@plutocms/supabase 0.14.1 → 0.15.1

package/app/plugins/pluto-extension.ts

@@ -52,9 +52,7 @@ export default defineNuxtPlugin(() => {
   async function fetchSetupState(): Promise<SetupState> {
     let state: SetupState = 'unknown'
     try {
-      state = setupStateFromResponse(
-        await $fetch('/api/_pluto/supabase/setup')
-      )
+      state = setupStateFromResponse(await $fetch('/api/_pluto/supabase/setup'))
     } catch (error) {
       if (import.meta.dev) {
         console.error('Error checking first setup status:', error)
@@ -220,8 +218,16 @@ export default defineNuxtPlugin(() => {
     // gated by requireAdmin (public.is_admin() directly), never a named
     // capability — see server/utils/admin-guard.ts for why.
     capabilities: [
-      { id: 'settings-manage', key: 'settings:manage', label: 'supabase.capabilities.settingsManage' },
-      { id: 'users-read', key: 'users:read', label: 'supabase.capabilities.usersRead' },
+      {
+        id: 'settings-manage',
+        key: 'settings:manage',
+        label: 'supabase.capabilities.settingsManage',
+      },
+      {
+        id: 'users-read',
+        key: 'users:read',
+        label: 'supabase.capabilities.usersRead',
+      },
     ],
     // The admin language of the signed-in user, stored in profiles.locale
     // (005_profile_locale.sql). A save error carries the translated server
@@ -229,12 +235,17 @@ export default defineNuxtPlugin(() => {
     localeDriver: {
       id: 'supabase',
       load: async () => {
-        const response = await $fetch<{ locale: string | null }>('/api/_pluto/supabase/me/locale')
+        const response = await $fetch<{ locale: string | null }>(
+          '/api/_pluto/supabase/me/locale'
+        )
         return response.locale
       },
       save: async (locale) => {
         try {
-          await $fetch('/api/_pluto/supabase/me/locale', { method: 'PUT', body: { locale } })
+          await $fetch('/api/_pluto/supabase/me/locale', {
+            method: 'PUT',
+            body: { locale },
+          })
         } catch (error) {
           throw new Error(errorText(error))
         }
@@ -243,7 +254,9 @@ export default defineNuxtPlugin(() => {
     permissionsDriver: {
       id: 'supabase',
       load: async () => {
-        const response = await $fetch<{ capabilities: string[] }>('/api/_pluto/supabase/me/capabilities')
+        const response = await $fetch<{ capabilities: string[] }>(
+          '/api/_pluto/supabase/me/capabilities'
+        )
         return response.capabilities
       },
     },

package/app/utils/access-ui.ts

@@ -27,11 +27,15 @@ export function slugifyRoleKey(label: string): string {
 }
 
 export function isValidRoleKey(key: string): boolean {
-  return key.length > 0 && key.length <= ROLE_KEY_MAX && ROLE_KEY_PATTERN.test(key)
+  return (
+    key.length > 0 && key.length <= ROLE_KEY_MAX && ROLE_KEY_PATTERN.test(key)
+  )
 }
 
 /** `invited` until the user accepts the invite, then `active`. */
-export function userStatus(user: Pick<AccessUser, 'email_confirmed_at'>): 'active' | 'invited' {
+export function userStatus(
+  user: Pick<AccessUser, 'email_confirmed_at'>
+): 'active' | 'invited' {
   return user.email_confirmed_at ? 'active' : 'invited'
 }
 
@@ -39,13 +43,22 @@ export function userStatus(user: Pick<AccessUser, 'email_confirmed_at'>): 'activ
  * True when the user is an administrator. The `admin` role or the profile flag
  * counts, the same as `public.is_admin()`.
  */
-export function isAdminUser(user: Pick<AccessUser, 'is_admin' | 'roles'>): boolean {
+export function isAdminUser(
+  user: Pick<AccessUser, 'is_admin' | 'roles'>
+): boolean {
   return user.is_admin || user.roles.includes(ADMIN_ROLE_KEY)
 }
 
