@plutocms/supabase 0.2.2 → 0.4.0

package/server/api/migrations/status.get.ts

@@ -0,0 +1,14 @@
+import { requireAdmin } from '../../utils/admin-guard'
+import { getMigrationStatus } from '../../utils/pending-migrations'
+
+export default defineEventHandler(async (event) => {
+  await requireAdmin(event)
+
+  const status = await getMigrationStatus(event)
+
+  return {
+    success: true as const,
+    ...status,
+    needsConnectionString: !status.hasConnection && status.pendingFileCount > 0,
+  }
+})

package/server/api/settings/update.post.ts

@@ -1,6 +1,18 @@
 import { serverSupabaseClient } from '#supabase/server'
+import { requireAdmin } from '../../utils/admin-guard'
+
+// Mirrors the TSettings enum in db/migrations/001_baseline.sql. The Postgres enum
+// already rejects an unknown key at the DB level (as a raw constraint
+// error) — this turns that into a clean 400 instead.
+const KNOWN_SETTING_KEYS = [
+  'website_title',
+  'website_url',
+  'website_description',
+] as const
 
 export default defineEventHandler(async (event) => {
+  await requireAdmin(event)
+
   type SettingName =
     Database['public']['Tables']['settings']['Insert']['setting_name']
   type FormBody = Record<SettingName, string>
@@ -8,16 +20,32 @@ export default defineEventHandler(async (event) => {
   const client = await serverSupabaseClient<Database>(event)
   const body = await readBody<FormBody>(event)
 
-  if (!body) {
-    throw createError({ statusMessage: 'No payload sent.' })
+  if (!body || typeof body !== 'object') {
+    throw createError({ statusCode: 400, statusMessage: 'No payload sent.' })
   }
 
-  const transformed = [
-    ...Object.entries(body).map(([key, value]) => ({
+  const transformed = Object.entries(body).map(([key, value]) => {
+    if (
+      !KNOWN_SETTING_KEYS.includes(key as (typeof KNOWN_SETTING_KEYS)[number])
+    ) {
+      throw createError({
+        statusCode: 400,
+        statusMessage: `Unknown setting: ${key}`,
+      })
+    }
+
+    if (typeof value !== 'string') {
+      throw createError({
+        statusCode: 400,
+        statusMessage: `Setting "${key}" must be a string.`,
+      })
+    }
+
+    return {
       setting_name: key as SettingName,
       setting_value: value,
-    })),
-  ]
+    }
+  })
 
   const { data, error } = await client
     .from('settings')

package/server/api/setup/create.post.ts

@@ -1,22 +1,51 @@
-import { readFile, writeFile } from 'node:fs/promises'
-import { resolve } from 'node:path'
+import type { PlutoMigrationFile } from '../../../shared/types/migrations'
 import postgres from 'postgres'
-import { splitStatements } from '../../utils/sql'
+import { persistDatabaseUrl } from '../../utils/env-file'
+import { runPendingMigrations } from '../../utils/migrations'
+import { scrubConnectionString } from '../../utils/scrub-connection-string'
 
 interface Payload {
-  baseUrl: string
   connectionString: string
 }
 
 export default defineEventHandler(async (event) => {
-  const body = await readBody<Payload>(event)
+  // An already-configured DATABASE_URL means setup has already completed.
+  // This route is reachable with no admin session — no admin can exist
+  // before setup creates the profiles table — so once real setup has run,
+  // this check is the only thing stopping anyone from re-running it against
+  // an arbitrary database. Mirrors the same precedence rule in
+  // server/api/migrations/run.post.ts, which calls it "the whole security
+  // model for this endpoint."
+  if (process.env.DATABASE_URL) {
+    throw createError({
+      statusCode: 403,
+      statusMessage: 'Setup has already been completed.',
+    })
+  }
 
-  let schema = await $fetch<string | Blob>('/schema.sql', {
-    baseURL: body.baseUrl,
-  })
+  const body = await readBody<Payload>(event)
 
