@plutocms/supabase 0.2.2 → 0.4.0

package/app/pages/admin/setup.vue

@@ -17,6 +17,8 @@ const projectId = config.public.supabase.url
 
 const toast = useToast()
 
+const isDev = import.meta.dev
+
 const items = ref<StepperItem[]>([
   {
     title: 'Database Setup',
@@ -40,6 +42,12 @@ const databaseForm = ref({
   password: '',
 })
 
+// Set only when the server reports it could not write DATABASE_URL to
+// .env — see EnvPersistWarning.vue. Holds the connection string this page
+// already sent once; never re-sent, only shown back on this same page.
+const envNotPersisted = ref(false)
+const submittedConnectionString = ref('')
+
 const currentLoading = computed(() => {
   if (currentStep.value === 0) {
     return isSettingUpDatabase.value
@@ -64,18 +72,55 @@ const currentStepSubmitLabel = computed(() => {
   return 'Submit'
 })
 
+/**
+ * Polls /api/settings/first_setup until the dev server responds again, and
+ * advances the stepper once it does.
+ *
+ * Used only to wait out the restart described in the `catch` block of
+ * `completeDatabaseSetup` — the server is expected to come back within a
+ * few seconds, not to be actually down.
+ */
+async function waitForServerAndAdvance(): Promise<boolean> {
+  const maxAttempts = 15
+  const delayMs = 2000
+
+  for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+    await new Promise((resolve) => setTimeout(resolve, delayMs))
+
+    try {
+      await $fetch('/api/settings/first_setup')
+
+      toast.add({
+        title: 'Reconnected',
+        description: 'The server is back. Your database has been set up.',
+        icon: 'lucide:check-circle',
+        color: 'success',
+      })
+
+      stepper.value?.next()
+
+      return true
+    } catch {
+      // Still restarting — try again.
+    }
+  }
+
+  return false
+}
+
 async function completeDatabaseSetup() {
   try {
     isSettingUpDatabase.value = true
 
+    const connectionString = databaseForm.value.connectionString.replace(
+      '[YOUR-PASSWORD]',
+      encodeURIComponent(databaseForm.value.password)
+    )
+
     const data = await $fetch<any>('/api/setup/create', {
       method: 'POST',
       body: {
-        baseUrl: window.location.origin,
-        connectionString: databaseForm.value.connectionString.replace(
-          '[YOUR-PASSWORD]',
-          encodeURIComponent(databaseForm.value.password)
-        ),
+        connectionString,
       },
     })
 
@@ -90,6 +135,11 @@ async function completeDatabaseSetup() {
       return
     }
 
+    if (data.persisted === false) {
+      envNotPersisted.value = true
+      submittedConnectionString.value = connectionString
+    }
+
     toast.add({
       title: 'Database setup complete',
       description: 'Your database has been set up successfully.',
@@ -99,6 +149,44 @@ async function completeDatabaseSetup() {
 
     stepper.value?.next()
   } catch (error) {
+    // Writing DATABASE_URL to .env (the last step of /api/setup/create,
+    // after the schema and every layer migration already succeeded)
+    // restarts the dev server. The response can be cut off by that
+    // restart even though the setup itself worked. A dropped connection
+    // has no HTTP status code — a real error response would — so use
+    // that, and only in dev, to tell "still finishing" apart from a real
+    // failure. See the matching comment in app/pages/admin/migrations.vue.
+    const hasStatusCode =
+      typeof error === 'object' &&
+      error !== null &&
+      'statusCode' in error &&
+      (error as { statusCode?: unknown }).statusCode !== undefined
+
+    if (import.meta.dev && !hasStatusCode) {
+      toast.add({
+        title: 'Dev server restarting',
+        description: 'Setup is finishing. Reconnecting…',
+        icon: 'lucide:refresh-cw',
+        color: 'info',
+      })
+
+      const recovered = await waitForServerAndAdvance()
+
+      if (recovered) {
+        return
+      }
+
+      toast.add({
+        title: 'Still reconnecting',
+        description:
+          'The dev server is taking longer than expected. Reload this page in a moment.',
+        icon: 'lucide:triangle-alert',
+        color: 'warning',
+      })
+
+      return
+    }
+
     if (import.meta.dev) {
       console.error('Error setting up the database:', error)
     }
@@ -234,11 +322,11 @@ function handleStepChange(step: number) {
                                 Supabase database and run the SQL queries from
                                 this
                                 <ULink
-                                  to="https://github.com/plutocms/supabase/blob/feat/setup-wizard/public/schema.sql"
+                                  to="https://github.com/plutocms/supabase/tree/main/db/migrations"
                                   target="_blank"
                                   class="underline"
                                 >
-                                  SQL file</ULink
+                                  SQL files</ULink
                                 >.
                               </p>
 
