@plutocms/supabase 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [0.4.0](https://github.com/plutocms/supabase/compare/v0.3.0...v0.4.0) (2026-09-11)
+
+
+### Features
+
+* **migrations:** harden SQL splitter and add a versioned ledger shape ([#45](https://github.com/plutocms/supabase/issues/45)) ([f6e54a6](https://github.com/plutocms/supabase/commit/f6e54a6d87ae12c197e467c6d271793ce0ae4b7f))
+* **migrations:** versioned per-file migration engine ([#46](https://github.com/plutocms/supabase/issues/46)) ([2e39d12](https://github.com/plutocms/supabase/commit/2e39d1255ada616ae55894bc2d363eb710d1a8dd))
+
+
+### Bug Fixes
+
+* close setup-wizard RCE, signup privilege escalation, and unguarded admin routes ([#43](https://github.com/plutocms/supabase/issues/43)) ([81c3c7e](https://github.com/plutocms/supabase/commit/81c3c7eb7c2dfa80b426d91d0330176298316be4))
+* **deps:** move @nuxt/eslint to dependencies ([#42](https://github.com/plutocms/supabase/issues/42)) ([11e5b1e](https://github.com/plutocms/supabase/commit/11e5b1eac80436af85a70252d25e22bda8bc3be2))
+* **navbar:** hide admin navbar on public auth pages ([f9b2a9e](https://github.com/plutocms/supabase/commit/f9b2a9e8db7c83f89c842565e359f794fb700143))
+* **types:** drop media.product_id from the committed type snapshot ([#44](https://github.com/plutocms/supabase/issues/44)) ([6b21506](https://github.com/plutocms/supabase/commit/6b215064c4f8538af097b71b4b5f1567de1d585e))
+
 ## [0.3.0](https://github.com/plutocms/supabase/compare/v0.2.2...v0.3.0) (2026-09-10)
 
 

package/FEATURES.md

@@ -6,5 +6,5 @@ with full detail, so this file stays short.
 See the workspace-level `CLAUDE.md` (one directory up) for the delegation, writing, and git
 policies shared by every project here.
 
-- Layer migrations: apply pending layer database migrations from the admin UI, after initial
-  setup. @.claude/skills/layer-migrations/SKILL.md
+- Layer migrations: apply pending, versioned, per-file database migrations from the admin UI,
+  after initial setup. @.claude/skills/layer-migrations/SKILL.md

package/app/components/navbar/NavbarAdminProvider.vue

@@ -3,6 +3,10 @@ const route = useRoute()
 const session = useSupabaseSession()
 
 const shouldShowNavbar = computed(() => {
+  if (allowedUnauthenticatedPaths.includes(route.path)) {
+    return false
+  }
+
   return route.path === '/admin'
     || route.path.startsWith('/admin/')
     || Boolean(session.value)

package/app/composables/auth.ts

@@ -16,6 +16,17 @@ interface PlutoUserMetadata {
   [key: string]: unknown
 }
 
+// Admin paths that a signed-out visitor may load. Keep this list in sync
+// with every public `/admin/*` page.
+export const allowedUnauthenticatedPaths: RouteLocationRaw[] = [
+  '/admin/login',
+  '/admin/signup',
+  '/admin/confirm',
+  '/admin/setup',
+  '/admin/forgot-password',
+  '/admin/update-password',
+]
+
 export async function useAuth(authOptions?: PlutoSupabaseAuthOptions) {
   const toast = useToast()
 
@@ -50,15 +61,6 @@ export async function useAuth(authOptions?: PlutoSupabaseAuthOptions) {
   const isLoggedIn = computed<boolean>(() => !!supabaseSession.value)
   const isSubmitting = ref<boolean>(false)
 