-  if (typeof schema !== 'string') {
-    schema = await schema.text()
+  const config = useRuntimeConfig()
+  // Nuxt's schema inference narrows `plutoLayerMigrations` to whatever
+  // layer keys and file shapes it happened to observe at build time (see
+  // the `RuntimeConfig` augmentation in shared/types/runtime-config.d.ts),
+  // so the read is cast back to the intended general shape.
+  const layers = (config.plutoLayerMigrations ?? {}) as unknown as Record<
+    string,
+    PlutoMigrationFile[]
+  >
+
+  // The core layer's migrations are discovered and embedded at build time
+  // by the pluto-migrations module, exactly like every other layer — see
+  // modules/pluto-migrations.ts. Reading it from there instead of fetching
+  // it over HTTP means this route needs no `baseUrl` from the caller, and
+  // can no longer be made to fetch or execute SQL from an arbitrary origin.
+  if (!layers.core?.length) {
+    throw createError({
+      statusCode: 500,
+      statusMessage:
+        'Core schema not found. Reinstall @plutocms/supabase and restart the dev server.',
+    })
   }
 
   const supabaseUrl = process.env.SUPABASE_URL
@@ -30,63 +59,62 @@ export default defineEventHandler(async (event) => {
 
   const connectionString = body.connectionString
 
-  const sql = postgres(connectionString)
-
   try {
-    const statements = splitStatements(schema)
-
-    for (const statement of statements) {
-      await sql.unsafe(statement)
-    }
-
-    // Mark first_setup as complete
-    await sql.unsafe(
-      `UPDATE public.healthcheck SET config_value = 'false' WHERE config_name = 'first_setup'`
-    )
-
-    // Record the core schema migration
-    await sql.unsafe(
-      `INSERT INTO public.pluto_migrations (layer_name)
-       VALUES ('core')
-       ON CONFLICT (layer_name) DO NOTHING`
-    )
-
-    // Persist connection string to .env for future layer migrations
-    const envPath = resolve(process.cwd(), '.env')
-    let envContent = ''
-    try {
-      envContent = await readFile(envPath, 'utf-8')
-    } catch {
-      // .env doesn't exist yet
-    }
-
-    if (envContent.includes('DATABASE_URL=')) {
-      envContent = envContent.replace(
-        /^DATABASE_URL=.*$/m,
-        `DATABASE_URL="${connectionString}"`
-      )
-    } else {
-      // Ensure there's a trailing newline before appending
-      if (envContent.length > 0 && !envContent.endsWith('\n')) {
-        envContent += '\n'
+    // core must apply before every other layer — a layer's migrations may
+    // reference core objects (public.profiles, public.is_admin()).
+    // runPendingMigrations guarantees this ordering itself.
+    const layerResults = await runPendingMigrations({
+      connectionString,
+      layers,
+    })
+
+    const coreResult = layerResults.find((layer) => layer.layerName === 'core')
+
+    // Only mark first_setup complete once the core layer's own migrations
+    // are known good. A single failing extra layer must not block this —
+    // core already succeeded, so the wizard can still hand off to sign-up —
+    // but a failed core layer must not flip first_setup, since the base
+    // schema (profiles, healthcheck, and so on) may be incomplete.
+    if (coreResult && !coreResult.failed) {
+      const sql = postgres(connectionString, { max: 1 })
+      try {
+        await sql.unsafe(
+          `UPDATE public.healthcheck SET config_value = 'false' WHERE config_name = 'first_setup'`
+        )
+      } finally {
+        await sql.end()
       }
-      envContent += `DATABASE_URL="${connectionString}"\n`
     }
 
-    await writeFile(envPath, envContent, 'utf-8')
+    // Deliberate runtime mutation: the connection string just proved
+    // itself against the database, so make it available to
+    // getConnectionString() for the rest of this process life, with no
+    // server restart needed.
+    process.env.DATABASE_URL = connectionString
+
+    // Persist connection string to .env for future layer migrations. This
+    // must stay the very last thing this handler does — see "The
+    // dev-server restart on first save" in
+    // .claude/skills/layer-migrations/SKILL.md.
+    const persisted = await persistDatabaseUrl(connectionString)
 
     return {
       success: true,
       message: 'Database setup completed successfully.',
+      layers: layerResults,
+      persisted,
     }
   } catch (error: any) {
-    console.error('Error setting up database:', error)
+    const message = scrubConnectionString(
+      error.message ?? 'Unknown error.',
+      connectionString
+    )
+
+    console.error('Error setting up the database:', message)
 
     return {
       success: false,
-      error: error.message,
+      error: message,
     }
-  } finally {
-    sql.end()
   }
 })

package/server/api/users/[id].get.ts

@@ -1,6 +1,9 @@
 import { serverSupabaseClient } from '#supabase/server'
+import { requireAdmin } from '../../utils/admin-guard'
 
