@plutocms/supabase 0.11.0 → 0.11.2

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## [0.11.2](https://github.com/plutocms/supabase/compare/v0.11.1...v0.11.2) (2026-10-22)
+
+
+### Bug Fixes
+
+* **db:** grant Data API access explicitly and restrict staff reads ([#93](https://github.com/plutocms/supabase/issues/93)) ([0ed2d56](https://github.com/plutocms/supabase/commit/0ed2d56c593ed6550312692e125ba75525f5fd69))
+* **typegen:** keep the PostgREST version block and match the app's lint output ([#94](https://github.com/plutocms/supabase/issues/94)) ([38ec3ea](https://github.com/plutocms/supabase/commit/38ec3ea5e49ef559cfc8142bbbfff401f934cd22))
+
+## [0.11.1](https://github.com/plutocms/supabase/compare/v0.11.0...v0.11.1) (2026-10-21)
+
+
+### Bug Fixes
+
+* **deps:** use @plutocms/pluto 0.17 ([#91](https://github.com/plutocms/supabase/issues/91)) ([7deeac5](https://github.com/plutocms/supabase/commit/7deeac5379ddaac0317fa457897190c0850e8ffc))
+* **typegen:** keep the PostgREST version block and the app's format ([#90](https://github.com/plutocms/supabase/issues/90)) ([2518c33](https://github.com/plutocms/supabase/commit/2518c33f69fe188e69d93695819d7d3ca19932d7))
+
+
+### Performance Improvements
+
+* **admin:** load the admin components on demand and start the setup check early ([#89](https://github.com/plutocms/supabase/issues/89)) ([f0d36bc](https://github.com/plutocms/supabase/commit/f0d36bc7d46f911522990653cd93ebb523c5a774))
+
 ## [0.11.0](https://github.com/plutocms/supabase/compare/v0.10.0...v0.11.0) (2026-10-20)
 
 

package/app/plugins/pluto-extension.ts

@@ -1,6 +1,16 @@
-import AuthSignIn from '../components/auth/AuthSignIn.vue'
-import MigrationsBanner from '../components/migrations/MigrationsBanner.vue'
-import SettingsGeneralPanel from '../components/settings/SettingsGeneralPanel.vue'
+import { defineAsyncComponent } from 'vue'
+
+// The three components load on demand. They stay out of the entry chunk. Core
+// shows a skeleton while each chunk loads.
+const AuthSignIn = defineAsyncComponent(
+  () => import('../components/auth/AuthSignIn.vue')
+)
+const MigrationsBanner = defineAsyncComponent(
+  () => import('../components/migrations/MigrationsBanner.vue')
+)
+const SettingsGeneralPanel = defineAsyncComponent(
+  () => import('../components/settings/SettingsGeneralPanel.vue')
+)
 
 export default defineNuxtPlugin(() => {
   // Read at setup, while the Nuxt context exists. The driver below calls it
@@ -35,11 +45,7 @@ export default defineNuxtPlugin(() => {
   // again each time.
   const setupDone = useState<boolean>('supabase-setup-done', () => false)
 
-  async function readSetupState(): Promise<SetupState> {
-    if (setupDone.value) {
-      return 'done'
-    }
-
+  async function fetchSetupState(): Promise<SetupState> {
     let state: SetupState = 'unknown'
     try {
       state = setupStateFromResponse(
@@ -56,6 +62,27 @@ export default defineNuxtPlugin(() => {
     return state
   }
 
+  // On a cold load of an admin path, the request starts here, at plugin setup.
+  // The guard then awaits a request that is already in flight. The guard takes
+  // this promise once, so a later navigation reads the state again.
+  let earlyState: Promise<SetupState> | null =
+    import.meta.client &&
+    !setupDone.value &&
+    /^\/admin(?:\/|$)/.test(window.location.pathname)
+      ? fetchSetupState()
+      : null
+
+  async function readSetupState(): Promise<SetupState> {
+    if (setupDone.value) {
+      return 'done'
+    }
+
+    const early = earlyState
+    earlyState = null
+
+    return early ?? fetchSetupState()
+  }
+
   if (import.meta.client) {
     watch(
       [() => Boolean(session.value), hasSettingsModified],