-  const allowedUnauthenticatedPaths: RouteLocationRaw[] = [
-    '/admin/login',
-    '/admin/signup',
-    '/admin/confirm',
-    '/admin/setup',
-    '/admin/forgot-password',
-    '/admin/update-password',
-  ]
-
   interface LoginForm {
     email: string
     password: string

package/app/composables/migrations.ts

@@ -1,13 +1,23 @@
-export interface LayerMigrationResult {
+export interface MigrationFileResult {
   layerName: string
+  migrationName: string
   status: 'applied' | 'skipped' | 'failed'
   error?: string
 }
 
+export interface LayerStatus {
+  layerName: string
+  applied: string[]
+  pending: string[]
+}
+
 interface MigrationsStatusResponse {
   success: boolean
+  layers: LayerStatus[]
   pending: string[]
   applied: string[]
+  discovered: string[]
+  pendingFileCount: number
   hasConnection: boolean
   needsConnectionString: boolean
 }
@@ -15,13 +25,14 @@ interface MigrationsStatusResponse {
 interface RunMigrationsResponse {
   success: boolean
   needsConnectionString?: boolean
-  results?: LayerMigrationResult[]
+  results?: MigrationFileResult[]
   persisted?: boolean
   message?: string
+  error?: string
 }
 
 /**
- * Reads and applies pending layer migrations, for admin-only pages and the
+ * Reads and applies pending migrations, for admin-only pages and the
  * admin-shell banner.
  *
  * `useFetch` keys the request as `pluto-migrations-status`, so every
@@ -51,6 +62,8 @@ export function useMigrations() {
     return data.value ?? null
   })
 
+  // Layer-level count — a layer with any pending file counts once here.
+  // See `status.pendingFileCount` for the per-file count.
   const pendingCount = computed(() => status.value?.pending.length ?? 0)
 
   async function runMigrations(connectionString?: string) {

package/app/pages/admin/migrations.vue

@@ -15,6 +15,15 @@ const { status, fetchStatus, pendingCount, refresh, runMigrations } =
 
 const isDev = import.meta.dev
 
+// Only the layers that actually have a pending, or applied, file — used to
+// render per-file detail under each layer below.
+const pendingLayers = computed(
+  () => status.value?.layers.filter((layer) => layer.pending.length > 0) ?? []
+)
+const appliedLayers = computed(
+  () => status.value?.layers.filter((layer) => layer.applied.length > 0) ?? []
+)
+
 const connectionForm = ref({
   connectionString: '',
   password: '',
@@ -175,9 +184,14 @@ async function applyMigrations(useForm: boolean) {
             <h2 class="font-semibold">
               Pending layers ({{ status.pending.length }})
             </h2>
-            <ul class="list-inside list-disc text-sm">
-              <li v-for="layer in status.pending" :key="layer">
-                {{ layer }}
+            <ul class="flex flex-col gap-y-2 text-sm">
+              <li v-for="layer in pendingLayers" :key="layer.layerName">
+                <span class="font-mono">{{ layer.layerName }}</span>
+                <ul class="list-inside list-disc pl-4">
+                  <li v-for="fileName in layer.pending" :key="fileName">
+                    {{ fileName }}
+                  </li>
+                </ul>
               </li>
             </ul>
           </div>
@@ -186,9 +200,14 @@ async function applyMigrations(useForm: boolean) {
             <h2 class="font-semibold">
               Applied layers ({{ status.applied.length }})
             </h2>
-            <ul class="list-inside list-disc text-sm">
-              <li v-for="layer in status.applied" :key="layer">
-                {{ layer }}
+            <ul class="flex flex-col gap-y-2 text-sm">
+              <li v-for="layer in appliedLayers" :key="layer.layerName">
+                <span class="font-mono">{{ layer.layerName }}</span>
+                <ul class="list-inside list-disc pl-4">
+                  <li v-for="fileName in layer.applied" :key="fileName">
+                    {{ fileName }}
+                  </li>
+                </ul>
               </li>
             </ul>
           </div>
@@ -305,8 +324,13 @@ async function applyMigrations(useForm: boolean) {
             v-if="lastRun.results?.length"
             class="flex flex-col gap-y-1 text-sm"
           >
-            <li v-for="result in lastRun.results" :key="result.layerName">
-              <span class="font-mono">{{ result.layerName }}</span>
+            <li
+              v-for="result in lastRun.results"
+              :key="`${result.layerName}/${result.migrationName}`"
+            >
+              <span class="font-mono"
+              >{{ result.layerName }}/{{ result.migrationName }}</span
+              >
               — {{ result.status }}
               <span v-if="result.error" class="text-error">
                 : {{ result.error }}</span

