@plutocms/supabase 0.0.1-alpha.9 → 0.1.1

package/nuxt.config.ts

@@ -1,5 +1,10 @@
+// Point these at a local checkout (e.g. `../pluto`, `../utils`) to test
+// unpublished changes; unset, they resolve to the published npm packages.
+const plutoLayer = process.env.PLUTO_PLUTO_PATH || '@plutocms/pluto'
+const utilsLayer = process.env.PLUTO_UTILS_PATH || '@plutocms/utils'
+
 export default defineNuxtConfig({
-  extends: [['@plutocms/pluto', { install: true }], '@plutocms/utils'],
+  extends: [[plutoLayer, { install: true }], utilsLayer],
 
   modules: ['@nuxt/eslint', '@nuxtjs/supabase'],
 
@@ -10,6 +15,8 @@ export default defineNuxtConfig({
   runtimeConfig: {
     supabaseUrl: process.env.SUPABASE_URL,
     supabaseKey: process.env.SUPABASE_KEY,
+    plutoRootDir: '',
+    plutoLayerSchemas: {} as Record<string, string>,
   },
 
   alias: {
@@ -24,6 +31,12 @@ export default defineNuxtConfig({
     },
   },
 
+  vite: {
+    optimizeDeps: {
+      include: ['yup'],
+    },
+  },
+
   eslint: {
     config: {
       nuxt: {

package/package.json

@@ -1,7 +1,26 @@
 {
   "name": "@plutocms/supabase",
   "type": "module",
-  "version": "0.0.1-alpha.9",
+  "version": "0.1.1",
+  "trustedDependencies": [
+    "@parcel/watcher",
+    "@plutocms/pluto",
+    "@plutocms/utils",
+    "esbuild",
+    "supabase",
+    "unrs-resolver",
+    "vue-demi"
+  ],
+  "description": "Supabase backend layer for Pluto CMS",
+  "author": "Victor Ribeiro",
+  "homepage": "https://github.com/plutocms/supabase#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/plutocms/supabase.git"
+  },
+  "bugs": {
+    "url": "https://github.com/plutocms/supabase/issues"
+  },
   "main": "./nuxt.config.ts",
   "scripts": {
     "build": "nuxt build",
@@ -12,35 +31,32 @@
     "prettier": "prettier --write .",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix && prettier --write .",
+    "typecheck": "nuxi typecheck",
     "supabase-types": "bun ./scripts/supabase-typegen.ts"
   },
   "dependencies": {
-    "@nuxtjs/supabase": "2.0.3",
-    "@plutocms/pluto": "^0.0.1-alpha.4",
-    "@plutocms/utils": "^0.0.1-alpha.5",
-    "postgres": "^3.4.8",
-    "supabase": "^2.76.15",
+    "@nuxt/ui": "^4.9.0",
+    "@nuxtjs/supabase": "^2.0.9",
+    "@plutocms/pluto": "^0.1.0",
+    "@plutocms/utils": "^0.1.0",
+    "postgres": "^3.4.9",
+    "supabase": "^2.109.1",
     "yup": "1.7.1"
   },
   "devDependencies": {
     "@antfu/eslint-config": "^6.2.0",
-    "@nuxt/eslint": "^1.15.1",
-    "@nuxt/ui": "^4.4.0",
-    "@types/bun": "^1.3.9",
-    "@vueuse/nuxt": "^14.2.1",
-    "eslint": "^9.39.1",
-    "nuxt": "^4.3.1",
-    "prettier": "^3.8.1",
-    "vue": "^3.5.28",
-    "vue-router": "^5.0.2"
+    "@nuxt/eslint": "^1.16.0",
+    "@types/bun": "^1.3.14",
+    "@vueuse/nuxt": "^14.3.0",
+    "eslint": "^10.6.0",
+    "nuxt": "^4.4.2",
+    "prettier": "^3.9.4",
+    "tailwindcss": "^4.3.2",
+    "vue": "^3.5.39",
+    "vue-router": "^5.1.0",
+    "vue-tsc": "^3.3.7"
   },
-  "trustedDependencies": [
-    "@parcel/watcher",
-    "@plutocms/pluto",
-    "@plutocms/utils",
-    "esbuild",
-    "supabase",
-    "unrs-resolver",
-    "vue-demi"
-  ]
+  "publishConfig": {
+    "access": "public"
+  }
 }