package/db/migrations/006_data_api_grants.sql

@@ -0,0 +1,48 @@
+-- Data API grants
+--
+-- From 2026-10-30, Supabase stops granting Data API access to new tables
+-- in the public schema on its own. A table that a migration creates needs
+-- an explicit grant, or the API answers "permission denied" (42501).
+--
+-- This file grants the minimal privileges that the RLS policies of this
+-- layer already allow. It changes nothing on an older database: those
+-- tables already hold broader privileges, and grant is additive. Every
+-- statement is safe to run twice.
+--
+-- Rules: anon gets select only, and only on a table with a public read
+-- policy. service_role gets select, insert, update and delete. No file
+-- grants truncate, references, trigger or all.
+
+-- healthcheck: the setup check reads it without a login.
+grant select on public.healthcheck to anon;
+grant select, update on public.healthcheck to authenticated;
+
+-- settings: the policies allow select, insert and update.
+grant select, insert, update on public.settings to authenticated;
+
+-- profiles: select only. A write goes through a security definer function.
+grant select on public.profiles to authenticated;
+
+-- pluto_migrations: the admin reads the migration status.
+grant select on public.pluto_migrations to authenticated;
+
+-- Role tables: today's behavior. Every write policy needs public.is_admin().
+grant select, insert, update, delete on public.roles to authenticated;
+grant select, insert, update, delete on public.role_capabilities to authenticated;
+grant select, insert, update, delete on public.user_roles to authenticated;
+
+-- service_role: select, insert, update and delete on every table.
+grant select, insert, update, delete on public.healthcheck to service_role;
+grant select, insert, update, delete on public.settings to service_role;
+grant select, insert, update, delete on public.profiles to service_role;
+grant select, insert, update, delete on public.pluto_migrations to service_role;
+grant select, insert, update, delete on public.roles to service_role;
+grant select, insert, update, delete on public.role_capabilities to service_role;
+grant select, insert, update, delete on public.user_roles to service_role;
+
+-- Functions. Postgres already gives execute to public. These grants are
+-- explicit, so the access does not depend on that default.
+grant execute on function public.is_admin() to authenticated, service_role;
+grant execute on function public.has_capability(text) to authenticated, service_role;
+grant execute on function public.my_capabilities() to authenticated, service_role;
+grant execute on function public.set_my_locale(text) to authenticated;

package/db/migrations/007_restrict_staff_reads.sql

@@ -0,0 +1,58 @@
+-- Restrict staff reads
+--
+-- Sign-up is open. Before this file, any signed-in user could read every
+-- row of settings, pluto_migrations, roles and role_capabilities, because
+-- the select policies used "using (true)". This file narrows them.
+--
+-- settings: a user who holds at least one capability (staff) reads them.
+--   The admin bar loads the site name and URL for every staff user.
+-- pluto_migrations: only an admin reads it. The migrations page is
+--   admin only (requireAdmin -> public.is_admin()).
+-- roles, role_capabilities: only an admin reads them. Only security
+--   definer functions read them for other users.
+--
+-- dashboard_user keeps its access where it had access before. Every
+-- statement is safe to run twice.
+
+-- settings
+drop policy if exists "Enable read access for authenticated users on settings" on public.settings;
+drop policy if exists "Enable read access for staff on settings" on public.settings;
+
+create policy "Enable read access for staff on settings"
+on public.settings
+for select
+to authenticated, dashboard_user
+using (
+  current_user = 'dashboard_user'
+  or exists (select 1 from public.my_capabilities())
+);
+
+-- pluto_migrations
+drop policy if exists "Enable read access for authenticated users on pluto_migrations" on public.pluto_migrations;
+drop policy if exists "Enable read access for admins on pluto_migrations" on public.pluto_migrations;
+
+create policy "Enable read access for admins on pluto_migrations"
+on public.pluto_migrations
+for select
+to authenticated, dashboard_user
+using (current_user = 'dashboard_user' or public.is_admin());
+
+-- roles
+drop policy if exists "Enable read access for authenticated users on roles" on public.roles;
+drop policy if exists "Enable read access for admins on roles" on public.roles;
+
+create policy "Enable read access for admins on roles"
+on public.roles
+for select
+to authenticated
+using (public.is_admin());
+
+-- role_capabilities
+drop policy if exists "Enable read access for authenticated users on role_capabilities" on public.role_capabilities;
+drop policy if exists "Enable read access for admins on role_capabilities" on public.role_capabilities;
+
+create policy "Enable read access for admins on role_capabilities"
+on public.role_capabilities
+for select
+to authenticated
+using (public.is_admin());

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@plutocms/supabase",
   "type": "module",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "trustedDependencies": [
     "@parcel/watcher",
     "@plutocms/pluto",
@@ -39,7 +39,7 @@
     "@nuxt/eslint": "^1.17.0",
     "@nuxt/ui": "^4.12.0",
     "@nuxtjs/supabase": "^2.1.0",
-    "@plutocms/pluto": "^0.16.0",
+    "@plutocms/pluto": "^0.17.0",
     "@plutocms/utils": "^0.2.1",
     "postgres": "^3.4.9",
     "supabase": "^2.121.0",

package/server/utils/typegen.ts

@@ -1,6 +1,8 @@
 import { execFile } from 'node:child_process'
 import { existsSync, readFileSync, writeFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
 import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
 import { promisify } from 'node:util'
 