package/app/pages/admin/setup.vue

@@ -120,7 +120,6 @@ async function completeDatabaseSetup() {
     const data = await $fetch<any>('/api/setup/create', {
       method: 'POST',
       body: {
-        baseUrl: window.location.origin,
         connectionString,
       },
     })
@@ -323,11 +322,11 @@ function handleStepChange(step: number) {
                                 Supabase database and run the SQL queries from
                                 this
                                 <ULink
-                                  to="https://github.com/plutocms/supabase/blob/feat/setup-wizard/public/schema.sql"
+                                  to="https://github.com/plutocms/supabase/tree/main/db/migrations"
                                   target="_blank"
                                   class="underline"
                                 >
-                                  SQL file</ULink
+                                  SQL files</ULink
                                 >.
                               </p>
 

package/db/migrations/002_admin_hardening.sql

@@ -0,0 +1,107 @@
+-- Admin hardening
+--
+-- Gates the writes that were previously open to any authenticated user
+-- behind a real admin check, and closes a client-controlled admin
+-- self-grant on signup. Standalone and self-sufficient: it does not
+-- depend on running as a diff against 001_baseline.sql, only on that
+-- file's tables (public.profiles, public.settings, public.healthcheck)
+-- already existing.
+
+-- Returns true when the calling user's own profile has is_admin = true.
+-- SECURITY DEFINER so this lookup runs with the function owner's
+-- privileges rather than the caller's — RLS policies call this to decide
+-- whether to grant a *wider* read/write than a user's own row would
+-- otherwise get, so the check itself must not be subject to those same
+-- policies.
+create or replace function public.is_admin()
+returns boolean
+language sql
+security definer
+set search_path = ''
+stable
+as $$
+  select coalesce(
+    (select is_admin from public.profiles where id = auth.uid()),
+    false
+  );
+$$;
+
+-- A user can always read their own profile; only admins can read
+-- everyone's. Previously any authenticated user could read every row
+-- (including every user's email) — this was the actual reason `is_admin`
+-- existed on the table but no policy referenced it.
+drop policy if exists "Enable read access for authenticated users" on public.profiles;
+
+create policy "Enable read access for authenticated users"
+on public.profiles
+for select
+to authenticated, dashboard_user
+using (auth.uid() = id or public.is_admin());
+
+-- Previously any authenticated user (not just an admin) could insert or
+-- update settings — see server/api/settings/update.post.ts, which also
+-- now requires an admin session.
+drop policy if exists "Enable insert for authenticated users only" on public.settings;
+
+create policy "Enable insert for authenticated users only"
+on public.settings
+for insert
+to authenticated, dashboard_user
+with check (public.is_admin());
+
+drop policy if exists "Enable update for authenticated users on settings" on public.settings;
+
+create policy "Enable update for authenticated users on settings"
+on public.settings
+for update
+to authenticated, dashboard_user
+using (public.is_admin())
+with check (public.is_admin());
+
+-- Previously any authenticated user (not just an admin) could flip
+-- first_setup back to 'true', which would re-open the unauthenticated
+-- setup wizard for every visitor.
+drop policy if exists "Enable update for authenticated users on healthcheck" on public.healthcheck;
+
+create policy "Enable update for authenticated users on healthcheck"
+on public.healthcheck
+for update
+to authenticated, dashboard_user
+using (public.is_admin())
+with check (public.is_admin());
+
+--- inserts a row into public.profiles
+--- automatically grants admin to the first user if no profiles exist yet
+create or replace function public.handle_new_user()
+returns trigger
+language plpgsql
+security definer set search_path = ''
+as $$
+declare
+  profile_count int;
+  should_be_admin boolean;
+begin
+  select count(*) into profile_count from public.profiles;
+
+  -- Only the very first account is auto-promoted. Never trust
+  -- raw_user_meta_data for this: it is fully client-controlled — anyone can
+  -- pass an arbitrary `options.data` straight to Supabase's own
+  -- /auth/v1/signup endpoint, bypassing this project's own /api/auth/signup
+  -- route entirely — so honoring an `is_admin` key there let any new
+  -- signup grant itself admin.
+  should_be_admin := profile_count = 0;
+
+  insert into public.profiles (id, email, username, display_name, is_admin)
+  values (
+    new.id,
+    new.email,
+    new.raw_user_meta_data ->> 'username',
+    new.raw_user_meta_data ->> 'display_name',
+    should_be_admin
+  );
+  return new;
+end;
+$$;
+-- Not re-created here: on_auth_user_created (from 001_baseline.sql)
+-- already points at public.handle_new_user() by name, and
+-- `create or replace function` above is enough to update its behavior.