 /** The name to show for a user: the display name, the username, else the email. */
-export function userDisplayName(user: Pick<AccessUser, 'display_name' | 'username' | 'email'>): string {
-  return user.display_name?.trim() || user.username?.trim() || user.email?.trim() || ''
+export function userDisplayName(
+  user: Pick<AccessUser, 'display_name' | 'username' | 'email'>
+): string {
+  return (
+    user.display_name?.trim() ||
+    user.username?.trim() ||
+    user.email?.trim() ||
+    ''
+  )
 }
 
 /** Looks a role label up by key. A key with no role stays as it is. */
@@ -58,7 +71,10 @@ export function sameKeys(a: string[], b: string[]): boolean {
   const left = [...a].toSorted()
   const right = [...b].toSorted()
 
-  return left.length === right.length && left.every((key, index) => key === right[index])
+  return (
+    left.length === right.length &&
+    left.every((key, index) => key === right[index])
+  )
 }
 
 /**
@@ -66,7 +82,9 @@ export function sameKeys(a: string[], b: string[]): boolean {
  * undefined. An `ofetch` error holds the body in `data`.
  */
 export function errorKeyOf(error: unknown): string | undefined {
-  const body = (error as { data?: { data?: { i18n?: { key?: unknown } } } } | null)?.data
+  const body = (
+    error as { data?: { data?: { i18n?: { key?: unknown } } } } | null
+  )?.data
   const key = body?.data?.i18n?.key
 
   return typeof key === 'string' ? key : undefined
@@ -85,7 +103,10 @@ export const INVITE_MAIL_ERROR_KEYS = [
 export function isInviteMailError(error: unknown): boolean {
   const key = errorKeyOf(error)
 
-  return key !== undefined && (INVITE_MAIL_ERROR_KEYS as readonly string[]).includes(key)
+  return (
+    key !== undefined &&
+    (INVITE_MAIL_ERROR_KEYS as readonly string[]).includes(key)
+  )
 }
 
 /** The name of a language in that language, for example `Português (Brasil)`. */

package/app/utils/api-failure.ts

@@ -6,7 +6,9 @@
  * error holds the whole response body in `data`, so the extra data sits in
  * `data.data`. Returns `undefined` when the error has none.
  */
-export function failureData(error: unknown): Record<string, unknown> | undefined {
+export function failureData(
+  error: unknown
+): Record<string, unknown> | undefined {
   const body = (error as { data?: unknown } | null | undefined)?.data
   const data = (body as { data?: unknown } | null | undefined)?.data
 

package/app/utils/auth-driver.ts

@@ -76,9 +76,7 @@ export type SetupState = 'pending' | 'done' | 'unknown'
  */
 export function setupStateFromResponse(data: unknown): SetupState {
   const response = data as
-    | { success?: boolean, is_first_setup?: boolean }
-    | null
-    | undefined
+    { success?: boolean; is_first_setup?: boolean } | null | undefined
 
   if (!response?.success) {
     return 'unknown'

package/app/utils/auth-error.ts

@@ -37,7 +37,7 @@ export function authErrorKey(error: unknown): string | undefined {
  */
 export function resolveAuthErrorText(
   error: unknown,
-  i18n: { t: (key: string) => string, te: (key: string) => boolean }
+  i18n: { t: (key: string) => string; te: (key: string) => boolean }
 ): string {
   const key = authErrorKey(error)
 

package/app/utils/invite-link.ts

@@ -20,9 +20,9 @@ const OTP_TYPES: readonly string[] = ['invite', 'magiclink', 'signup']
  * - `none`: the link holds nothing. The page then looks for a session.
  */
 export type InviteLink =
-  | { kind: 'otp', tokenHash: string, type: InviteOtpType }
-  | { kind: 'session', accessToken: string, refreshToken: string }
-  | { kind: 'error', code: string, description?: string }
+  | { kind: 'otp'; tokenHash: string; type: InviteOtpType }
+  | { kind: 'session'; accessToken: string; refreshToken: string }
+  | { kind: 'error'; code: string; description?: string }
   | { kind: 'none' }
 
 type QueryValue = string | null | undefined | Array<string | null>

package/app/utils/supabase-project.ts

@@ -9,21 +9,26 @@ export const RESEND_SMTP = {
 } as const
 
 /** The page where Resend connects itself to a Supabase project. */
-export const RESEND_SUPABASE_INTEGRATION_URL = 'https://resend.com/settings/integrations'
+export const RESEND_SUPABASE_INTEGRATION_URL =
+  'https://resend.com/settings/integrations'
 