 export default defineEventHandler(async (event) => {
+  await requireAdmin(event)
+
   const client = await serverSupabaseClient<Database>(event)
 
   const id = event.context.params?.id as string

package/server/api/users/index.get.ts

@@ -1,6 +1,9 @@
 import { serverSupabaseClient } from '#supabase/server'
+import { requireAdmin } from '../../utils/admin-guard'
 
 export default defineEventHandler(async (event) => {
+  await requireAdmin(event)
+
   const client = await serverSupabaseClient<Database>(event)
 
   const { data: users, error } = await client.from('profiles').select('*')

package/server/plugins/migrations.ts

@@ -1,4 +1,5 @@
-import { runLayerMigration } from '../utils/migrations'
+import type { PlutoMigrationFile } from '../../shared/types/migrations'
+import { runPendingMigrations } from '../utils/migrations'
 import { regenerateSupabaseTypes } from '../utils/typegen'
 
 export default defineNitroPlugin(async () => {
@@ -8,52 +9,48 @@ export default defineNitroPlugin(async () => {
   }
 
   const config = useRuntimeConfig()
-  const layerSchemas: Record<string, string> = config.plutoLayerSchemas ?? {}
-
-  const layerNames = Object.keys(layerSchemas)
-
-  if (layerNames.length === 0) {
+  // Nuxt's schema inference narrows `plutoLayerMigrations` to whatever
+  // layer keys and file shapes it happened to observe at build time (see
+  // the `RuntimeConfig` augmentation in shared/types/runtime-config.d.ts),
+  // so the read is cast back to the intended general shape.
+  const layers = (config.plutoLayerMigrations ?? {}) as unknown as Record<
+    string,
+    PlutoMigrationFile[]
+  >
+
+  if (Object.keys(layers).length === 0) {
     return
   }
 
   let anyApplied = false
 
-  for (const layerName of layerNames) {
-    const schemaSql = layerSchemas[layerName]
-
-    if (!schemaSql) {
-      continue
-    }
-
-    try {
-      const result = await runLayerMigration({
-        layerName,
-        schemaSql,
-      })
-
-      if (result.skipped) {
-        console.warn(
-          `[migrations] Layer "${layerName}" already applied, skipped.`
-        )
-      } else if (result.success) {
-        console.warn(`[migrations] Layer "${layerName}" migrated successfully.`)
-        anyApplied = true
-      } else {
-        console.error(`[migrations] Layer "${layerName}" failed:`, result.error)
+  try {
+    const layerResults = await runPendingMigrations({
+      connectionString: process.env.DATABASE_URL,
+      layers,
+    })
+
+    for (const layer of layerResults) {
+      for (const result of layer.results) {
+        const label = `${result.layerName}/${result.migrationName}`
+
+        if (result.status === 'skipped') {
+          console.warn(`[migrations] ${label} already applied, skipped.`)
+        } else if (result.status === 'applied') {
+          console.warn(`[migrations] ${label} migrated successfully.`)
+          anyApplied = true
+        } else {
+          console.error(`[migrations] ${label} failed:`, result.error)
+        }
       }
-    } catch (error) {
-      console.error(
-        `[migrations] Error running migration for "${layerName}":`,
-        error
-      )
     }
+  } catch (error) {
+    console.error('[migrations] Error running pending migrations:', error)
   }
 
-  // Regenerate Database types from the live schema whenever a layer schema
-  // was newly applied, so `Database` stays in sync without a manual step.
-  // Re-editing an already-applied layer schema is a no-op here (it's
-  // recorded as `skipped`); use the `supabase-types` script to force a
-  // refresh in that case.
+  // Regenerate Database types from the live schema whenever a migration
+  // file was newly applied, so `Database` stays in sync without a manual
+  // step.
   if (import.meta.dev && anyApplied && config.plutoRootDir) {
     await regenerateSupabaseTypes(config.plutoRootDir)
   }