package/modules/pluto-migrations.ts

@@ -1,11 +1,87 @@
+import type { PlutoMigrationFile } from '../shared/types/migrations'
+import { createHash } from 'node:crypto'
 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
-import { dirname, join, relative } from 'node:path'
+import { basename, dirname, join, relative } from 'node:path'
 import { createResolver, defineNuxtModule, getLayerDirectories } from 'nuxt/kit'
 
+const schemaPattern = /^schema\.(.+)\.sql$/
+const noTransactionPattern = /^--\s*pluto:no-transaction\b/
+
+/**
+ * Plain, deliberate string comparator for migration file names — ASCII
+ * lexicographic order, so `001_...` sorts before `002_...` and so on.
+ * Written out instead of relying on `Array.prototype.sort()`'s default
+ * (which happens to do the same thing for ASCII names, but isn't a
+ * documented guarantee to depend on).
+ */
+function compareFileNames(a: string, b: string): number {
+  if (a < b) {
+    return -1
+  }
+  if (a > b) {
+    return 1
+  }
+  return 0
+}
+
+/**
+ * Derives a layer's key from its `package.json` `name` field, stripping
+ * any `@scope/` prefix. `@plutocms/supabase` always maps to the literal
+ * key `core` — every deployed site's ledger already has rows with
+ * `layer_name = 'core'`. Falls back to the layer directory's own name
+ * when `package.json` is missing or unreadable.
+ */
+function deriveLayerKey(layerRoot: string): string {
+  try {
+    const pkgRaw = readFileSync(join(layerRoot, 'package.json'), 'utf-8')
+    const pkg = JSON.parse(pkgRaw) as { name?: string }
+
+    if (typeof pkg.name === 'string' && pkg.name.length > 0) {
+      if (pkg.name === '@plutocms/supabase') {
+        return 'core'
+      }
+      return pkg.name.replace(/^@[^/]+\//, '')
+    }
+  } catch {
+    // package.json missing or unreadable — fall back to the directory name.
+  }
+
+  return basename(layerRoot)
+}
+
+function computeChecksum(content: string): string {
+  return createHash('sha256').update(content, 'utf-8').digest('hex').slice(0, 16)
+}
+
 /**
- * Discovers schema.[layerName].sql files across all Nuxt layers,
- * reads their content at build time, and populates runtimeConfig
- * so the migrations plugin can run them at server startup.
+ * True when the file's first non-blank line is a `-- pluto:no-transaction`
+ * directive.
+ */
+function detectNoTransaction(content: string): boolean {
+  const firstNonBlankLine = content
+    .split('\n')
+    .map((line) => line.trim())
+    .find((line) => line.length > 0)
+
+  return firstNonBlankLine ? noTransactionPattern.test(firstNonBlankLine) : false
+}
+
+function readMigrationFile(dir: string, fileName: string, name: string): PlutoMigrationFile {
+  const content = readFileSync(join(dir, fileName), 'utf-8')
+
+  return {
+    name,
+    sql: content,
+    checksum: computeChecksum(content),
+    noTransaction: detectNoTransaction(content),
+  }
+}
+
+/**
+ * Discovers `db/migrations/*.sql` (or, for a layer not yet converted, the
+ * legacy `public/schema.sql` / `public/schema.[name].sql`) across all Nuxt
+ * layers, reads their content at build time, and populates runtimeConfig
+ * so the migrations engine can apply them at server startup.
  *
  * Also seeds the consuming app's shared/types/supabase.ts with a
  * re-export of this layer's own committed snapshot when the consumer
@@ -59,62 +135,121 @@ export default defineNuxtModule({
     }
 