 /**
  * Reads the project ref from the Supabase URL: `https://<ref>.supabase.co`
  * (and `.supabase.red`). A custom domain, a local URL or a bad value gives
  * null.
  */
-export function supabaseProjectRef(url: string | null | undefined): string | null {
+export function supabaseProjectRef(
+  url: string | null | undefined
+): string | null {
   if (!url) {
     return null
   }
 
   try {
     const { hostname } = new URL(url)
-    const match = /^([a-z0-9]{10,})\.supabase\.(?:co|red)$/.exec(hostname.toLowerCase())
+    const match = /^([a-z0-9]{10,})\.supabase\.(?:co|red)$/.exec(
+      hostname.toLowerCase()
+    )
 
     return match?.[1] ?? null
   } catch {

package/modules/pluto-migrations.ts

@@ -1,10 +1,15 @@
 import type { PlutoMigrationFile } from '../shared/types/migrations'
 import { createHash } from 'node:crypto'
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
+import {
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  writeFileSync,
+} from 'node:fs'
 import { basename, dirname, join, relative } from 'node:path'
 import { createResolver, defineNuxtModule, getLayerDirectories } from 'nuxt/kit'
 
-const schemaPattern = /^schema\.(.+)\.sql$/
 const noTransactionPattern = /^--\s*pluto:no-transaction\b/
 
 /**
@@ -50,7 +55,10 @@ function deriveLayerKey(layerRoot: string): string {
 }
 
 function computeChecksum(content: string): string {
-  return createHash('sha256').update(content, 'utf-8').digest('hex').slice(0, 16)
+  return createHash('sha256')
+    .update(content, 'utf-8')
+    .digest('hex')
+    .slice(0, 16)
 }
 
 /**
@@ -63,11 +71,13 @@ function detectNoTransaction(content: string): boolean {
     .map((line) => line.trim())
     .find((line) => line.length > 0)
 
-  return firstNonBlankLine ? noTransactionPattern.test(firstNonBlankLine) : false
+  return firstNonBlankLine
+    ? noTransactionPattern.test(firstNonBlankLine)
+    : false
 }
 
-function readMigrationFile(dir: string, fileName: string, name: string): PlutoMigrationFile {
-  const content = readFileSync(join(dir, fileName), 'utf-8')
+function readMigrationFile(dir: string, name: string): PlutoMigrationFile {
+  const content = readFileSync(join(dir, name), 'utf-8')
 
   return {
     name,
@@ -78,10 +88,9 @@ function readMigrationFile(dir: string, fileName: string, name: string): PlutoMi
 }
 
 /**
- * Discovers `db/migrations/*.sql` (or, for a layer not yet converted, the
- * legacy `public/schema.sql` / `public/schema.[name].sql`) across all Nuxt
- * layers, reads their content at build time, and populates runtimeConfig
- * so the migrations engine can apply them at server startup.
+ * Discovers `db/migrations/*.sql` across all Nuxt layers, reads their
+ * content at build time, and populates runtimeConfig so the migrations
+ * engine can apply them at server startup.
  *
  * Also seeds the consuming app's shared/types/supabase.ts with a
  * re-export of this layer's own committed snapshot when the consumer
@@ -153,81 +162,36 @@ export default defineNuxtModule({
     for (const layer of layerDirs) {
       const migrationsDir = join(layer.root, 'db/migrations')
 