 const execFileAsync = promisify(execFile)
@@ -12,9 +14,103 @@ const execFileAsync = promisify(execFile)
  * directly via --db-url).
  */
 function resolveSupabaseBin(rootDir: string): string {
-  const binName = process.platform === 'win32' ? 'supabase.cmd' : 'supabase'
-  const localBin = join(rootDir, 'node_modules/.bin', binName)
-  return existsSync(localBin) ? localBin : 'supabase'
+  // On Windows, npm installs `supabase.cmd` and Bun installs `supabase.exe`.
+  const binNames = process.platform === 'win32'
+    ? ['supabase.cmd', 'supabase.exe']
+    : ['supabase']
+  const localBin = binNames
+    .map((name) => join(rootDir, 'node_modules/.bin', name))
+    .find((path) => existsSync(path))
+  return localBin ?? 'supabase'
+}
+
+// The block, with its leading comment lines. The block has no nested braces.
+const INTERNAL_BLOCK = /(?:^[ \t]*\/\/[^\n]*\n)*^[ \t]*__InternalSupabase:\s*\{[^{}]*\}[ \t]*\n/m
+// The block itself. The name alone is not enough: the output also has it in
+// `Omit<Database, '__InternalSupabase'>`.
+const HAS_BLOCK = /^[ \t]*__InternalSupabase:\s*\{/m
+const DATABASE_OPEN = /^export type Database = \{[ \t]*\n/m
+
+/**
+ * Keeps the `__InternalSupabase` block of the existing types file.
+ *
+ * The `--db-url` mode of the Supabase CLI does not write this block. It
+ * holds the PostgREST version that supabase-js reads for its typings. When
+ * the new output has no block and the existing file has one, this function
+ * copies the existing block into the new output. In every other case it
+ * returns the new output as it is.
+ */
+export function keepInternalSupabase(
+  next: string,
+  existing: string | null
+): string {
+  if (!existing || HAS_BLOCK.test(next)) {
+    return next
+  }
+
+  const block = existing.match(INTERNAL_BLOCK)?.[0]
+  const open = next.match(DATABASE_OPEN)
+
+  if (!block || !open || open.index === undefined) {
+    return next
+  }
+
+  const at = open.index + open[0].length
+  // The CLI writes a whitespace-only line after the opening brace. After the
+  // block it would stay as a blank line, so remove it.
+  const rest = next.slice(at).replace(/^(?:[ \t]*\n)+/, '')
+
+  return next.slice(0, at) + block + rest
+}
+
+/**
+ * Imports a package from the app's node_modules (resolved from `rootDir`).
+ */
+async function importFromApp(rootDir: string, name: string) {
+  const entry = createRequire(join(rootDir, 'package.json')).resolve(name)
+  const mod = await import(pathToFileURL(entry).href)
+  return mod.default ?? mod
+}
+
+/**
+ * Fixes the text with the ESLint of the app. It resolves ESLint and the
+ * app's config from `rootDir`. It returns the text unchanged when the app
+ * has no ESLint, when ESLint ignores the file, or when the fix fails.
+ */
+async function fixWithAppEslint(
+  rootDir: string,
+  filePath: string,
+  text: string
+): Promise<string> {
+  try {
+    const { ESLint } = await importFromApp(rootDir, 'eslint')
+    const eslint = new ESLint({ cwd: rootDir, fix: true })
+    const [result] = await eslint.lintText(text, { filePath })
+
+    return result?.output ?? text
+  } catch {
+    return text
+  }
+}
+
+/**
+ * Formats the text with the Prettier of the app. It resolves Prettier from
+ * `rootDir`. It returns the text unchanged when the app has no Prettier or
+ * when the format fails.
+ */
+async function formatWithAppPrettier(
+  rootDir: string,
+  filePath: string,
+  text: string
+): Promise<string> {
+  try {
+    const api = await importFromApp(rootDir, 'prettier')
+    const options = (await api.resolveConfig(filePath)) ?? {}
+
+    return await api.format(text, { ...options, filepath: filePath })
+  } catch {
+    return text
+  }
 }
 
 /**
@@ -56,11 +152,20 @@ export async function regenerateSupabaseTypes(
       ? readFileSync(targetPath, 'utf-8')
       : null
 
-    if (existing === stdout) {
+    // The same steps as a usual `lint:fix`: ESLint first, then Prettier. So
+    // an unchanged schema gives the same text as the committed file.
+    const fixed = await fixWithAppEslint(
+      rootDir,
+      targetPath,
+      keepInternalSupabase(stdout, existing)
+    )
+    const processed = await formatWithAppPrettier(rootDir, targetPath, fixed)
+
+    if (existing === processed) {
       return
     }
 
-    writeFileSync(targetPath, stdout, 'utf-8')
+    writeFileSync(targetPath, processed, 'utf-8')
     console.warn(`[typegen] Regenerated Supabase types at ${targetPath}`)
   } catch (error) {
     console.warn('[typegen] Failed to regenerate Supabase types:', error)