@@ -253,6 +341,15 @@ function handleStepChange(step: number) {
                     </div>
                   </template>
                 </UAlert>
+
+                <UAlert
+                  v-if="isDev"
+                  color="info"
+                  variant="outline"
+                  title="This restarts the dev server"
+                  icon="lucide:refresh-cw"
+                  description="Saving your connection string writes it to .env. In development, that restarts the server automatically. The page will briefly show a reconnecting message — this is expected, not an error."
+                />
               </UForm>
             </section>
 
@@ -269,6 +366,11 @@ function handleStepChange(step: number) {
                   up.
                 </p>
 
+                <EnvPersistWarning
+                  v-if="envNotPersisted"
+                  :connection-string="submittedConnectionString"
+                />
+
                 <p class="text-center">
                   <UButton
                     icon="lucide:arrow-right"

package/app/pages/admin.vue

@@ -32,6 +32,19 @@ watch(visibility, async (current, previous) => {
 
 <template>
   <div class="light:text-zinc-800 h-full dark:text-white">
+    <ClientOnly>
+      <Container
+        v-if="
+          isLoggedIn
+            && !route.path.startsWith('/admin/setup')
+            && !route.path.startsWith('/admin/migrations')
+        "
+        class="pt-4"
+      >
+        <MigrationsBanner />
+      </Container>
+    </ClientOnly>
+
     <NuxtPage />
   </div>
 </template>