-      if (existsSync(migrationsDir)) {
-        let fileNames: string[] = []
-        try {
-          fileNames = readdirSync(migrationsDir).filter((file) =>
-            file.endsWith('.sql')
-          )
-        } catch {
-          console.error(
-            `[pluto-migrations] Failed to read migrations directory: ${migrationsDir}`
-          )
-          continue
-        }
-
-        fileNames.sort(compareFileNames)
-
-        const files: PlutoMigrationFile[] = []
-        for (const fileName of fileNames) {
-          try {
-            files.push(readMigrationFile(migrationsDir, fileName, fileName))
-          } catch {
-            console.error(
-              `[pluto-migrations] Failed to read migration file: ${fileName}`
-            )
-          }
-        }
-
-        assignLayer(deriveLayerKey(layer.root), files)
-        continue
-      }
-
-      // Legacy fallback for a layer not yet converted to db/migrations/,
-      // exactly as before: a single public/schema.sql (always key `core`)
-      // and/or public/schema.[name].sql (key comes from the file name, not
-      // package.json — this keeps working for an unconverted layer without
-      // requiring it to match its package name).
-      const publicDir = join(layer.root, 'public')
-
-      if (!existsSync(publicDir)) {
+      if (!existsSync(migrationsDir)) {
         continue
       }
 
-      let publicFiles: string[] = []
+      let fileNames: string[] = []
       try {
-        publicFiles = readdirSync(publicDir)
+        fileNames = readdirSync(migrationsDir).filter((file) =>
+          file.endsWith('.sql')
+        )
       } catch {
+        console.error(
+          `[pluto-migrations] Failed to read migrations directory: ${migrationsDir}`
+        )
         continue
       }
 
-      for (const fileName of publicFiles) {
-        if (fileName === 'schema.sql') {
-          try {
-            assignLayer('core', [
-              readMigrationFile(publicDir, fileName, '001_baseline.sql'),
-            ])
-          } catch {
-            console.error(
-              `[pluto-migrations] Failed to read schema file: ${fileName}`
-            )
-          }
-          continue
-        }
+      fileNames.sort(compareFileNames)
 
-        const match = fileName.match(schemaPattern)
-        if (match?.[1]) {
-          try {
-            assignLayer(match[1], [
-              readMigrationFile(publicDir, fileName, '001_baseline.sql'),
-            ])
-          } catch {
-            console.error(
-              `[pluto-migrations] Failed to read schema file: ${fileName}`
-            )
-          }
+      const files: PlutoMigrationFile[] = []
+      for (const fileName of fileNames) {
+        try {
+          files.push(readMigrationFile(migrationsDir, fileName))
+        } catch {
+          console.error(
+            `[pluto-migrations] Failed to read migration file: ${fileName}`
+          )
         }
       }
+
+      assignLayer(deriveLayerKey(layer.root), files)
     }
 
     // Populate runtimeConfig with every layer's ordered migration files.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@plutocms/supabase",
   "type": "module",
-  "version": "0.14.1",
+  "version": "0.15.1",
   "trustedDependencies": [
     "@parcel/watcher",
     "@plutocms/pluto",
@@ -39,8 +39,8 @@
     "@nuxt/eslint": "^1.17.0",
     "@nuxt/ui": "^4.12.0",
     "@nuxtjs/supabase": "^2.1.0",
-    "@plutocms/pluto": "^0.28.0",
-    "@plutocms/utils": "^0.2.1",
+    "@plutocms/pluto": "^0.30.0",
+    "@plutocms/utils": "^0.3.0",
     "@supabase/supabase-js": "^2.117.3",
     "postgres": "^3.4.9",
     "supabase": "^2.121.0",
@@ -51,6 +51,8 @@
     "@types/bun": "^1.4.3",
     "@vueuse/nuxt": "^14.4.0",
     "eslint": "^10.12.0",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-better-tailwindcss": "^4.10.0",
     "nuxt": "^4.6.1",
     "prettier": "^3.9.10",
     "tailwindcss": "^4.3.3",