package/public/schema.sql

@@ -106,12 +106,12 @@ alter table public.healthcheck enable row level security;
 do $$
 begin
   if not exists (
-    select 1 from pg_policies where tablename = 'healthcheck' and policyname = 'Enable read access for healthcheck to public and dashboard_user'
+    select 1 from pg_policies where tablename = 'healthcheck' and policyname = 'Enable read access for healthcheck to public'
   ) then
-    create policy "Enable read access for healthcheck to public and dashboard_user"
+    create policy "Enable read access for healthcheck to public"
     on public.healthcheck
     for select
-    to public, dashboard_user
+    to public
     using (true);
   end if;
 end
@@ -137,6 +137,7 @@ $$;
 create table if not exists public.profiles (
   id uuid references auth.users on delete cascade not null primary key,
   updated_at timestamp with time zone,
+  email text,
   username text,
   display_name text,
   is_admin boolean not null default false,
@@ -160,14 +161,29 @@ end
 $$;
 
 --- inserts a row into public.profiles
+--- automatically grants admin to the first user if no profiles exist yet
 create or replace function public.handle_new_user()
 returns trigger
 language plpgsql
 security definer set search_path = ''
 as $$
+declare
+  profile_count int;
+  should_be_admin boolean;
 begin
-  insert into public.profiles (id, username, display_name)
-  values (new.id, new.raw_user_meta_data ->> 'username', new.raw_user_meta_data ->> 'display_name');
+  select count(*) into profile_count from public.profiles;
+
+  should_be_admin := profile_count = 0
+    or coalesce((new.raw_user_meta_data ->> 'is_admin')::boolean, false);
+
+  insert into public.profiles (id, email, username, display_name, is_admin)
+  values (
+    new.id,
+    new.email,
+    new.raw_user_meta_data ->> 'username',
+    new.raw_user_meta_data ->> 'display_name',
+    should_be_admin
+  );
   return new;
 end;
 $$;
@@ -183,3 +199,28 @@ begin
   end if;
 end
 $$;
+
+-- Migrations tracking
+create table if not exists public.pluto_migrations (
+  id bigint generated by default as identity primary key,
+  layer_name text not null,
+  applied_at timestamptz not null default now(),
+  constraint pluto_migrations_layer_key unique (layer_name)
+);
+
+alter table public.pluto_migrations enable row level security;
+
+-- Only authenticated users can read migrations
+do $$
+begin
+  if not exists (
+    select 1 from pg_policies where tablename = 'pluto_migrations' and policyname = 'Enable read access for authenticated users on pluto_migrations'
+  ) then
+    create policy "Enable read access for authenticated users on pluto_migrations"
+    on public.pluto_migrations
+    for select
+    to authenticated, dashboard_user
+    using (true);
+  end if;
+end
+$$;

package/scripts/supabase-typegen.ts

@@ -1,35 +1,50 @@
-import fs from 'node:fs'
-import path from 'node:path'
 import { cwd } from 'node:process'
-import { $ } from 'bun'
 import { consola } from 'consola'
+import { regenerateSupabaseTypes } from '../server/utils/typegen'
 
+const databaseUrl = process.env.DATABASE_URL
 const projectUrl = process.env.SUPABASE_URL
-const projectId = projectUrl?.split('.supabase.co')[0]?.replace('https://', '')
-const _path = path
-  .resolve(cwd(), './shared/types/supabase.ts')
-  .replace(/\\/g, '/')
 