package/db/migrations/002_admin_hardening.sql

@@ -0,0 +1,107 @@
+-- Admin hardening
+--
+-- Gates the writes that were previously open to any authenticated user
+-- behind a real admin check, and closes a client-controlled admin
+-- self-grant on signup. Standalone and self-sufficient: it does not
+-- depend on running as a diff against 001_baseline.sql, only on that
+-- file's tables (public.profiles, public.settings, public.healthcheck)
+-- already existing.
+
+-- Returns true when the calling user's own profile has is_admin = true.
+-- SECURITY DEFINER so this lookup runs with the function owner's
+-- privileges rather than the caller's — RLS policies call this to decide
+-- whether to grant a *wider* read/write than a user's own row would
+-- otherwise get, so the check itself must not be subject to those same
+-- policies.
+create or replace function public.is_admin()
+returns boolean
+language sql
+security definer
+set search_path = ''
+stable
+as $$
+  select coalesce(
+    (select is_admin from public.profiles where id = auth.uid()),
+    false
+  );
+$$;
+
+-- A user can always read their own profile; only admins can read
+-- everyone's. Previously any authenticated user could read every row
+-- (including every user's email) — this was the actual reason `is_admin`
+-- existed on the table but no policy referenced it.
+drop policy if exists "Enable read access for authenticated users" on public.profiles;
+
+create policy "Enable read access for authenticated users"
+on public.profiles
+for select
+to authenticated, dashboard_user
+using (auth.uid() = id or public.is_admin());
+
+-- Previously any authenticated user (not just an admin) could insert or
+-- update settings — see server/api/settings/update.post.ts, which also
+-- now requires an admin session.
+drop policy if exists "Enable insert for authenticated users only" on public.settings;
+
+create policy "Enable insert for authenticated users only"
+on public.settings
+for insert
+to authenticated, dashboard_user
+with check (public.is_admin());
+
+drop policy if exists "Enable update for authenticated users on settings" on public.settings;
+
+create policy "Enable update for authenticated users on settings"
+on public.settings
+for update
+to authenticated, dashboard_user
+using (public.is_admin())
+with check (public.is_admin());
+
+-- Previously any authenticated user (not just an admin) could flip
+-- first_setup back to 'true', which would re-open the unauthenticated
+-- setup wizard for every visitor.
+drop policy if exists "Enable update for authenticated users on healthcheck" on public.healthcheck;
+
+create policy "Enable update for authenticated users on healthcheck"
+on public.healthcheck
+for update
+to authenticated, dashboard_user
+using (public.is_admin())
+with check (public.is_admin());
+
+--- inserts a row into public.profiles
+--- automatically grants admin to the first user if no profiles exist yet
+create or replace function public.handle_new_user()
+returns trigger
+language plpgsql
+security definer set search_path = ''
+as $$
+declare
+  profile_count int;
+  should_be_admin boolean;
+begin
+  select count(*) into profile_count from public.profiles;
+
+  -- Only the very first account is auto-promoted. Never trust
+  -- raw_user_meta_data for this: it is fully client-controlled — anyone can
+  -- pass an arbitrary `options.data` straight to Supabase's own
+  -- /auth/v1/signup endpoint, bypassing this project's own /api/auth/signup
+  -- route entirely — so honoring an `is_admin` key there let any new
+  -- signup grant itself admin.
+  should_be_admin := profile_count = 0;
+
+  insert into public.profiles (id, email, username, display_name, is_admin)
+  values (
+    new.id,
+    new.email,
+    new.raw_user_meta_data ->> 'username',
+    new.raw_user_meta_data ->> 'display_name',
+    should_be_admin
+  );
+  return new;
+end;
+$$;
+-- Not re-created here: on_auth_user_created (from 001_baseline.sql)
+-- already points at public.handle_new_user() by name, and
+-- `create or replace function` above is enough to update its behavior.

package/modules/pluto-migrations.ts

@@ -1,11 +1,87 @@
+import type { PlutoMigrationFile } from '../shared/types/migrations'
+import { createHash } from 'node:crypto'
 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
-import { dirname, join, relative } from 'node:path'
+import { basename, dirname, join, relative } from 'node:path'
 import { createResolver, defineNuxtModule, getLayerDirectories } from 'nuxt/kit'
 
