@plutocms/supabase 0.11.3 → 0.12.0

package/app/utils/access-ui.ts

@@ -0,0 +1,100 @@
+// Pure helpers of the Users and Roles pages. This file does not use Nuxt
+// auto-imports, so plain Vitest can import it.
+import type { AccessRole, AccessUser } from '../../shared/types/access'
+
+/** The role key of the administrator. It cannot be edited or removed. */
+export const ADMIN_ROLE_KEY = 'admin'
+
+/** The role key pattern of the access API. */
+export const ROLE_KEY_PATTERN = /^[a-z0-9_]+$/
+
+/** The longest role key the API accepts. */
+export const ROLE_KEY_MAX = 50
+
+/**
+ * Makes a role key from a label: lower case, a-z and 0-9, words joined by an
+ * underscore, accents removed. Returns an empty string when nothing is left.
+ */
+export function slugifyRoleKey(label: string): string {
+  return label
+    .normalize('NFD')
+    .replace(/\p{M}/gu, '')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '_')
+    .replace(/^_+|_+$/g, '')
+    .slice(0, ROLE_KEY_MAX)
+    .replace(/_+$/g, '')
+}
+
+export function isValidRoleKey(key: string): boolean {
+  return key.length > 0 && key.length <= ROLE_KEY_MAX && ROLE_KEY_PATTERN.test(key)
+}
+
+/** `invited` until the user accepts the invite, then `active`. */
+export function userStatus(user: Pick<AccessUser, 'email_confirmed_at'>): 'active' | 'invited' {
+  return user.email_confirmed_at ? 'active' : 'invited'
+}
+
+/**
+ * True when the user is an administrator. The `admin` role or the profile flag
+ * counts, the same as `public.is_admin()`.
+ */
+export function isAdminUser(user: Pick<AccessUser, 'is_admin' | 'roles'>): boolean {
+  return user.is_admin || user.roles.includes(ADMIN_ROLE_KEY)
+}
+
+/** The name to show for a user: the display name, the username, else the email. */
+export function userDisplayName(user: Pick<AccessUser, 'display_name' | 'username' | 'email'>): string {
+  return user.display_name?.trim() || user.username?.trim() || user.email?.trim() || ''
+}
+
+/** Looks a role label up by key. A key with no role stays as it is. */
+export function roleLabelOf(roles: AccessRole[], key: string): string {
+  return roles.find((role) => role.key === key)?.label ?? key
+}
+
+/** The two lists hold the same keys, in any order. */
+export function sameKeys(a: string[], b: string[]): boolean {
+  const left = [...a].toSorted()
+  const right = [...b].toSorted()
+
+  return left.length === right.length && left.every((key, index) => key === right[index])
+}
+
+/**
+ * The error `i18n` key that the server sent (`createPlutoError`), or
+ * undefined. An `ofetch` error holds the body in `data`.
+ */
+export function errorKeyOf(error: unknown): string | undefined {
+  const body = (error as { data?: { data?: { i18n?: { key?: unknown } } } } | null)?.data
+  const key = body?.data?.i18n?.key
+
+  return typeof key === 'string' ? key : undefined
+}
+
+/**
+ * The keys of the invite errors that come from the mailer. The invite modal
+ * shows the cause, and offers a link to copy or the email setup.
+ */
+export const INVITE_MAIL_ERROR_KEYS = [
+  'supabase.access.errors.emailNotAuthorized',
+  'supabase.access.errors.emailRateLimited',
+  'supabase.access.errors.emailInvalid',
+] as const
+
+export function isInviteMailError(error: unknown): boolean {
+  const key = errorKeyOf(error)
+
+  return key !== undefined && (INVITE_MAIL_ERROR_KEYS as readonly string[]).includes(key)
+}
+
+/** The name of a language in that language, for example `Português (Brasil)`. */
+export function languageName(code: string): string {
+  try {
+    const name = new Intl.DisplayNames([code], { type: 'language' }).of(code)
+
+    return name ? name.charAt(0).toLocaleUpperCase(code) + name.slice(1) : code
+  } catch {
+    return code
+  }
+}

package/app/utils/auth-driver.ts

@@ -50,6 +50,8 @@ export function mapSupabaseUser(
  * - `signup` and `forgot-password` send a signed-in user to the admin home.