 ;(async () => {
-  consola.info(`Generating Supabase types for project: ${projectId}`)
-
-  // Create file if it doesn't exist
-  if (!fs.existsSync(_path)) {
-    consola.info('Types file does not exist. Creating a new one.')
+  if (databaseUrl) {
+    consola.info('Generating Supabase types via DATABASE_URL...')
+    await regenerateSupabaseTypes(cwd(), databaseUrl)
+    return
+  }
 
-    fs.mkdirSync(path.dirname(_path), { recursive: true })
-    fs.writeFileSync(_path, '', 'utf-8')
+  if (!projectUrl) {
+    consola.error(
+      'Cannot generate Supabase types: neither DATABASE_URL nor SUPABASE_URL is set.'
+    )
+    return
   }
 
-  const args = [
-    `--project-id=${projectId || ''}`,
-    '--schema=public',
-    '>',
-    `"${_path}"`,
-  ]
+  consola.warn(
+    'DATABASE_URL is not set; falling back to --project-id (requires `supabase login`).'
+  )
+
+  const projectId = projectUrl.split('.supabase.co')[0]?.replace('https://', '')
+  const { execFile } = await import('node:child_process')
+  const { promisify } = await import('node:util')
+  const { writeFileSync } = await import('node:fs')
+  const { join } = await import('node:path')
+
+  consola.info(`Generating Supabase types for project: ${projectId}`)
 
   try {
-    await $`bunx supabase gen types typescript ${{ raw: args.join(' ') }}`
+    const { stdout } = await promisify(execFile)(
+      'supabase',
+      [
+        'gen',
+        'types',
+        'typescript',
+        `--project-id=${projectId}`,
+        '--schema=public',
+      ],
+      { maxBuffer: 1024 * 1024 * 16 }
+    )
+    writeFileSync(join(cwd(), 'shared/types/supabase.ts'), stdout, 'utf-8')
+    consola.success('Supabase types generated.')
   } catch (error) {
     consola.error('Unhandled error:', error)
   }

package/scripts/tsconfig.json

@@ -0,0 +1,18 @@
+{
+  // This folder is excluded from the Nuxt app itself (see `ignore` in
+  // ../nuxt.config.ts), so it needs its own project - otherwise editors have
+  // no tsconfig to resolve against here and Node globals (process, fs, etc.)
+  // won't show up.
+  "compilerOptions": {
+    "target": "ESNext",
+    "lib": ["ESNext"],
+    "moduleDetection": "force",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "types": ["node"],
+    "strict": true,
+    "noEmit": true,
+    "skipLibCheck": true
+  },
+  "include": ["./**/*.ts", "../server/utils/typegen.ts"]
+}

package/server/api/{signup.post.ts → auth/signup.post.ts}

@@ -5,7 +5,6 @@ interface Payload {
   display_name: string
   email: string
   password: string
-  is_admin?: boolean
 }
 
 export default defineEventHandler(async (event) => {
@@ -13,6 +12,13 @@ export default defineEventHandler(async (event) => {
 
   const body = await readBody<Payload>(event)
 
+  if (!body.username || body.username.length < 3) {
+    return {
+      success: false,
+      message: 'Username must be at least 3 characters.',
+    }
+  }
+
   const { data, error } = await client.auth.signUp({
     email: body.email,
     password: body.password,
@@ -20,7 +26,6 @@ export default defineEventHandler(async (event) => {
       data: {
         username: body.username,
         display_name: body.display_name,
-        is_admin: body.is_admin || false,
       },
     },
   })
@@ -33,20 +38,6 @@ export default defineEventHandler(async (event) => {
     }
   }
 