package/server/api/_pluto/supabase/access/users/[id]/resend.post.ts

@@ -1,6 +1,11 @@
 import { serverSupabaseClient } from '#supabase/server'
 import { mapAccessError } from '../../../../../../utils/access-errors'
-import { inviteRedirectUrl, isEmailExistsError, requireUserId, resendBodySchema } from '../../../../../../utils/access-invite'
+import {
+  inviteRedirectUrl,
+  isEmailExistsError,
+  requireUserId,
+  resendBodySchema,
+} from '../../../../../../utils/access-invite'
 import {
   assertInviteLocale,
   generateAcceptLink,
@@ -122,7 +127,9 @@ export default defineEventHandler(async (event) => {
     }
 
     const { data: staff } = await client.rpc('list_staff_users')
-    const roleKeys = Array.isArray(staff) ? (staff.find((row) => row.id === id)?.roles ?? []) : []
+    const roleKeys = Array.isArray(staff)
+      ? (staff.find((row) => row.id === id)?.roles ?? [])
+      : []
     const sent = await sendInviteMail({
       client,
       to: email,
@@ -138,9 +145,12 @@ export default defineEventHandler(async (event) => {
       : { status: 'sent' as const, emailSent: false, link: made.link }
   }
 
-  const { error: inviteError } = await service.auth.admin.inviteUserByEmail(email, {
-    redirectTo,
-  })
+  const { error: inviteError } = await service.auth.admin.inviteUserByEmail(
+    email,
+    {
+      redirectTo,
+    }
+  )
 
   if (inviteError) {
     if (isEmailExistsError(inviteError)) {

package/server/api/_pluto/supabase/access/users/[id]/roles.put.ts

@@ -1,6 +1,9 @@
 import { serverSupabaseClient } from '#supabase/server'
 import { mapAccessError } from '../../../../../../utils/access-errors'
-import { requireUserId, rolesBodySchema } from '../../../../../../utils/access-invite'
+import {
+  requireUserId,
+  rolesBodySchema,
+} from '../../../../../../utils/access-invite'
 import { requireAdminRole } from '../../../../../../utils/admin-role-guard'
 import { parseBody } from '../../../../../../utils/validate'
 

package/server/api/_pluto/supabase/access/users/invite-link.post.ts

@@ -1,6 +1,12 @@
 import { serverSupabaseClient } from '#supabase/server'
-import { inviteBodySchema, inviteRedirectUrl } from '../../../../../utils/access-invite'
-import { provisionAccess, serviceKeyRequiredError } from '../../../../../utils/access-mail'
+import {
+  inviteBodySchema,
+  inviteRedirectUrl,
+} from '../../../../../utils/access-invite'
+import {
+  provisionAccess,
+  serviceKeyRequiredError,
+} from '../../../../../utils/access-mail'
 import { requireAdminRole } from '../../../../../utils/admin-role-guard'
 import { enforceInviteRateLimit } from '../../../../../utils/rate-limit'
 import { optionalServiceClient } from '../../../../../utils/service-client'
@@ -24,7 +30,10 @@ export default defineEventHandler(async (event) => {
 
   enforceInviteRateLimit(caller.sub)
 
-  const { email, roleKeys, displayName } = await parseBody(event, inviteBodySchema)
+  const { email, roleKeys, displayName } = await parseBody(
+    event,
+    inviteBodySchema
+  )
   const service = optionalServiceClient(event)
 
   if (!service) {

package/server/api/_pluto/supabase/access/users/invite.post.ts

@@ -54,7 +54,10 @@ export default defineEventHandler(async (event) => {
 
   enforceInviteRateLimit(caller.sub)
 
-  const { email, roleKeys, displayName, locale } = await parseBody(event, inviteBodySchema)
+  const { email, roleKeys, displayName, locale } = await parseBody(
+    event,
+    inviteBodySchema
+  )
 
   assertInviteLocale(event, locale)
 