  * - `confirm` and `update-password` stay open: a recovery or confirm link
  *   signs the user in, and the page must still show.
+ * - `accept-invite` stays open: an invite link signs the user in, and the page
+ *   must still show the password form.
  * - `setup` stays open for the auth guard. The setup guard
  *   (`guard` in `pluto-extension.ts`) blocks it when the setup is done.
  */
@@ -58,6 +60,7 @@ export const SUPABASE_PUBLIC_PATHS: PlutoAuthPublicPath[] = [
   { path: '/admin/forgot-password', signedIn: 'redirect' },
   { path: '/admin/confirm', signedIn: 'allow' },
   { path: '/admin/update-password', signedIn: 'allow' },
+  { path: '/admin/accept-invite', signedIn: 'allow' },
   { path: '/admin/setup', signedIn: 'allow' },
 ]
 

package/app/utils/invite-link.ts

@@ -0,0 +1,70 @@
+// Pure helper of the accept-invite page. This file does not use Nuxt
+// auto-imports, so plain Vitest can import it.
+
+/** The link types that the page can verify. */
+export type InviteOtpType = 'invite' | 'magiclink' | 'signup'
+
+const OTP_TYPES: readonly string[] = ['invite', 'magiclink', 'signup']
+
+/**
+ * What an invite link holds.
+ *
+ * - `otp`: `?token_hash=...&type=invite`. It comes from the custom invite
+ *   email template, or from the link that the admin copies or Pluto mail
+ *   sends. The type is `invite`, or `magiclink` for an account that
+ *   exists (`signup` for an account that did not confirm). The page calls
+ *   `verifyOtp` with that type.
+ * - `session`: `#access_token=...&refresh_token=...`. It comes from the
+ *   default invite email (the implicit flow). The page calls `setSession`.
+ * - `error`: `#error_code=otp_expired`. GoTrue could not accept the link.
+ * - `none`: the link holds nothing. The page then looks for a session.
+ */
+export type InviteLink =
+  | { kind: 'otp', tokenHash: string, type: InviteOtpType }
+  | { kind: 'session', accessToken: string, refreshToken: string }
+  | { kind: 'error', code: string, description?: string }
+  | { kind: 'none' }
+
+type QueryValue = string | null | undefined | Array<string | null>
+
+function first(value: QueryValue): string | undefined {
+  const item = Array.isArray(value) ? value[0] : value
+
+  return typeof item === 'string' && item !== '' ? item : undefined
+}
+
+/**
+ * Reads an invite link. `query` is the route query. `hash` is the URL hash,
+ * with or without the leading `#`. The query wins over the hash.
+ */
+export function parseInviteLink(
+  query: Record<string, QueryValue> | null | undefined,
+  hash: string | null | undefined
+): InviteLink {
+  const fragment = new URLSearchParams((hash ?? '').replace(/^#/, ''))
+  const q = query ?? {}
+
+  const tokenHash = first(q.token_hash)
+  const type = first(q.type)
+  if (tokenHash && type && OTP_TYPES.includes(type)) {
+    return { kind: 'otp', tokenHash, type: type as InviteOtpType }
+  }
+
+  const accessToken = fragment.get('access_token')
+  const refreshToken = fragment.get('refresh_token')
+  if (accessToken && refreshToken) {
+    return { kind: 'session', accessToken, refreshToken }
+  }
+
+  const code = fragment.get('error_code') ?? first(q.error_code)
+  if (code) {
+    return {
+      kind: 'error',
+      code,
+      description:
+        fragment.get('error_description') ?? first(q.error_description),
+    }
+  }
+
+  return { kind: 'none' }
+}

package/app/utils/supabase-project.ts

@@ -0,0 +1,54 @@
+// Pure helpers of the "Supabase sign-in emails" panel. This file does not use
+// Nuxt auto-imports, so plain Vitest can import it.