     const layerDirs = getLayerDirectories()
-    const layerSchemas: Record<string, string> = {}
-    const schemaPattern = /^schema\.(.+)\.sql$/
+    const layerMigrations: Record<string, PlutoMigrationFile[]> = {}
+
+    // Keeps the first-discovered layer for a given key (getLayerDirectories
+    // orders the user/project layer first), and warns once when a later
+    // layer's key collides with one already discovered.
+    function assignLayer(layerKey: string, files: PlutoMigrationFile[]): void {
+      if (layerMigrations[layerKey]) {
+        console.warn(
+          `[pluto-migrations] Layer key "${layerKey}" was already discovered from another layer. Keeping the first one, ignoring this one.`
+        )
+        return
+      }
+      layerMigrations[layerKey] = files
+    }
 
     for (const layer of layerDirs) {
-      // Each layer may have a public/ directory with schema files
+      const migrationsDir = join(layer.root, 'db/migrations')
+
+      if (existsSync(migrationsDir)) {
+        let fileNames: string[] = []
+        try {
+          fileNames = readdirSync(migrationsDir).filter((file) =>
+            file.endsWith('.sql')
+          )
+        } catch {
+          console.error(
+            `[pluto-migrations] Failed to read migrations directory: ${migrationsDir}`
+          )
+          continue
+        }
+
+        fileNames.sort(compareFileNames)
+
+        const files: PlutoMigrationFile[] = []
+        for (const fileName of fileNames) {
+          try {
+            files.push(readMigrationFile(migrationsDir, fileName, fileName))
+          } catch {
+            console.error(
+              `[pluto-migrations] Failed to read migration file: ${fileName}`
+            )
+          }
+        }
+
+        assignLayer(deriveLayerKey(layer.root), files)
+        continue
+      }
+
+      // Legacy fallback for a layer not yet converted to db/migrations/,
+      // exactly as before: a single public/schema.sql (always key `core`)
+      // and/or public/schema.[name].sql (key comes from the file name, not
+      // package.json — this keeps working for an unconverted layer without
+      // requiring it to match its package name).
       const publicDir = join(layer.root, 'public')
 
       if (!existsSync(publicDir)) {
         continue
       }
 
-      let files: string[] = []
+      let publicFiles: string[] = []
       try {
-        files = readdirSync(publicDir, 'utf-8')
+        publicFiles = readdirSync(publicDir)
       } catch {
         continue
       }
 
-      for (const file of files) {
-        // Skip the core schema
-        if (file === 'schema.sql') {
+      for (const fileName of publicFiles) {
+        if (fileName === 'schema.sql') {
+          try {
+            assignLayer('core', [
+              readMigrationFile(publicDir, fileName, '001_baseline.sql'),
+            ])
+          } catch {
+            console.error(
+              `[pluto-migrations] Failed to read schema file: ${fileName}`
+            )
+          }
           continue
         }
 