package/server/utils/admin-guard.ts

@@ -0,0 +1,46 @@
+import type { H3Event } from 'h3'
+import { serverSupabaseClient, serverSupabaseUser } from '#supabase/server'
+
+/**
+ * Guards a server route so only a logged-in admin can call it.
+ *
+ * `serverSupabaseUser` (from `@nuxtjs/supabase`, backed by
+ * `client.auth.getClaims()`) returns decoded JWT claims, not a Supabase
+ * `User` row. The claims object has no `id` field — the user's id is the
+ * `sub` claim. Using `user.id` here silently queries `eq('id', undefined)`,
+ * which matches zero rows and looks exactly like "not an admin" even for a
+ * real admin. Always read `user.sub`, never `user.id`.
+ *
+ * Reads `is_admin` from `public.profiles`, never from `user_metadata`. The
+ * `handle_new_user` trigger never writes `is_admin` back to
+ * `auth.users.raw_user_meta_data`, so `user_metadata.is_admin` can be unset
+ * even for the first admin. `public.profiles.is_admin` is the source of
+ * truth.
+ *
+ * Throws a 401 if there is no logged-in user, or a 403 if the user is not
+ * an admin. Returns the claims on success.
+ */
+export async function requireAdmin(event: H3Event) {
+  const user = await serverSupabaseUser(event)
+
+  if (!user) {
+    throw createError({ statusCode: 401, statusMessage: 'You must be logged in.' })
+  }
+
+  const client = await serverSupabaseClient<Database>(event)
+
+  const { data: profile, error } = await client
+    .from('profiles')
+    .select('is_admin')
+    .eq('id', user.sub)
+    .single()
+
+  if (error || !profile?.is_admin) {
+    throw createError({
+      statusCode: 403,
+      statusMessage: 'Your account is not an admin.',
+    })
+  }
+
+  return user
+}

package/server/utils/env-file.ts

@@ -0,0 +1,53 @@
+import { readFile, writeFile } from 'node:fs/promises'
+import { resolve } from 'node:path'
+
+/**
+ * Writes (or updates) `DATABASE_URL` in the project's `.env` file.
+ *
+ * Reads the current file, replaces an existing `DATABASE_URL` line or
+ * appends a new one, then writes it back. Never throws: a failure to read
+ * or write is swallowed and reported as `false`, so a caller can still
+ * report success for work that is already durably recorded elsewhere (for
+ * example, an applied migration row) even when `.env` could not be
+ * updated.
+ *
+ * Caveat: `process.cwd()` may not point at the project root in every
+ * deployment (a production build can start from a different working
+ * directory). This best-effort write can silently target the wrong file in
+ * that case.
+ */
+export async function persistDatabaseUrl(
+  connectionString: string
+): Promise<boolean> {
+  try {
+    const envPath = resolve(process.cwd(), '.env')
+    let envContent = ''
+
+    try {
+      envContent = await readFile(envPath, 'utf-8')
+    } catch {
+      // .env doesn't exist yet.
+    }
+
+    if (envContent.includes('DATABASE_URL=')) {
+      envContent = envContent.replace(
+        /^DATABASE_URL=.*$/m,
+        `DATABASE_URL="${connectionString}"`
+      )
+    } else {
+      // Ensure there's a trailing newline before appending.
+      if (envContent.length > 0 && !envContent.endsWith('\n')) {
+        envContent += '\n'
+      }
+      envContent += `DATABASE_URL="${connectionString}"\n`
+    }
+
+    await writeFile(envPath, envContent, 'utf-8')
+
+    return true
+  } catch (error) {
+    console.error('Error persisting DATABASE_URL to .env:', error)
+
+    return false
+  }
+}