@@ -120,7 +123,9 @@ export default defineEventHandler(async (event) => {
     const linkedId = await findUserIdByEmail(client, email)
 
     if (!linkedId) {
-      console.error('invite: the sign-in link was sent, but no account has this email')
+      console.error(
+        'invite: the sign-in link was sent, but no account has this email'
+      )
 
       throw createPlutoError({
         statusCode: 502,

package/server/api/_pluto/supabase/auth/signup.post.ts

@@ -7,7 +7,11 @@ import { parseBody } from '../../../../utils/validate'
 // into the same clean 400 shape as every other validation failure, instead
 // of a raw auth-service error reaching the caller.
 const signupSchema = z.object({
-  username: z.string().trim().min(3, 'Username must be at least 3 characters.').max(100),
+  username: z
+    .string()
+    .trim()
+    .min(3, 'Username must be at least 3 characters.')
+    .max(100),
   display_name: z.string().trim().min(1, 'Display name is required.').max(200),
   email: z.string().trim().email('Email must be a valid email address.'),
   password: z.string().min(6, 'Password must be at least 6 characters.'),

package/server/api/_pluto/supabase/me/capabilities.get.ts

@@ -26,7 +26,10 @@ export default defineEventHandler(async (event) => {
     // Without the fallback, the admin guard would see an admin with no
     // capability and keep them out of /admin/migrations, the one page that
     // can apply the missing migration.
-    console.error('my_capabilities() failed, falling back to profiles.is_admin:', error.message)
+    console.error(
+      'my_capabilities() failed, falling back to profiles.is_admin:',
+      error.message
+    )
 
     const { data: profile } = await client
       .from('profiles')

package/server/api/_pluto/supabase/migrations/run.post.ts

@@ -3,7 +3,10 @@ import type { MigrationFileResult } from '../../../../utils/migrations'
 import { z } from 'zod'
 import { requireAdmin } from '../../../../utils/admin-guard'
 import { persistDatabaseUrl } from '../../../../utils/env-file'
-import { resolveConnectionString, runPendingMigrations } from '../../../../utils/migrations'
+import {
+  resolveConnectionString,
+  runPendingMigrations,
+} from '../../../../utils/migrations'
 import { scrubConnectionString } from '../../../../utils/scrub-connection-string'
 import { regenerateSupabaseTypes } from '../../../../utils/typegen'
 import { parseBody } from '../../../../utils/validate'
@@ -12,7 +15,11 @@ import { parseBody } from '../../../../utils/validate'
 // caller need not (and, per resolveConnectionString, cannot) supply one.
 const runMigrationsSchema = z
   .object({
-    connectionString: z.string().trim().min(1, 'Connection string must not be empty.').optional(),
+    connectionString: z
+      .string()
+      .trim()
+      .min(1, 'Connection string must not be empty.')
+      .optional(),
   })
   .optional()
 

package/server/api/_pluto/supabase/setup/index.post.ts

@@ -11,7 +11,10 @@ import { parseBody } from '../../../../utils/validate'
 // DSN, and so on), so this route's real security model is the
 // DATABASE_URL precedence check above, not a stricter format check here.
 const setupSchema = z.object({
-  connectionString: z.string().trim().min(1, 'Connection string must not be empty.'),
+  connectionString: z
+    .string()
+    .trim()
+    .min(1, 'Connection string must not be empty.'),
 })
 
 export default defineEventHandler(async (event) => {

package/server/utils/access-errors.ts

@@ -136,7 +136,8 @@ export function mapAccessError(error: PgErrorLike) {
   if (isMissingAccessFunction(error)) {
     return createPlutoError({
       statusCode: 409,
-      message: 'Apply the pending database migrations to manage users and roles.',
+      message:
+        'Apply the pending database migrations to manage users and roles.',
       key: 'supabase.access.errors.migrationPending',
     })
   }

package/server/utils/access-invite.ts

@@ -45,7 +45,7 @@ export function inviteRedirectUrl(origin: string): string {
 
 /** True when GoTrue says that an account with this email already exists. */
 export function isEmailExistsError(
-  error: { code?: string, status?: number } | null | undefined
+  error: { code?: string; status?: number } | null | undefined
 ): boolean {
   return error?.code === 'email_exists' || error?.code === 'user_already_exists'
 }