+
+/** The SMTP values of Resend, for the Supabase custom SMTP form. */
+export const RESEND_SMTP = {
+  host: 'smtp.resend.com',
+  port: '465',
+  username: 'resend',
+} as const
+
+/** The page where Resend connects itself to a Supabase project. */
+export const RESEND_SUPABASE_INTEGRATION_URL = 'https://resend.com/settings/integrations'
+
+/**
+ * Reads the project ref from the Supabase URL: `https://<ref>.supabase.co`
+ * (and `.supabase.red`). A custom domain, a local URL or a bad value gives
+ * null.
+ */
+export function supabaseProjectRef(url: string | null | undefined): string | null {
+  if (!url) {
+    return null
+  }
+
+  try {
+    const { hostname } = new URL(url)
+    const match = /^([a-z0-9]{10,})\.supabase\.(?:co|red)$/.exec(hostname.toLowerCase())
+
+    return match?.[1] ?? null
+  } catch {
+    return null
+  }
+}
+
+export interface SupabaseDashboardLinks {
+  project: string
+  smtp: string
+  templates: string
+  rateLimits: string
+}
+
+/**
+ * The dashboard pages of a project. The deep links are best effort: Supabase
+ * can move a page, and the panel says so.
+ */
+export function supabaseDashboardLinks(ref: string): SupabaseDashboardLinks {
+  const base = `https://supabase.com/dashboard/project/${ref}`
+
+  return {
+    project: base,
+    smtp: `${base}/auth/smtp`,
+    templates: `${base}/auth/templates`,
+    rateLimits: `${base}/auth/rate-limits`,
+  }
+}

package/db/migrations/008_users_and_roles_admin.sql

@@ -0,0 +1,462 @@
+-- Users and roles admin
+--
+-- Functions for the access API (server/api/access/**). They let an admin
+-- list staff and roles, change the roles of a user, and manage roles.
+-- This file creates no table, so it needs no table grant.
+--
+-- Rules:
+-- - Every function is security definer with an empty search_path.
+-- - Every write needs public.is_admin(). There is no users:manage
+--   capability. A user with users:read may list staff and roles.
+-- - A rule error is P0001 with the message 'pluto:<code>'. A missing right
+--   is 42501 with the message 'pluto:forbidden'.
+-- - set_user_roles and add_user_roles keep profiles.is_admin in step with
+--   the 'admin' role. So a revoke removes the first admin too, and
+--   requireAdmin (it reads the column) sees an admin that has the role only.
+--
+-- Every statement is safe to run twice.
+
+-- Staff: a user with at least one role, or with profiles.is_admin.
+create or replace function public.list_staff_users()
+returns table (
+  id uuid,
+  email text,
+  display_name text,
+  username text,
+  is_admin boolean,
+  roles text[],
+  invited_at timestamptz,
+  email_confirmed_at timestamptz,
+  last_sign_in_at timestamptz
+)
+language plpgsql
+security definer
+set search_path = ''
+stable
+as $$
+begin
+  if not public.has_capability('users:read') then
+    raise exception using errcode = '42501', message = 'pluto:forbidden';
+  end if;
+
+  return query
+  select
+    u.id,
+    u.email::text,
+    p.display_name,
+    p.username,
+    (
+      coalesce(p.is_admin, false)
+      or exists (
+        select 1 from public.user_roles a
+         where a.user_id = u.id and a.role_key = 'admin'
+      )
+    ),
+    coalesce(
+      array(
+        select ur.role_key from public.user_roles ur
+         where ur.user_id = u.id
+         order by ur.role_key
+      ),
+      '{}'::text[]
+    ),
+    u.invited_at,
+    u.email_confirmed_at,
+    u.last_sign_in_at
+  from auth.users u
+  left join public.profiles p on p.id = u.id
