@plutocms/supabase 0.3.0 → 0.4.1

package/server/api/migrations/run.post.ts

@@ -1,7 +1,8 @@
+import type { PlutoMigrationFile } from '../../../shared/types/migrations'
+import type { MigrationFileResult } from '../../utils/migrations'
 import { requireAdmin } from '../../utils/admin-guard'
 import { persistDatabaseUrl } from '../../utils/env-file'
-import { runLayerMigration } from '../../utils/migrations'
-import { getMigrationStatus } from '../../utils/pending-migrations'
+import { resolveConnectionString, runPendingMigrations } from '../../utils/migrations'
 import { scrubConnectionString } from '../../utils/scrub-connection-string'
 import { regenerateSupabaseTypes } from '../../utils/typegen'
 
@@ -9,12 +10,6 @@ interface Payload {
   connectionString?: string
 }
 
-interface LayerResult {
-  layerName: string
-  status: 'applied' | 'skipped' | 'failed'
-  error?: string
-}
-
 export default defineEventHandler(async (event) => {
   await requireAdmin(event)
 
@@ -23,12 +18,10 @@ export default defineEventHandler(async (event) => {
   // Connection string precedence: an already-configured DATABASE_URL always
   // wins, and a body-supplied string is ignored completely in that case.
   // This is the whole security model for this endpoint — without it, any
-  // admin could point the server at an arbitrary database host.
-  const envConnectionString = process.env.DATABASE_URL
-  const bodyConnectionString = body?.connectionString
-  const usingBodyConnectionString = !envConnectionString
-
-  const connStr = envConnectionString || bodyConnectionString
+  // admin could point the server at an arbitrary database host. See
+  // resolveConnectionString for the full rule.
+  const { connStr, usingBody: usingBodyConnectionString } =
+    resolveConnectionString(body?.connectionString)
 
   if (!connStr) {
     return {
@@ -38,82 +31,71 @@ export default defineEventHandler(async (event) => {
   }
 
   const config = useRuntimeConfig()
-  const layerSchemas: Record<string, string> = config.plutoLayerSchemas ?? {}
-
-  const { pending } = await getMigrationStatus(event)
+  // Nuxt's schema inference narrows `plutoLayerMigrations` to whatever
+  // layer keys and file shapes it happened to observe at build time (see
+  // the `RuntimeConfig` augmentation in shared/types/runtime-config.d.ts),
+  // so the read is cast back to the intended general shape.
+  const layers = (config.plutoLayerMigrations ?? {}) as unknown as Record<
+    string,
+    PlutoMigrationFile[]
+  >
+
+  try {
+    const layerResults = await runPendingMigrations({
+      connectionString: connStr,
+      layers,
+    })
 
-  const results: LayerResult[] = []
-  let anyApplied = false
-  // Tracks whether we've already committed a body-supplied connection
-  // string to process.env for this request (done once, on first success).
-  let connStrCommitted = false
+    const results: MigrationFileResult[] = layerResults.flatMap(
+      (layer) => layer.results
+    )
 
-  for (const layerName of pending) {
-    const schemaSql = layerSchemas[layerName]
+    const anyApplied = results.some((result) => result.status === 'applied')
 
-    if (!schemaSql) {
-      continue
+    // Deliberate runtime mutation: a valid connection string just proved
+    // itself against the database, so make it available to
+    // getConnectionString() for the rest of this process life. No
+    // server restart is needed for later requests to pick it up.
+    if (usingBodyConnectionString) {
+      process.env.DATABASE_URL = connStr
     }
 
-    const result = await runLayerMigration({
-      layerName,
-      schemaSql,
-      connectionString: connStr,
-    })
+    // Nothing to persist when DATABASE_URL was already configured.
+    // Otherwise persist the now-proven body-supplied string.
+    let persisted = !usingBodyConnectionString
+    let message: string | undefined
 
-    if (result.success) {
-      results.push({
-        layerName,
-        status: result.skipped ? 'skipped' : 'applied',
-      })
+    if (usingBodyConnectionString) {
+      persisted = await persistDatabaseUrl(connStr)
 