-  // Set the first_setup flag in the healthcheck table to false
-  const { error: healthcheckError } = await client
-    .from('healthcheck')
-    .update({ config_value: 'false' })
-    .eq('config_name', 'first_setup')
-
-  if (healthcheckError) {
-    return {
-      success: false,
-      message: healthcheckError.message,
-      error: healthcheckError,
-    }
-  }
-
   return {
     success: true,
     message: 'User registered successfully',

package/server/api/setup/create.post.ts

@@ -1,92 +1,13 @@
+import { readFile, writeFile } from 'node:fs/promises'
+import { resolve } from 'node:path'
 import postgres from 'postgres'
+import { splitStatements } from '../../utils/sql'
 
 interface Payload {
   baseUrl: string
   connectionString: string
 }
 
-/**
- * Splits a SQL string into individual statements, correctly handling
- * $$ dollar-quoted blocks, single-quoted strings, and -- comments.
- */
-function splitStatements(sql: string): string[] {
-  const statements: string[] = []
-  let current = ''
-  let i = 0
-
-  while (i < sql.length) {
-    // Check for dollar-quoting ($$)
-    if (sql[i] === '$' && sql[i + 1] === '$') {
-      current += '$$'
-      i += 2
-      // Read until closing $$
-      while (i < sql.length) {
-        if (sql[i] === '$' && sql[i + 1] === '$') {
-          current += '$$'
-          i += 2
-          break
-        }
-        current += sql[i]
-        i++
-      }
-      continue
-    }
-
-    // Check for single-quoted strings (handle '' escapes)
-    if (sql[i] === `'`) {
-      current += sql[i]
-      i++
-      while (i < sql.length) {
-        if (sql[i] === `'` && sql[i + 1] === `'`) {
-          // Escaped quote
-          current += `''`
-          i += 2
-          continue
-        }
-        if (sql[i] === `'`) {
-          current += sql[i]
-          i++
-          break
-        }
-        current += sql[i]
-        i++
-      }
-      continue
-    }
-
-    // Check for single-line comments
-    if (sql[i] === '-' && sql[i + 1] === '-') {
-      while (i < sql.length && sql[i] !== '\n') {
-        current += sql[i]
-        i++
-      }
-      continue
-    }
-
-    // Statement terminator
-    if (sql[i] === ';') {
-      current += ';'
-      const trimmed = current.trim()
-      if (trimmed && trimmed !== ';') {
-        statements.push(trimmed)
-      }
-      current = ''
-      i++
-      continue
-    }
-
-    current += sql[i]
-    i++
-  }
-
-  const trimmed = current.trim()
-  if (trimmed && trimmed !== ';') {
-    statements.push(trimmed)
-  }
-
-  return statements
-}
-
 export default defineEventHandler(async (event) => {
   const body = await readBody<Payload>(event)
 
@@ -118,6 +39,42 @@ export default defineEventHandler(async (event) => {
       await sql.unsafe(statement)
     }
 
+    // Mark first_setup as complete
+    await sql.unsafe(
+      `UPDATE public.healthcheck SET config_value = 'false' WHERE config_name = 'first_setup'`
+    )
+
+    // Record the core schema migration
+    await sql.unsafe(
+      `INSERT INTO public.pluto_migrations (layer_name)
+       VALUES ('core')
+       ON CONFLICT (layer_name) DO NOTHING`
+    )
+
+    // Persist connection string to .env for future layer migrations
+    const envPath = resolve(process.cwd(), '.env')
+    let envContent = ''
+    try {
+      envContent = await readFile(envPath, 'utf-8')
+    } catch {
+      // .env doesn't exist yet
+    }
+
+    if (envContent.includes('DATABASE_URL=')) {
+      envContent = envContent.replace(
+        /^DATABASE_URL=.*$/m,
+        `DATABASE_URL="${connectionString}"`
+      )
+    } else {
+      // Ensure there's a trailing newline before appending
+      if (envContent.length > 0 && !envContent.endsWith('\n')) {
+        envContent += '\n'
+      }
+      envContent += `DATABASE_URL="${connectionString}"\n`
+    }
+
+    await writeFile(envPath, envContent, 'utf-8')
+
     return {
       success: true,
       message: 'Database setup completed successfully.',