+  where coalesce(p.is_admin, false)
+     or exists (select 1 from public.user_roles s where s.user_id = u.id)
+  order by u.created_at;
+end;
+$$;
+
+create or replace function public.list_roles()
+returns table (
+  key text,
+  label text,
+  description text,
+  is_builtin boolean,
+  capabilities text[],
+  user_count integer
+)
+language plpgsql
+security definer
+set search_path = ''
+stable
+as $$
+begin
+  if not public.has_capability('users:read') then
+    raise exception using errcode = '42501', message = 'pluto:forbidden';
+  end if;
+
+  return query
+  select
+    r.key,
+    r.label,
+    r.description,
+    r.is_builtin,
+    coalesce(
+      array(
+        select rc.capability from public.role_capabilities rc
+         where rc.role_key = r.key
+         order by rc.capability
+      ),
+      '{}'::text[]
+    ),
+    (select count(*)::integer from public.user_roles ur where ur.role_key = r.key)
+  from public.roles r
+  order by r.is_builtin desc, r.key;
+end;
+$$;
+
+create or replace function public.find_user_id_by_email(p_email text)
+returns uuid
+language plpgsql
+security definer
+set search_path = ''
+stable
+as $$
+declare
+  found_id uuid;
+begin
+  if not public.is_admin() then
+    raise exception using errcode = '42501', message = 'pluto:forbidden';
+  end if;
+
+  select u.id into found_id
+    from auth.users u
+   where lower(u.email) = lower(trim(p_email))
+   limit 1;
+
+  return found_id;
+end;
+$$;
+
+-- Replaces the roles of a user. An empty array removes every role.
+create or replace function public.set_user_roles(target uuid, role_keys text[])
+returns void
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  keys text[];
+  target_is_admin boolean;
+begin
+  if not public.is_admin() then
+    raise exception using errcode = '42501', message = 'pluto:forbidden';
+  end if;
+
+  perform pg_advisory_xact_lock(hashtext('pluto.user_roles'));
+
+  if not exists (select 1 from auth.users u where u.id = target) then
+    raise exception using errcode = 'P0001', message = 'pluto:user_not_found';
+  end if;
+
+  select coalesce(array(select distinct k from unnest(role_keys) as k), '{}'::text[])
+    into keys;
+
+  if exists (
+    select 1 from unnest(keys) as k
+     where not exists (select 1 from public.roles r where r.key = k)
+  ) then
+    raise exception using errcode = 'P0001', message = 'pluto:unknown_role';
+  end if;
+
+  target_is_admin := coalesce(
+    (select p.is_admin from public.profiles p where p.id = target),
+    false
+  ) or exists (
+    select 1 from public.user_roles ur
+     where ur.user_id = target and ur.role_key = 'admin'
+  );
+
+  -- Do not remove the last admin.
+  if target_is_admin and not ('admin' = any(keys)) then
+    if not exists (
+      select 1 from public.profiles p
+       where p.is_admin and p.id <> target
+      union all
+      select 1 from public.user_roles ur
+       where ur.role_key = 'admin' and ur.user_id <> target
+    ) then
+      raise exception using errcode = 'P0001', message = 'pluto:last_admin';
+    end if;
+  end if;
+
+  delete from public.user_roles ur
+   where ur.user_id = target and ur.role_key <> all (keys);
+
+  insert into public.user_roles (user_id, role_key)
+  select target, k from unnest(keys) as k
+  on conflict do nothing;
+
+  update public.profiles p
+     set is_admin = ('admin' = any(keys))
+   where p.id = target;
+end;
+$$;
+
+-- Adds roles to a user. It keeps the roles that the user has.