-      if (!result.skipped) {
-        anyApplied = true
+      if (!persisted) {
+        message =
+          'Migrations were applied, but the connection string could not be ' +
+          'saved to .env. Add DATABASE_URL to .env by hand.'
       }
-
-      if (usingBodyConnectionString && !connStrCommitted) {
-        // Deliberate runtime mutation: a valid connection string just
-        // proved itself against the database, so make it available to
-        // getConnectionString() for the rest of this process life. No
-        // server restart is needed for later requests to pick it up.
-        process.env.DATABASE_URL = connStr
-        connStrCommitted = true
-      }
-    } else {
-      const message = scrubConnectionString(
-        result.error ?? 'Unknown migration error.',
-        connStr
-      )
-
-      console.error(`Migration failed [${layerName}]:`, message)
-
-      results.push({ layerName, status: 'failed', error: message })
     }
-  }
-
-  // Nothing to persist when DATABASE_URL was already configured. Otherwise
-  // only persist once a body-supplied string has proven itself valid.
-  let persisted = !usingBodyConnectionString
-  let message: string | undefined
 
-  if (usingBodyConnectionString && connStrCommitted) {
-    persisted = await persistDatabaseUrl(connStr)
+    if (import.meta.dev && anyApplied && config.plutoRootDir) {
+      await regenerateSupabaseTypes(config.plutoRootDir, connStr)
+    }
 
-    if (!persisted) {
-      message =
-        'Migrations were applied, but the connection string could not be ' +
-        'saved to .env. Add DATABASE_URL to .env by hand.'
+    return {
+      success: true as const,
+      results,
+      persisted,
+      message,
     }
-  }
+  } catch (error: any) {
+    const errorMessage = scrubConnectionString(
+      error?.message ?? 'Unknown migration error.',
+      connStr
+    )
 
-  if (import.meta.dev && anyApplied && config.plutoRootDir) {
-    await regenerateSupabaseTypes(config.plutoRootDir, connStr)
-  }
+    console.error('Error applying migrations:', errorMessage)
 
-  return {
-    success: true as const,
-    results,
-    persisted,
-    message,
+    return {
+      success: false as const,
+      error: errorMessage,
+    }
   }
 })

package/server/api/migrations/status.get.ts

@@ -4,13 +4,11 @@ import { getMigrationStatus } from '../../utils/pending-migrations'
 export default defineEventHandler(async (event) => {
   await requireAdmin(event)
 
-  const { pending, applied, hasConnection } = await getMigrationStatus(event)
+  const status = await getMigrationStatus(event)
 
   return {
     success: true as const,
-    pending,
-    applied,
-    hasConnection,
-    needsConnectionString: !hasConnection && pending.length > 0,
+    ...status,
+    needsConnectionString: !status.hasConnection && status.pendingFileCount > 0,
   }
 })

package/server/api/settings/update.post.ts

@@ -1,6 +1,18 @@
 import { serverSupabaseClient } from '#supabase/server'
+import { requireAdmin } from '../../utils/admin-guard'
+
+// Mirrors the TSettings enum in db/migrations/001_baseline.sql. The Postgres enum
+// already rejects an unknown key at the DB level (as a raw constraint
+// error) — this turns that into a clean 400 instead.
+const KNOWN_SETTING_KEYS = [
+  'website_title',
+  'website_url',
+  'website_description',
+] as const
 
 export default defineEventHandler(async (event) => {
+  await requireAdmin(event)
+
   type SettingName =
     Database['public']['Tables']['settings']['Insert']['setting_name']
   type FormBody = Record<SettingName, string>
@@ -8,16 +20,32 @@ export default defineEventHandler(async (event) => {
   const client = await serverSupabaseClient<Database>(event)
   const body = await readBody<FormBody>(event)
 
-  if (!body) {
-    throw createError({ statusMessage: 'No payload sent.' })
+  if (!body || typeof body !== 'object') {
+    throw createError({ statusCode: 400, statusMessage: 'No payload sent.' })
   }
 
-  const transformed = [
-    ...Object.entries(body).map(([key, value]) => ({
+  const transformed = Object.entries(body).map(([key, value]) => {
+    if (
+      !KNOWN_SETTING_KEYS.includes(key as (typeof KNOWN_SETTING_KEYS)[number])
+    ) {
+      throw createError({
+        statusCode: 400,
+        statusMessage: `Unknown setting: ${key}`,
+      })
+    }
+
+    if (typeof value !== 'string') {
+      throw createError({
+        statusCode: 400,
+        statusMessage: `Setting "${key}" must be a string.`,
+      })
+    }
+
+    return {
       setting_name: key as SettingName,
       setting_value: value,
-    })),
-  ]
+    }
+  })
 