package/server/plugins/migrations.ts

@@ -0,0 +1,60 @@
+import { runLayerMigration } from '../utils/migrations'
+import { regenerateSupabaseTypes } from '../utils/typegen'
+
+export default defineNitroPlugin(async () => {
+  // Only run if DATABASE_URL is configured (setup already completed)
+  if (!process.env.DATABASE_URL) {
+    return
+  }
+
+  const config = useRuntimeConfig()
+  const layerSchemas = config.plutoLayerSchemas ?? {}
+
+  const layerNames = Object.keys(layerSchemas)
+
+  if (layerNames.length === 0) {
+    return
+  }
+
+  let anyApplied = false
+
+  for (const layerName of layerNames) {
+    const schemaSql = layerSchemas[layerName]
+
+    if (!schemaSql) {
+      continue
+    }
+
+    try {
+      const result = await runLayerMigration({
+        layerName,
+        schemaSql,
+      })
+
+      if (result.skipped) {
+        console.warn(
+          `[migrations] Layer "${layerName}" already applied, skipped.`
+        )
+      } else if (result.success) {
+        console.warn(`[migrations] Layer "${layerName}" migrated successfully.`)
+        anyApplied = true
+      } else {
+        console.error(`[migrations] Layer "${layerName}" failed:`, result.error)
+      }
+    } catch (error) {
+      console.error(
+        `[migrations] Error running migration for "${layerName}":`,
+        error
+      )
+    }
+  }
+
+  // Regenerate Database types from the live schema whenever a layer schema
+  // was newly applied, so `Database` stays in sync without a manual step.
+  // Re-editing an already-applied layer schema is a no-op here (it's
+  // recorded as `skipped`); use the `supabase-types` script to force a
+  // refresh in that case.
+  if (import.meta.dev && anyApplied && config.plutoRootDir) {
+    await regenerateSupabaseTypes(config.plutoRootDir)
+  }
+})

package/server/utils/migrations.ts

@@ -0,0 +1,88 @@
+import postgres from 'postgres'
+import { splitStatements } from './sql'
+
+/**
+ * Retrieves the database connection string from environment variables.
+ * Stored in .env during initial setup.
+ */
+export function getConnectionString(): string | null {
+  return process.env.DATABASE_URL ?? null
+}
+
+/**
+ * Checks if a specific layer migration has already been applied.
+ */
+async function isMigrationApplied(
+  sql: postgres.Sql,
+  layerName: string
+): Promise<boolean> {
+  const result = await sql.unsafe(
+    `SELECT 1 FROM public.pluto_migrations WHERE layer_name = $1`,
+    [layerName]
+  )
+  return result.length > 0
+}
+
+/**
+ * Records a migration as applied.
+ */
+async function recordMigration(
+  sql: postgres.Sql,
+  layerName: string
+): Promise<void> {
+  await sql.unsafe(
+    `INSERT INTO public.pluto_migrations (layer_name)
+     VALUES ($1)
+     ON CONFLICT (layer_name) DO NOTHING`,
+    [layerName]
+  )
+}
+
+interface LayerMigrationResult {
+  success: boolean
+  skipped?: boolean
+  error?: string
+}
+
+/**
+ * Runs a layer's schema SQL if not already applied.
+ * Splits and executes statements, then records the migration.
+ */
+export async function runLayerMigration(opts: {
+  layerName: string
+  schemaSql: string
+  connectionString?: string
+}): Promise<LayerMigrationResult> {
+  const connStr = opts.connectionString ?? getConnectionString()
+
+  if (!connStr) {
+    return {
+      success: false,
+      error: 'No DATABASE_URL configured. Re-run setup or add it to .env.',
+    }
+  }
+
+  const sql = postgres(connStr)
+
+  try {
+    const applied = await isMigrationApplied(sql, opts.layerName)
+    if (applied) {
+      return { success: true, skipped: true }
+    }
+
+    const statements = splitStatements(opts.schemaSql)
+
+    for (const statement of statements) {
+      await sql.unsafe(statement)
+    }
+
+    await recordMigration(sql, opts.layerName)
+
+    return { success: true }
+  } catch (error: any) {
+    console.error(`Migration error [${opts.layerName}]:`, error)
+    return { success: false, error: error.message }
+  } finally {
+    await sql.end()
+  }
+}