package/server/utils/ledger.ts

@@ -0,0 +1,124 @@
+import type postgres from 'postgres'
+import { splitStatements } from './sql'
+
+/**
+ * Cheap check for whether `public.pluto_migrations` is already in the
+ * target shape (has a `migration_name` column). Running this first, and
+ * skipping every DDL statement below when it already passes, avoids
+ * taking a DDL lock on the table on every server boot once a database has
+ * already been upgraded.
+ */
+const PROBE_SQL = `
+  select 1
+  from information_schema.columns
+  where table_schema = 'public'
+    and table_name = 'pluto_migrations'
+    and column_name = 'migration_name'
+`
+
+/**
+ * Brings `public.pluto_migrations` from either shape (none yet, or the old
+ * one-row-per-layer shape) to the versioned, per-migration shape:
+ *
+ * ```sql
+ * create table if not exists public.pluto_migrations (
+ *   id bigint generated by default as identity primary key,
+ *   layer_name text not null,
+ *   migration_name text not null,
+ *   checksum text,
+ *   applied_at timestamptz not null default now(),
+ *   constraint pluto_migrations_layer_migration_key unique (layer_name, migration_name)
+ * );
+ * ```
+ *
+ * The backfill below (`migration_name = '001_baseline.sql'` for a null
+ * row) is safe and correct because an old-shape row can only exist if the
+ * old engine ran a layer's single monolithic schema file — that file is,
+ * by construction, `001_baseline.sql` for every layer (see
+ * `db/migrations/001_baseline.sql` for `core`, and the equivalent file in
+ * every converted layer).
+ */
+export const ledgerDdl = `
+create table if not exists public.pluto_migrations (
+  id bigint generated by default as identity primary key,
+  layer_name text not null,
+  migration_name text not null,
+  checksum text,
+  applied_at timestamptz not null default now(),
+  constraint pluto_migrations_layer_migration_key unique (layer_name, migration_name)
+);
+
+alter table public.pluto_migrations add column if not exists migration_name text;
+
+alter table public.pluto_migrations add column if not exists checksum text;
+
+update public.pluto_migrations set migration_name = '001_baseline.sql' where migration_name is null;
+
+alter table public.pluto_migrations alter column migration_name set not null;
+
+alter table public.pluto_migrations drop constraint if exists pluto_migrations_layer_key;
+
+do $$
+begin
+  if not exists (
+    select 1 from pg_constraint
+     where conname = 'pluto_migrations_layer_migration_key'
+       and conrelid = 'public.pluto_migrations'::regclass
+  ) then
+    alter table public.pluto_migrations
+      add constraint pluto_migrations_layer_migration_key unique (layer_name, migration_name);
+  end if;
+end
+$$;
+
+alter table public.pluto_migrations enable row level security;
+
+do $$
+begin
+  if not exists (
+    select 1 from pg_policies where tablename = 'pluto_migrations' and policyname = 'Enable read access for authenticated users on pluto_migrations'
+  ) then
+    create policy "Enable read access for authenticated users on pluto_migrations"
+    on public.pluto_migrations
+    for select
+    to authenticated, dashboard_user
+    using (true);
+  end if;
+end
+$$;
+`
+
+async function runLedgerSteps(
+  tx: postgres.Sql | postgres.TransactionSql
+): Promise<void> {
+  const probe = await tx.unsafe(PROBE_SQL)
+
+  if (probe.length > 0) {
+    // Already in the target shape. Skip all DDL below.
+    return
+  }
+
+  for (const statement of splitStatements(ledgerDdl)) {
+    await tx.unsafe(statement)
+  }
+}
+
+/**
+ * Ensures `public.pluto_migrations` is in the versioned, per-migration
+ * shape, running every DDL step in one transaction.
+ *
+ * Accepts either a plain connection or a connection already inside a
+ * transaction. A plain connection (it has `.begin`) opens its own
+ * transaction here; a connection already inside a transaction runs the
+ * same steps directly, since the caller's transaction already wraps them.
+ */
+export async function ensureLedger(
+  sql: postgres.Sql | postgres.TransactionSql
+): Promise<void> {
+  if (typeof (sql as postgres.Sql).begin === 'function') {
+    await (sql as postgres.Sql).begin((tx) => runLedgerSteps(tx))
+    return
+  }
+
+  await runLedgerSteps(sql as postgres.TransactionSql)
+}

package/server/utils/scrub-connection-string.ts

@@ -0,0 +1,37 @@
+/**
+ * Removes a connection string, and its password segment, from an error
+ * message before it is logged or returned to a client.
+ *
+ * A `postgres` error can embed the full connection string (host, user,
+ * password) in its message. Call this on every error message that might
+ * have touched a connection string, before it is logged or sent in a
+ * response.
+ */
+export function scrubConnectionString(
+  message: string,
+  connStr: string
+): string {
+  if (!message || !connStr) {
+    return message
+  }
+
+  let scrubbed = message.split(connStr).join('[redacted]')
+
+  const passwordMatch = connStr.match(/:\/\/[^:@/]+:([^@]+)@/)
+  const password = passwordMatch?.[1]
+
+  if (password) {
+    scrubbed = scrubbed.split(password).join('[redacted]')
+
+    try {
+      const decodedPassword = decodeURIComponent(password)
+      if (decodedPassword !== password) {
+        scrubbed = scrubbed.split(decodedPassword).join('[redacted]')
+      }
+    } catch {
+      // Password wasn't URI-encoded — nothing more to decode.
+    }
+  }
+
+  return scrubbed
+}