-        const match = file.match(schemaPattern)
+        const match = fileName.match(schemaPattern)
         if (match?.[1]) {
-          const layerName = match[1]
-          // Read SQL content at build time
           try {
-            layerSchemas[layerName] = readFileSync(
-              join(publicDir, file),
-              'utf-8'
-            )
+            assignLayer(match[1], [
+              readMigrationFile(publicDir, fileName, '001_baseline.sql'),
+            ])
           } catch {
             console.error(
-              `[pluto-migrations] Failed to read schema file: ${file}`
+              `[pluto-migrations] Failed to read schema file: ${fileName}`
             )
           }
         }
       }
     }
 
-    const layerNames = Object.keys(layerSchemas)
-
-    // Populate runtimeConfig with layer names and their SQL content.
+    // Populate runtimeConfig with every layer's ordered migration files.
     // Nuxt's schema inference narrows this to a literal shape based on
-    // whatever layer keys were last observed in this project (see the
-    // `RuntimeConfig` augmentation in shared/types/runtime-config.d.ts,
-    // which isn't visible from this module-context tsconfig), so the
-    // assignment is cast to the intended general shape.
-    ;(nuxt.options.runtimeConfig as { plutoLayerSchemas: Record<string, string> }).plutoLayerSchemas =
-      layerSchemas
-
-    if (layerNames.length > 0) {
+    // whatever layer keys and file shapes happen to be discovered in a
+    // given project (see the `RuntimeConfig` augmentation in
+    // shared/types/runtime-config.d.ts, which isn't visible from this
+    // module-context tsconfig), so the assignment is cast to the intended
+    // general shape. That inferred shape's array elements don't carry
+    // enough structure for a direct cast, hence the `unknown` step.
+    ;(
+      nuxt.options.runtimeConfig as unknown as {
+        plutoLayerMigrations: Record<string, PlutoMigrationFile[]>
+      }
+    ).plutoLayerMigrations = layerMigrations
+
+    const layerKeys = Object.keys(layerMigrations)
+    if (layerKeys.length > 0) {
       console.warn(
-        `[pluto-migrations] Discovered layer schemas: ${layerNames.join(', ')}`
+        `[pluto-migrations] Discovered layer migrations: ${layerKeys
+          .map((key) => `${key} (${layerMigrations[key]!.length} file(s))`)
+          .join(', ')}`
       )
     }
   },

package/nuxt.config.ts

@@ -1,3 +1,5 @@
+import type { PlutoMigrationFile } from './shared/types/migrations'
+
 // Point these at a local checkout (e.g. `../pluto`, `../utils`) to test
 // unpublished changes; unset, they resolve to the published npm packages.
 const plutoLayer = process.env.PLUTO_PLUTO_PATH || '@plutocms/pluto'
@@ -18,7 +20,7 @@ export default defineNuxtConfig({
     supabaseUrl: process.env.SUPABASE_URL,
     supabaseKey: process.env.SUPABASE_KEY,
     plutoRootDir: '',
-    plutoLayerSchemas: {} as Record<string, string>,
+    plutoLayerMigrations: {} as Record<string, PlutoMigrationFile[]>,
   },
 
   alias: {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@plutocms/supabase",
   "type": "module",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "trustedDependencies": [
     "@parcel/watcher",
     "@plutocms/pluto",
@@ -36,6 +36,7 @@
     "supabase-types": "bun ./scripts/supabase-typegen.ts"
   },
   "dependencies": {
+    "@nuxt/eslint": "^1.16.0",
     "@nuxt/ui": "^4.9.0",
     "@nuxtjs/supabase": "^2.0.9",
     "@plutocms/pluto": "^0.3.2",
@@ -46,7 +47,6 @@
   },
   "devDependencies": {
     "@antfu/eslint-config": "^6.2.0",
-    "@nuxt/eslint": "^1.16.0",
     "@types/bun": "^1.3.14",
     "@vueuse/nuxt": "^14.3.0",
     "eslint": "^10.6.0",