   const { data, error } = await client
     .from('settings')

package/server/api/setup/create.post.ts

@@ -1,29 +1,51 @@
+import type { PlutoMigrationFile } from '../../../shared/types/migrations'
 import postgres from 'postgres'
 import { persistDatabaseUrl } from '../../utils/env-file'
-import { runLayerMigration } from '../../utils/migrations'
+import { runPendingMigrations } from '../../utils/migrations'
 import { scrubConnectionString } from '../../utils/scrub-connection-string'
-import { splitStatements } from '../../utils/sql'
 
 interface Payload {
-  baseUrl: string
   connectionString: string
 }
 
-interface LayerResult {
-  layerName: string
-  status: 'applied' | 'skipped' | 'failed'
-  error?: string
-}
-
 export default defineEventHandler(async (event) => {
-  const body = await readBody<Payload>(event)
+  // An already-configured DATABASE_URL means setup has already completed.
+  // This route is reachable with no admin session — no admin can exist
+  // before setup creates the profiles table — so once real setup has run,
+  // this check is the only thing stopping anyone from re-running it against
+  // an arbitrary database. Mirrors the same precedence rule in
+  // server/api/migrations/run.post.ts, which calls it "the whole security
+  // model for this endpoint."
+  if (process.env.DATABASE_URL) {
+    throw createError({
+      statusCode: 403,
+      statusMessage: 'Setup has already been completed.',
+    })
+  }
 
-  let schema = await $fetch<string | Blob>('/schema.sql', {
-    baseURL: body.baseUrl,
-  })
+  const body = await readBody<Payload>(event)
 
-  if (typeof schema !== 'string') {
-    schema = await schema.text()
+  const config = useRuntimeConfig()
+  // Nuxt's schema inference narrows `plutoLayerMigrations` to whatever
+  // layer keys and file shapes it happened to observe at build time (see
+  // the `RuntimeConfig` augmentation in shared/types/runtime-config.d.ts),
+  // so the read is cast back to the intended general shape.
+  const layers = (config.plutoLayerMigrations ?? {}) as unknown as Record<
+    string,
+    PlutoMigrationFile[]
+  >
+
+  // The core layer's migrations are discovered and embedded at build time
+  // by the pluto-migrations module, exactly like every other layer — see
+  // modules/pluto-migrations.ts. Reading it from there instead of fetching
+  // it over HTTP means this route needs no `baseUrl` from the caller, and
+  // can no longer be made to fetch or execute SQL from an arbitrary origin.
+  if (!layers.core?.length) {
+    throw createError({
+      statusCode: 500,
+      statusMessage:
+        'Core schema not found. Reinstall @plutocms/supabase and restart the dev server.',
+    })
   }
 
   const supabaseUrl = process.env.SUPABASE_URL
@@ -37,63 +59,30 @@ export default defineEventHandler(async (event) => {
 
   const connectionString = body.connectionString
 
-  const sql = postgres(connectionString)
-
   try {
-    const statements = splitStatements(schema)
-
-    for (const statement of statements) {
-      await sql.unsafe(statement)
-    }
-
-    // Mark first_setup as complete
-    await sql.unsafe(
-      `UPDATE public.healthcheck SET config_value = 'false' WHERE config_name = 'first_setup'`
-    )
-
-    // Record the core schema migration
-    await sql.unsafe(
-      `INSERT INTO public.pluto_migrations (layer_name)
-       VALUES ('core')
-       ON CONFLICT (layer_name) DO NOTHING`
-    )
-
-    // Apply every extra layer's schema too. The core schema must run first
-    // (a layer schema may depend on a core object), so this loop stays
-    // after the core-schema block above. A single failing layer must not
-    // fail the whole wizard — the core schema already succeeded and
-    // first_setup is already 'false', so this loop reports per-layer
-    // failures instead of throwing.
-    const config = useRuntimeConfig()
-    const layerSchemas: Record<string, string> = config.plutoLayerSchemas ?? {}
-
-    const layers: LayerResult[] = []
-
-    for (const [layerName, schemaSql] of Object.entries(layerSchemas)) {
-      if (!schemaSql) {
-        continue
-      }
-
-      const result = await runLayerMigration({
-        layerName,
-        schemaSql,
-        connectionString,
-      })
-
-      if (result.success) {
-        layers.push({
-          layerName,
-          status: result.skipped ? 'skipped' : 'applied',
-        })
-      } else {
-        const message = scrubConnectionString(
-          result.error ?? 'Unknown migration error.',
-          connectionString
+    // core must apply before every other layer — a layer's migrations may
+    // reference core objects (public.profiles, public.is_admin()).
+    // runPendingMigrations guarantees this ordering itself.
+    const layerResults = await runPendingMigrations({
+      connectionString,
+      layers,
+    })
+
+    const coreResult = layerResults.find((layer) => layer.layerName === 'core')
+
+    // Only mark first_setup complete once the core layer's own migrations
+    // are known good. A single failing extra layer must not block this —
+    // core already succeeded, so the wizard can still hand off to sign-up —
+    // but a failed core layer must not flip first_setup, since the base
+    // schema (profiles, healthcheck, and so on) may be incomplete.
+    if (coreResult && !coreResult.failed) {
+      const sql = postgres(connectionString, { max: 1 })
+      try {
+        await sql.unsafe(
+          `UPDATE public.healthcheck SET config_value = 'false' WHERE config_name = 'first_setup'`
         )
-
-        console.error(`Layer migration failed [${layerName}]:`, message)
-
-        layers.push({ layerName, status: 'failed', error: message })
+      } finally {
+        await sql.end()
       }
     }
 