+const schemaPattern = /^schema\.(.+)\.sql$/
+const noTransactionPattern = /^--\s*pluto:no-transaction\b/
+
+/**
+ * Plain, deliberate string comparator for migration file names — ASCII
+ * lexicographic order, so `001_...` sorts before `002_...` and so on.
+ * Written out instead of relying on `Array.prototype.sort()`'s default
+ * (which happens to do the same thing for ASCII names, but isn't a
+ * documented guarantee to depend on).
+ */
+function compareFileNames(a: string, b: string): number {
+  if (a < b) {
+    return -1
+  }
+  if (a > b) {
+    return 1
+  }
+  return 0
+}
+
+/**
+ * Derives a layer's key from its `package.json` `name` field, stripping
+ * any `@scope/` prefix. `@plutocms/supabase` always maps to the literal
+ * key `core` — every deployed site's ledger already has rows with
+ * `layer_name = 'core'`. Falls back to the layer directory's own name
+ * when `package.json` is missing or unreadable.
+ */
+function deriveLayerKey(layerRoot: string): string {
+  try {
+    const pkgRaw = readFileSync(join(layerRoot, 'package.json'), 'utf-8')
+    const pkg = JSON.parse(pkgRaw) as { name?: string }
+
+    if (typeof pkg.name === 'string' && pkg.name.length > 0) {
+      if (pkg.name === '@plutocms/supabase') {
+        return 'core'
+      }
+      return pkg.name.replace(/^@[^/]+\//, '')
+    }
+  } catch {
+    // package.json missing or unreadable — fall back to the directory name.
+  }
+
+  return basename(layerRoot)
+}
+
+function computeChecksum(content: string): string {
+  return createHash('sha256').update(content, 'utf-8').digest('hex').slice(0, 16)
+}
+
 /**
- * Discovers schema.[layerName].sql files across all Nuxt layers,
- * reads their content at build time, and populates runtimeConfig
- * so the migrations plugin can run them at server startup.
+ * True when the file's first non-blank line is a `-- pluto:no-transaction`
+ * directive.
+ */
+function detectNoTransaction(content: string): boolean {
+  const firstNonBlankLine = content
+    .split('\n')
+    .map((line) => line.trim())
+    .find((line) => line.length > 0)
+
+  return firstNonBlankLine ? noTransactionPattern.test(firstNonBlankLine) : false
+}
+
+function readMigrationFile(dir: string, fileName: string, name: string): PlutoMigrationFile {
+  const content = readFileSync(join(dir, fileName), 'utf-8')
+
+  return {
+    name,
+    sql: content,
+    checksum: computeChecksum(content),
+    noTransaction: detectNoTransaction(content),
+  }
+}
+
+/**
+ * Discovers `db/migrations/*.sql` (or, for a layer not yet converted, the
+ * legacy `public/schema.sql` / `public/schema.[name].sql`) across all Nuxt
+ * layers, reads their content at build time, and populates runtimeConfig
+ * so the migrations engine can apply them at server startup.
  *
  * Also seeds the consuming app's shared/types/supabase.ts with a
  * re-export of this layer's own committed snapshot when the consumer
@@ -59,62 +135,121 @@ export default defineNuxtModule({
     }
 
     const layerDirs = getLayerDirectories()
-    const layerSchemas: Record<string, string> = {}
-    const schemaPattern = /^schema\.(.+)\.sql$/
+    const layerMigrations: Record<string, PlutoMigrationFile[]> = {}
+
+    // Keeps the first-discovered layer for a given key (getLayerDirectories
+    // orders the user/project layer first), and warns once when a later
+    // layer's key collides with one already discovered.
+    function assignLayer(layerKey: string, files: PlutoMigrationFile[]): void {
+      if (layerMigrations[layerKey]) {
+        console.warn(
+          `[pluto-migrations] Layer key "${layerKey}" was already discovered from another layer. Keeping the first one, ignoring this one.`
+        )
+        return
+      }
+      layerMigrations[layerKey] = files
+    }
 
     for (const layer of layerDirs) {
-      // Each layer may have a public/ directory with schema files
+      const migrationsDir = join(layer.root, 'db/migrations')
+
+      if (existsSync(migrationsDir)) {
+        let fileNames: string[] = []
+        try {
+          fileNames = readdirSync(migrationsDir).filter((file) =>
+            file.endsWith('.sql')
+          )
+        } catch {
+          console.error(
+            `[pluto-migrations] Failed to read migrations directory: ${migrationsDir}`
+          )
+          continue
+        }
+
+        fileNames.sort(compareFileNames)
+
+        const files: PlutoMigrationFile[] = []
+        for (const fileName of fileNames) {
+          try {
+            files.push(readMigrationFile(migrationsDir, fileName, fileName))
+          } catch {
+            console.error(
+              `[pluto-migrations] Failed to read migration file: ${fileName}`
+            )
+          }
+        }
+
+        assignLayer(deriveLayerKey(layer.root), files)
+        continue
+      }
+
+      // Legacy fallback for a layer not yet converted to db/migrations/,
+      // exactly as before: a single public/schema.sql (always key `core`)
+      // and/or public/schema.[name].sql (key comes from the file name, not
+      // package.json — this keeps working for an unconverted layer without
+      // requiring it to match its package name).
       const publicDir = join(layer.root, 'public')
 
       if (!existsSync(publicDir)) {
         continue
       }
 
-      let files: string[] = []
+      let publicFiles: string[] = []
       try {
-        files = readdirSync(publicDir, 'utf-8')
+        publicFiles = readdirSync(publicDir)
       } catch {
         continue
       }
 
