@plutocms/supabase 0.24.0 → 0.25.0

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.25.0](https://github.com/plutocms/supabase/compare/v0.24.0...v0.25.0) (2026-11-06)
+
+
+### Features
+
+* **supabase:** keep a server copy of the unsaved changes of an editor ([#234](https://github.com/plutocms/supabase/issues/234)) ([bd7d06f](https://github.com/plutocms/supabase/commit/bd7d06f5094d43e98e406d05b2af99bd4a5962ce))
+
 ## [0.24.0](https://github.com/plutocms/supabase/compare/v0.23.0...v0.24.0) (2026-11-06)
 
 

package/FEATURES.md

@@ -18,6 +18,8 @@ policies shared by every project here.
   declared content type into `@plutocms/core`'s generic content routes. It supports query
   filters (a filter on a `multiple` reference matches a list column) and `ids`, puts the timestamps on items, and reads the public API of core with an anonymous client.
   It keeps the revisions of every item (`pluto_content_revisions`, migration 011) for the History of core.
+  It keeps a server copy of the unsaved changes of each editor (`pluto_content_backups`, migration
+  012), so the edit form can offer them on another device.
   @.claude/skills/content-adapter/SKILL.md
 - Auth driver: plugs Supabase sign-in into the admin shell that pluto core owns (navbar, sign-in
   page, route guard), keeps the setup guard in the driver, and registers the backend badge

package/db/migrations/012_content_backups.sql

@@ -0,0 +1,55 @@
+-- The server copy of the unsaved changes of an editor (the content-backup skill of
+-- @plutocms/core). The edit form sends the copy while the editor types, so the editor can pick the
+-- changes up again on another device. One row for each user, content type and item. Only the owner
+-- reads or writes a row. Every content type of every layer shares this table. Every statement is
+-- idempotent.
+
+create table if not exists public.pluto_content_backups (
+  id          bigint generated by default as identity not null,
+  user_id     uuid not null default auth.uid() references auth.users (id) on delete cascade,
+  type        text not null,                -- the content type name
+  item_key    text not null,                -- the item id as text, '+new' for a new item
+  device      text not null,                -- the device id of the record
+  saved_at    timestamp with time zone not null,  -- savedAt of the record (the browser clock)
+  updated_at  timestamp with time zone not null default now(),  -- the server time of the write
+  record      jsonb not null,
+  constraint pluto_content_backups_pkey primary key (id),
+  constraint pluto_content_backups_item_key unique (user_id, type, item_key),
+  constraint pluto_content_backups_item_key_length check (char_length(item_key) between 1 and 500),
+  constraint pluto_content_backups_record_size check (octet_length(record::text) <= 5000000)
+);
+
+create index if not exists pluto_content_backups_user_idx
+  on public.pluto_content_backups (user_id, updated_at desc);
+
+alter table public.pluto_content_backups enable row level security;
+
+-- Owner only. The core route checks the write capability of the type, and a row only ever shows
+-- its owner their own data, so the policies hold no capability.
+drop policy if exists "pluto_content_backups_select" on public.pluto_content_backups;
+create policy "pluto_content_backups_select"
+  on public.pluto_content_backups for select
+  to authenticated
+  using (user_id = (select auth.uid()));
+
+drop policy if exists "pluto_content_backups_insert" on public.pluto_content_backups;
+create policy "pluto_content_backups_insert"
+  on public.pluto_content_backups for insert
+  to authenticated
+  with check (user_id = (select auth.uid()));
+
+drop policy if exists "pluto_content_backups_update" on public.pluto_content_backups;
+create policy "pluto_content_backups_update"
+  on public.pluto_content_backups for update
+  to authenticated
+  using (user_id = (select auth.uid()))
+  with check (user_id = (select auth.uid()));
+
+drop policy if exists "pluto_content_backups_delete" on public.pluto_content_backups;
+create policy "pluto_content_backups_delete"
+  on public.pluto_content_backups for delete
+  to authenticated
+  using (user_id = (select auth.uid()));
+
+grant select, insert, update, delete on public.pluto_content_backups to authenticated;
+grant select, insert, update, delete on public.pluto_content_backups to service_role;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@plutocms/supabase",
   "type": "module",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "Supabase backend layer for Pluto",
   "author": "Victor Ribeiro",
   "homepage": "https://github.com/plutocms/supabase/tree/main/packages/supabase#readme",
@@ -30,7 +30,7 @@
   "dependencies": {
     "@nuxt/ui": "^4.12.0",
     "@nuxtjs/supabase": "^2.1.0",
-    "@plutocms/core": ">=0.58.0 <1.0.0",
+    "@plutocms/core": ">=0.59.0 <1.0.0",
     "@supabase/supabase-js": "^2.117.3",
     "postgres": "^3.4.9",
     "supabase": "^2.121.0",