+create or replace function public.add_user_roles(target uuid, role_keys text[])
+returns void
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  keys text[];
+begin
+  if not public.is_admin() then
+    raise exception using errcode = '42501', message = 'pluto:forbidden';
+  end if;
+
+  perform pg_advisory_xact_lock(hashtext('pluto.user_roles'));
+
+  if not exists (select 1 from auth.users u where u.id = target) then
+    raise exception using errcode = 'P0001', message = 'pluto:user_not_found';
+  end if;
+
+  select coalesce(array(select distinct k from unnest(role_keys) as k), '{}'::text[])
+    into keys;
+
+  if exists (
+    select 1 from unnest(keys) as k
+     where not exists (select 1 from public.roles r where r.key = k)
+  ) then
+    raise exception using errcode = 'P0001', message = 'pluto:unknown_role';
+  end if;
+
+  insert into public.user_roles (user_id, role_key)
+  select target, k from unnest(keys) as k
+  on conflict do nothing;
+
+  if 'admin' = any(keys) then
+    update public.profiles p set is_admin = true where p.id = target;
+  end if;
+end;
+$$;
+
+create or replace function public.create_role(
+  p_key text,
+  p_label text,
+  p_description text,
+  p_capabilities text[]
+)
+returns void
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  caps text[];
+begin
+  if not public.is_admin() then
+    raise exception using errcode = '42501', message = 'pluto:forbidden';
+  end if;
+
+  perform pg_advisory_xact_lock(hashtext('pluto.user_roles'));
+
+  if p_key is null or p_key !~ '^[a-z0-9_]+$' then
+    raise exception using errcode = 'P0001', message = 'pluto:invalid_key';
+  end if;
+
+  if p_label is null or trim(p_label) = '' then
+    raise exception using errcode = 'P0001', message = 'pluto:invalid_label';
+  end if;
+
+  select coalesce(array(select distinct c from unnest(p_capabilities) as c), '{}'::text[])
+    into caps;
+
+  if '*' = any(caps) then
+    raise exception using errcode = 'P0001', message = 'pluto:wildcard';
+  end if;
+
+  if cardinality(caps) = 0 then
+    raise exception using errcode = 'P0001', message = 'pluto:empty_role';
+  end if;
+
+  if exists (
+    select 1 from unnest(caps) as c where c !~ '^[a-z0-9_]+:[a-z0-9_]+$'
+  ) then
+    raise exception using errcode = 'P0001', message = 'pluto:invalid_capability';
+  end if;
+
+  if exists (select 1 from public.roles r where r.key = p_key) then
+    raise exception using errcode = 'P0001', message = 'pluto:role_exists';
+  end if;
+
+  insert into public.roles (key, label, description, is_builtin)
+  values (p_key, trim(p_label), nullif(trim(coalesce(p_description, '')), ''), false);
+
+  insert into public.role_capabilities (role_key, capability)
+  select p_key, c from unnest(caps) as c;
+end;
+$$;
+
+-- Edits a role and replaces its capabilities in one transaction.
+create or replace function public.update_role(
+  p_key text,
+  p_label text,
+  p_description text,
+  p_capabilities text[]
+)
+returns void
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  caps text[];
+begin
+  if not public.is_admin() then
+    raise exception using errcode = '42501', message = 'pluto:forbidden';
+  end if;
+
+  perform pg_advisory_xact_lock(hashtext('pluto.user_roles'));
+
+  if p_key = 'admin' then
+    raise exception using errcode = 'P0001', message = 'pluto:builtin_role';
+  end if;
+
+  if not exists (select 1 from public.roles r where r.key = p_key) then
+    raise exception using errcode = 'P0001', message = 'pluto:role_not_found';
+  end if;
+
+  if p_label is null or trim(p_label) = '' then
+    raise exception using errcode = 'P0001', message = 'pluto:invalid_label';
+  end if;
+
+  select coalesce(array(select distinct c from unnest(p_capabilities) as c), '{}'::text[])
+    into caps;
+
+  if '*' = any(caps) then
+    raise exception using errcode = 'P0001', message = 'pluto:wildcard';
+  end if;
+
+  if cardinality(caps) = 0 then
+    raise exception using errcode = 'P0001', message = 'pluto:empty_role';
+  end if;
+
+  if exists (
+    select 1 from unnest(caps) as c where c !~ '^[a-z0-9_]+:[a-z0-9_]+$'
+  ) then
+    raise exception using errcode = 'P0001', message = 'pluto:invalid_capability';
+  end if;
+
+  update public.roles r
+     set label = trim(p_label),
+         description = nullif(trim(coalesce(p_description, '')), '')
+   where r.key = p_key;
+
+  delete from public.role_capabilities rc where rc.role_key = p_key;
+
+  insert into public.role_capabilities (role_key, capability)
+  select p_key, c from unnest(caps) as c;
+end;
+$$;
+
+-- Deletes a role. It returns the number of users who lost the role.