@@ -103,13 +92,16 @@ export default defineEventHandler(async (event) => {
     // server restart needed.
     process.env.DATABASE_URL = connectionString
 
-    // Persist connection string to .env for future layer migrations
+    // Persist connection string to .env for future layer migrations. This
+    // must stay the very last thing this handler does — see "The
+    // dev-server restart on first save" in
+    // .claude/skills/layer-migrations/SKILL.md.
     const persisted = await persistDatabaseUrl(connectionString)
 
     return {
       success: true,
       message: 'Database setup completed successfully.',
-      layers,
+      layers: layerResults,
       persisted,
     }
   } catch (error: any) {
@@ -124,7 +116,5 @@ export default defineEventHandler(async (event) => {
       success: false,
       error: message,
     }
-  } finally {
-    sql.end()
   }
 })

package/server/api/users/[id].get.ts

@@ -1,6 +1,9 @@
 import { serverSupabaseClient } from '#supabase/server'
+import { requireAdmin } from '../../utils/admin-guard'
 
 export default defineEventHandler(async (event) => {
+  await requireAdmin(event)
+
   const client = await serverSupabaseClient<Database>(event)
 
   const id = event.context.params?.id as string

package/server/api/users/index.get.ts

@@ -1,6 +1,9 @@
 import { serverSupabaseClient } from '#supabase/server'
+import { requireAdmin } from '../../utils/admin-guard'
 
 export default defineEventHandler(async (event) => {
+  await requireAdmin(event)
+
   const client = await serverSupabaseClient<Database>(event)
 
   const { data: users, error } = await client.from('profiles').select('*')

package/server/plugins/migrations.ts

@@ -1,4 +1,5 @@
-import { runLayerMigration } from '../utils/migrations'
+import type { PlutoMigrationFile } from '../../shared/types/migrations'
+import { runPendingMigrations } from '../utils/migrations'
 import { regenerateSupabaseTypes } from '../utils/typegen'
 
 export default defineNitroPlugin(async () => {
@@ -8,52 +9,48 @@ export default defineNitroPlugin(async () => {
   }
 
   const config = useRuntimeConfig()
-  const layerSchemas: Record<string, string> = config.plutoLayerSchemas ?? {}
-
-  const layerNames = Object.keys(layerSchemas)
-
-  if (layerNames.length === 0) {
+  // Nuxt's schema inference narrows `plutoLayerMigrations` to whatever
+  // layer keys and file shapes it happened to observe at build time (see
+  // the `RuntimeConfig` augmentation in shared/types/runtime-config.d.ts),
+  // so the read is cast back to the intended general shape.
+  const layers = (config.plutoLayerMigrations ?? {}) as unknown as Record<
+    string,
+    PlutoMigrationFile[]
+  >
+
+  if (Object.keys(layers).length === 0) {
     return
   }
 