-      for (const file of files) {
-        // Skip the core schema
-        if (file === 'schema.sql') {
+      for (const fileName of publicFiles) {
+        if (fileName === 'schema.sql') {
+          try {
+            assignLayer('core', [
+              readMigrationFile(publicDir, fileName, '001_baseline.sql'),
+            ])
+          } catch {
+            console.error(
+              `[pluto-migrations] Failed to read schema file: ${fileName}`
+            )
+          }
           continue
         }
 
-        const match = file.match(schemaPattern)
+        const match = fileName.match(schemaPattern)
         if (match?.[1]) {
-          const layerName = match[1]
-          // Read SQL content at build time
           try {
-            layerSchemas[layerName] = readFileSync(
-              join(publicDir, file),
-              'utf-8'
-            )
+            assignLayer(match[1], [
+              readMigrationFile(publicDir, fileName, '001_baseline.sql'),
+            ])
           } catch {
             console.error(
-              `[pluto-migrations] Failed to read schema file: ${file}`
+              `[pluto-migrations] Failed to read schema file: ${fileName}`
             )
           }
         }
       }
     }
 
-    const layerNames = Object.keys(layerSchemas)
-
-    // Populate runtimeConfig with layer names and their SQL content.
+    // Populate runtimeConfig with every layer's ordered migration files.
     // Nuxt's schema inference narrows this to a literal shape based on
-    // whatever layer keys were last observed in this project (see the
-    // `RuntimeConfig` augmentation in shared/types/runtime-config.d.ts,
-    // which isn't visible from this module-context tsconfig), so the
-    // assignment is cast to the intended general shape.
-    ;(nuxt.options.runtimeConfig as { plutoLayerSchemas: Record<string, string> }).plutoLayerSchemas =
-      layerSchemas
-
-    if (layerNames.length > 0) {
+    // whatever layer keys and file shapes happen to be discovered in a
+    // given project (see the `RuntimeConfig` augmentation in
+    // shared/types/runtime-config.d.ts, which isn't visible from this
+    // module-context tsconfig), so the assignment is cast to the intended
+    // general shape. That inferred shape's array elements don't carry
+    // enough structure for a direct cast, hence the `unknown` step.
+    ;(
+      nuxt.options.runtimeConfig as unknown as {
+        plutoLayerMigrations: Record<string, PlutoMigrationFile[]>
+      }
+    ).plutoLayerMigrations = layerMigrations
+
+    const layerKeys = Object.keys(layerMigrations)
+    if (layerKeys.length > 0) {
       console.warn(
-        `[pluto-migrations] Discovered layer schemas: ${layerNames.join(', ')}`
+        `[pluto-migrations] Discovered layer migrations: ${layerKeys
+          .map((key) => `${key} (${layerMigrations[key]!.length} file(s))`)
+          .join(', ')}`
       )
     }
   },

package/nuxt.config.ts

@@ -1,3 +1,5 @@
+import type { PlutoMigrationFile } from './shared/types/migrations'
+
 // Point these at a local checkout (e.g. `../pluto`, `../utils`) to test
 // unpublished changes; unset, they resolve to the published npm packages.
 const plutoLayer = process.env.PLUTO_PLUTO_PATH || '@plutocms/pluto'
@@ -18,7 +20,7 @@ export default defineNuxtConfig({
     supabaseUrl: process.env.SUPABASE_URL,
     supabaseKey: process.env.SUPABASE_KEY,
     plutoRootDir: '',
-    plutoLayerSchemas: {} as Record<string, string>,
+    plutoLayerMigrations: {} as Record<string, PlutoMigrationFile[]>,
   },
 
