generation: no DATABASE_URL configured.'
+    )
+    return
+  }
+
+  const targetPath = join(rootDir, 'shared/types/supabase.ts')
+
+  try {
+    const { stdout } = await execFileAsync(
+      resolveSupabaseBin(rootDir),
+      ['gen', 'types', 'typescript', '--db-url', connStr, '--schema', 'public'],
+      { maxBuffer: 1024 * 1024 * 16 }
+    )
+
+    if (!stdout.trim()) {
+      console.warn('[typegen] Supabase CLI returned no output, skipping write.')
+      return
+    }
+
+    const existing = existsSync(targetPath)
+      ? readFileSync(targetPath, 'utf-8')
+      : null
+
+    if (existing === stdout) {
+      return
+    }
+
+    writeFileSync(targetPath, stdout, 'utf-8')
+    console.warn(`[typegen] Regenerated Supabase types at ${targetPath}`)
+  } catch (error) {
+    console.warn('[typegen] Failed to regenerate Supabase types:', error)
+  }
+}