package/server/utils/content-adapter.ts

@@ -3,6 +3,7 @@ import type { H3Event } from 'h3'
 import { createClient } from '@supabase/supabase-js'
 import { serverSupabaseClient } from '#supabase/server'
 import { requireCapability } from './capability-guard'
+import { getBackup, putBackup, removeBackup } from './content-backups'
 import {
   deleteRevisions,
   getItemRevision,
@@ -571,6 +572,22 @@ async function getRevision(
   }
 }
 
+/** The server copy of the unsaved changes of the caller. See `content-backups.ts`. */
+const backups = {
+  async get(ctx: PlutoContentContext, key: string) {
+    const client = await getClient(ctx.event)
+    return await getBackup(ctx, client, key)
+  },
+  async put(ctx: PlutoContentContext, key: string, record: PlutoContentBackup) {
+    const client = await getClient(ctx.event)
+    return await putBackup(ctx, client, key, record)
+  },
+  async remove(ctx: PlutoContentContext, key: string) {
+    const client = await getClient(ctx.event)
+    await removeBackup(ctx, client, key)
+  },
+}
+
 /**
  * Counts the rows created in `[range.from, range.to)` with one exact-count
  * HEAD query: no rows come back, so it is not capped by the PostgREST row
@@ -619,5 +636,6 @@ export function createSupabaseContentAdapter(): PlutoContentAdapter {
     timestampKeys,
     listRevisions,
     getRevision,
+    backups,
   }
 }