   alias: {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@plutocms/supabase",
   "type": "module",
-  "version": "0.2.2",
+  "version": "0.4.0",
   "trustedDependencies": [
     "@parcel/watcher",
     "@plutocms/pluto",
@@ -36,6 +36,7 @@
     "supabase-types": "bun ./scripts/supabase-typegen.ts"
   },
   "dependencies": {
+    "@nuxt/eslint": "^1.16.0",
     "@nuxt/ui": "^4.9.0",
     "@nuxtjs/supabase": "^2.0.9",
     "@plutocms/pluto": "^0.3.2",
@@ -46,7 +47,6 @@
   },
   "devDependencies": {
     "@antfu/eslint-config": "^6.2.0",
-    "@nuxt/eslint": "^1.16.0",
     "@types/bun": "^1.3.14",
     "@vueuse/nuxt": "^14.3.0",
     "eslint": "^10.6.0",

package/server/api/migrations/run.post.ts

@@ -0,0 +1,101 @@
+import type { PlutoMigrationFile } from '../../../shared/types/migrations'
+import type { MigrationFileResult } from '../../utils/migrations'
+import { requireAdmin } from '../../utils/admin-guard'
+import { persistDatabaseUrl } from '../../utils/env-file'
+import { resolveConnectionString, runPendingMigrations } from '../../utils/migrations'
+import { scrubConnectionString } from '../../utils/scrub-connection-string'
+import { regenerateSupabaseTypes } from '../../utils/typegen'
+
+interface Payload {
+  connectionString?: string
+}
+
+export default defineEventHandler(async (event) => {
+  await requireAdmin(event)
+
+  const body = await readBody<Payload | undefined>(event)
+
+  // Connection string precedence: an already-configured DATABASE_URL always
+  // wins, and a body-supplied string is ignored completely in that case.
+  // This is the whole security model for this endpoint — without it, any
+  // admin could point the server at an arbitrary database host. See
+  // resolveConnectionString for the full rule.
+  const { connStr, usingBody: usingBodyConnectionString } =
+    resolveConnectionString(body?.connectionString)
+
+  if (!connStr) {
+    return {
+      success: false as const,
+      needsConnectionString: true,
+    }
+  }
+
+  const config = useRuntimeConfig()
+  // Nuxt's schema inference narrows `plutoLayerMigrations` to whatever
+  // layer keys and file shapes it happened to observe at build time (see
+  // the `RuntimeConfig` augmentation in shared/types/runtime-config.d.ts),
+  // so the read is cast back to the intended general shape.
+  const layers = (config.plutoLayerMigrations ?? {}) as unknown as Record<
+    string,
+    PlutoMigrationFile[]
+  >
+
+  try {
+    const layerResults = await runPendingMigrations({
+      connectionString: connStr,
+      layers,
+    })
+
+    const results: MigrationFileResult[] = layerResults.flatMap(
+      (layer) => layer.results
+    )
+
+    const anyApplied = results.some((result) => result.status === 'applied')
+
+    // Deliberate runtime mutation: a valid connection string just proved
+    // itself against the database, so make it available to
+    // getConnectionString() for the rest of this process life. No
+    // server restart is needed for later requests to pick it up.
+    if (usingBodyConnectionString) {
+      process.env.DATABASE_URL = connStr
+    }
+
+    // Nothing to persist when DATABASE_URL was already configured.
+    // Otherwise persist the now-proven body-supplied string.
+    let persisted = !usingBodyConnectionString
+    let message: string | undefined
+
+    if (usingBodyConnectionString) {
+      persisted = await persistDatabaseUrl(connStr)
+
+      if (!persisted) {
+        message =
+          'Migrations were applied, but the connection string could not be ' +
+          'saved to .env. Add DATABASE_URL to .env by hand.'
+      }
+    }
+
+    if (import.meta.dev && anyApplied && config.plutoRootDir) {
+      await regenerateSupabaseTypes(config.plutoRootDir, connStr)
+    }
+
+    return {
+      success: true as const,
+      results,
+      persisted,
+      message,
+    }
+  } catch (error: any) {
+    const errorMessage = scrubConnectionString(
+      error?.message ?? 'Unknown migration error.',
+      connStr
+    )
+
+    console.error('Error applying migrations:', errorMessage)
+
+    return {
+      success: false as const,
+      error: errorMessage,
+    }
+  }
+})