+create or replace function public.delete_role(p_key text)
+returns integer
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  builtin boolean;
+  affected integer;
+begin
+  if not public.is_admin() then
+    raise exception using errcode = '42501', message = 'pluto:forbidden';
+  end if;
+
+  perform pg_advisory_xact_lock(hashtext('pluto.user_roles'));
+
+  select r.is_builtin into builtin from public.roles r where r.key = p_key;
+
+  if builtin is null then
+    raise exception using errcode = 'P0001', message = 'pluto:role_not_found';
+  end if;
+
+  if builtin or p_key = 'admin' then
+    raise exception using errcode = 'P0001', message = 'pluto:builtin_role';
+  end if;
+
+  select count(*)::integer into affected
+    from public.user_roles ur where ur.role_key = p_key;
+
+  -- The cascade removes the user_roles and role_capabilities rows.
+  delete from public.roles r where r.key = p_key;
+
+  return affected;
+end;
+$$;
+
+-- Execute rights. Only a signed-in user and the service role may call them.
+-- Each function checks the right of the caller inside.
+revoke execute on function public.list_staff_users() from public, anon;
+grant execute on function public.list_staff_users() to authenticated, service_role;
+
+revoke execute on function public.list_roles() from public, anon;
+grant execute on function public.list_roles() to authenticated, service_role;
+
+revoke execute on function public.find_user_id_by_email(text) from public, anon;
+grant execute on function public.find_user_id_by_email(text) to authenticated, service_role;
+
+revoke execute on function public.set_user_roles(uuid, text[]) from public, anon;
+grant execute on function public.set_user_roles(uuid, text[]) to authenticated, service_role;
+
+revoke execute on function public.add_user_roles(uuid, text[]) from public, anon;
+grant execute on function public.add_user_roles(uuid, text[]) to authenticated, service_role;
+
+revoke execute on function public.create_role(text, text, text, text[]) from public, anon;
+grant execute on function public.create_role(text, text, text, text[]) to authenticated, service_role;
+
+revoke execute on function public.update_role(text, text, text, text[]) from public, anon;
+grant execute on function public.update_role(text, text, text, text[]) to authenticated, service_role;
+
+revoke execute on function public.delete_role(text) from public, anon;
+grant execute on function public.delete_role(text) to authenticated, service_role;
+
+-- Policy tweaks. The functions above are the way to edit roles. These
+-- policies stop a direct write through the Data API from breaking the
+-- rules: the built-in roles stay, 'admin' keeps its wildcard, and no other
+-- role gets the wildcard.
+drop policy if exists "Enable delete for admins on roles" on public.roles;
+
+create policy "Enable delete for admins on roles"
+on public.roles
+for delete
+to authenticated
+using (public.is_admin() and not is_builtin);
+
+drop policy if exists "Enable insert for admins on role_capabilities" on public.role_capabilities;
+
+create policy "Enable insert for admins on role_capabilities"
+on public.role_capabilities
+for insert
+to authenticated
+with check (
+  public.is_admin() and role_key <> 'admin' and capability <> '*'
+);
+
+drop policy if exists "Enable update for admins on role_capabilities" on public.role_capabilities;
+
+create policy "Enable update for admins on role_capabilities"
+on public.role_capabilities
+for update
+to authenticated
+using (public.is_admin() and role_key <> 'admin')
+with check (
+  public.is_admin() and role_key <> 'admin' and capability <> '*'
+);
+
+drop policy if exists "Enable delete for admins on role_capabilities" on public.role_capabilities;
+
+create policy "Enable delete for admins on role_capabilities"
+on public.role_capabilities
+for delete
+to authenticated
+using (public.is_admin() and role_key <> 'admin');