package/server/utils/content-backups.ts

@@ -0,0 +1,220 @@
+import type { SupabaseClient } from '@supabase/supabase-js'
+import type { H3Event } from 'h3'
+import { serverSupabaseUser } from '#supabase/server'
+
+/**
+ * The server copy of the unsaved changes of an editor (012_content_backups.sql). Core's edit form
+ * sends it through `PlutoContentAdapter.backups`. One row for each user, type and item, readable
+ * only by its owner (Row Level Security). See the content-adapter skill ("Backups").
+ */
+
+export const BACKUPS_TABLE = 'pluto_content_backups'
+
+/** The most copies kept for one user. Older ones (by `updated_at`) are deleted after a write. */
+export const MAX_BACKUPS_PER_USER = 20
+
+/** A copy expires after this many days. */
+export const BACKUP_TTL_DAYS = 14
+
+/** `otherDevice` is true when the replaced copy came from another device within this time. */
+export const OTHER_DEVICE_WINDOW_MS = 10 * 60 * 1000
+
+/** The most rows one cleanup deletes. A later write deletes the rest. */
+const PRUNE_BATCH = 100
+
+const DAY_MS = 24 * 60 * 60 * 1000
+
+let warned = false
+
+/**
+ * True when the error says the table does not exist: Postgres `42P01`, or PostgREST `PGRST205`
+ * (the table is not in the schema cache). This is the case before migration 012 is applied.
+ */
+export function isMissingTable(error: unknown): boolean {
+  const code = (error as { code?: string } | null)?.code
+  return code === '42P01' || code === 'PGRST205'
+}
+
+/** Warns one time for each process that the table is missing. A save never fails for a backup. */
+function warnMissingTable(): void {
+  if (warned) {
+    return
+  }
+  warned = true
+  console.warn(
+    '[content-backups] The table pluto_content_backups does not exist. Apply migration 012 from /admin/migrations to keep server copies of unsaved changes.'
+  )
+}
+
+/** Resets the one-warning flag. For tests. */
+export function resetMissingTableWarning(): void {
+  warned = false
+}
+
+/** The id of the signed-in user, or `null`. */
+async function userIdOf(event: H3Event): Promise<string | null> {
+  const user = (await serverSupabaseUser(event)) as {
+    sub?: string
+    id?: string
+  } | null
+  return user?.sub ?? user?.id ?? null
+}
+
+/** The ISO time of the oldest row that is still valid. */
+function expiryOf(now: number): string {
+  return new Date(now - BACKUP_TTL_DAYS * DAY_MS).toISOString()
+}
+
+/**
+ * The copy of the caller for one item, or `null`. It first deletes the expired copies of the
+ * caller. With no user, or before 012 is applied, it answers `null`.
+ */
+export async function getBackup(
+  ctx: PlutoContentContext,
+  client: SupabaseClient,
+  key: string
+): Promise<PlutoContentBackup | null> {
+  const userId = await userIdOf(ctx.event)
+  if (!userId) {
+    return null
+  }
+  try {
+    const { error: expiredError } = await client
+      .from(BACKUPS_TABLE)
+      .delete()
+      .eq('user_id', userId)
+      .lt('updated_at', expiryOf(Date.now()))
+    if (expiredError) {
+      throw expiredError
+    }
+    const { data, error } = await client
+      .from(BACKUPS_TABLE)
+      .select('record')
+      .eq('user_id', userId)
+      .eq('type', ctx.type.name)
+      .eq('item_key', key)
+      .maybeSingle()
+    if (error) {
+      throw error
+    }
+    return (data as { record?: PlutoContentBackup } | null)?.record ?? null
+  } catch (error) {
+    if (isMissingTable(error)) {
+      warnMissingTable()
+      return null
+    }
+    throw error
+  }
+}
+
+/**
+ * Replaces the copy of the caller for one item, then deletes the expired copies and the copies
+ * above `MAX_BACKUPS_PER_USER`. `otherDevice` is true when the replaced copy had another `device`
+ * and a recent `updated_at`. With no user, or before 012 is applied, it does nothing.
+ */
+export async function putBackup(
+  ctx: PlutoContentContext,
+  client: SupabaseClient,
+  key: string,
+  record: PlutoContentBackup
+): Promise<{ otherDevice: boolean }> {
+  const userId = await userIdOf(ctx.event)
+  if (!userId) {
+    return { otherDevice: false }
+  }
+  try {
+    const { data: current, error: currentError } = await client
+      .from(BACKUPS_TABLE)
+      .select('device, updated_at')
+      .eq('user_id', userId)
+      .eq('type', ctx.type.name)
+      .eq('item_key', key)
+      .maybeSingle()
+    if (currentError) {
+      throw currentError
+    }
+    const now = Date.now()
+    const replaced = current as { device?: string; updated_at?: string } | null
+    const otherDevice =
+      Boolean(replaced) &&
+      replaced!.device !== record.device &&
+      now - new Date(replaced!.updated_at ?? 0).getTime() <=
+        OTHER_DEVICE_WINDOW_MS
+
+    const { error } = await client.from(BACKUPS_TABLE).upsert(
+      {
+        user_id: userId,
+        type: ctx.type.name,
+        item_key: key,
+        device: record.device,
+        saved_at: new Date(record.savedAt).toISOString(),
+        updated_at: new Date(now).toISOString(),
+        record,
+      },
+      { onConflict: 'user_id,type,item_key' }
+    )
+    if (error) {
+      throw error
+    }
+
+    // The cleanup is best effort: a failure here must not fail the write.
+    const { error: expiredError } = await client
+      .from(BACKUPS_TABLE)
+      .delete()
+      .eq('user_id', userId)
+      .lt('updated_at', expiryOf(now))
+    if (expiredError) {
+      console.warn(
+        `[content-backups] Could not delete the expired copies: ${expiredError.message}`
+      )
+    }
+    const { data: old, error: oldError } = await client
+      .from(BACKUPS_TABLE)
+      .select('id')
+      .eq('user_id', userId)
+      .order('updated_at', { ascending: false })
+      .range(MAX_BACKUPS_PER_USER, MAX_BACKUPS_PER_USER + PRUNE_BATCH - 1)
+    if (oldError) {
+      console.warn(
+        `[content-backups] Could not list the old copies: ${oldError.message}`
+      )
+    } else {
+      const ids = (old ?? []).map((row: { id: number }) => row.id)
+      if (ids.length > 0) {
+        await client.from(BACKUPS_TABLE).delete().in('id', ids)
+      }
+    }
+    return { otherDevice }
+  } catch (error) {
+    if (isMissingTable(error)) {
+      warnMissingTable()
+      return { otherDevice: false }
+    }
+    throw error
+  }
+}
+
+/** Deletes the copy of the caller for one item. With no user, or before 012, it does nothing. */
+export async function removeBackup(
+  ctx: PlutoContentContext,
+  client: SupabaseClient,
+  key: string
+): Promise<void> {
+  const userId = await userIdOf(ctx.event)
+  if (!userId) {
+    return
+  }
+  const { error } = await client
+    .from(BACKUPS_TABLE)
+    .delete()
+    .eq('user_id', userId)
+    .eq('type', ctx.type.name)
+    .eq('item_key', key)
+  if (error) {
+    if (isMissingTable(error)) {
+      warnMissingTable()
+      return
+    }
+    throw error
+  }
+}