   let anyApplied = false
 
-  for (const layerName of layerNames) {
-    const schemaSql = layerSchemas[layerName]
-
-    if (!schemaSql) {
-      continue
-    }
-
-    try {
-      const result = await runLayerMigration({
-        layerName,
-        schemaSql,
-      })
-
-      if (result.skipped) {
-        console.warn(
-          `[migrations] Layer "${layerName}" already applied, skipped.`
-        )
-      } else if (result.success) {
-        console.warn(`[migrations] Layer "${layerName}" migrated successfully.`)
-        anyApplied = true
-      } else {
-        console.error(`[migrations] Layer "${layerName}" failed:`, result.error)
+  try {
+    const layerResults = await runPendingMigrations({
+      connectionString: process.env.DATABASE_URL,
+      layers,
+    })
+
+    for (const layer of layerResults) {
+      for (const result of layer.results) {
+        const label = `${result.layerName}/${result.migrationName}`
+
+        if (result.status === 'skipped') {
+          console.warn(`[migrations] ${label} already applied, skipped.`)
+        } else if (result.status === 'applied') {
+          console.warn(`[migrations] ${label} migrated successfully.`)
+          anyApplied = true
+        } else {
+          console.error(`[migrations] ${label} failed:`, result.error)
+        }
       }
-    } catch (error) {
-      console.error(
-        `[migrations] Error running migration for "${layerName}":`,
-        error
-      )
     }
+  } catch (error) {
+    console.error('[migrations] Error running pending migrations:', error)
   }
 
-  // Regenerate Database types from the live schema whenever a layer schema
-  // was newly applied, so `Database` stays in sync without a manual step.
-  // Re-editing an already-applied layer schema is a no-op here (it's
-  // recorded as `skipped`); use the `supabase-types` script to force a
-  // refresh in that case.
+  // Regenerate Database types from the live schema whenever a migration
+  // file was newly applied, so `Database` stays in sync without a manual
+  // step.
   if (import.meta.dev && anyApplied && config.plutoRootDir) {
     await regenerateSupabaseTypes(config.plutoRootDir)
   }

package/server/utils/ledger.ts

@@ -0,0 +1,124 @@
+import type postgres from 'postgres'
+import { splitStatements } from './sql'
+
+/**
+ * Cheap check for whether `public.pluto_migrations` is already in the
+ * target shape (has a `migration_name` column). Running this first, and
+ * skipping every DDL statement below when it already passes, avoids
+ * taking a DDL lock on the table on every server boot once a database has
+ * already been upgraded.
+ */
+const PROBE_SQL = `
+  select 1
+  from information_schema.columns
+  where table_schema = 'public'
+    and table_name = 'pluto_migrations'
+    and column_name = 'migration_name'
+`
+
+/**
+ * Brings `public.pluto_migrations` from either shape (none yet, or the old
+ * one-row-per-layer shape) to the versioned, per-migration shape:
+ *
+ * ```sql
+ * create table if not exists public.pluto_migrations (
+ *   id bigint generated by default as identity primary key,
+ *   layer_name text not null,
+ *   migration_name text not null,
+ *   checksum text,
+ *   applied_at timestamptz not null default now(),
+ *   constraint pluto_migrations_layer_migration_key unique (layer_name, migration_name)
+ * );
+ * ```
+ *
+ * The backfill below (`migration_name = '001_baseline.sql'` for a null
+ * row) is safe and correct because an old-shape row can only exist if the
+ * old engine ran a layer's single monolithic schema file — that file is,
+ * by construction, `001_baseline.sql` for every layer (see
+ * `db/migrations/001_baseline.sql` for `core`, and the equivalent file in
+ * every converted layer).
+ */
+export const ledgerDdl = `
+create table if not exists public.pluto_migrations (
+  id bigint generated by default as identity primary key,
+  layer_name text not null,
+  migration_name text not null,
+  checksum text,
+  applied_at timestamptz not null default now(),
+  constraint pluto_migrations_layer_migration_key unique (layer_name, migration_name)
+);
+
+alter table public.pluto_migrations add column if not exists migration_name text;
+
+alter table public.pluto_migrations add column if not exists checksum text;
+
+update public.pluto_migrations set migration_name = '001_baseline.sql' where migration_name is null;
+
+alter table public.pluto_migrations alter column migration_name set not null;
+
+alter table public.pluto_migrations drop constraint if exists pluto_migrations_layer_key;
+
+do $$
+begin
+  if not exists (
+    select 1 from pg_constraint
+     where conname = 'pluto_migrations_layer_migration_key'
+       and conrelid = 'public.pluto_migrations'::regclass
+  ) then
+    alter table public.pluto_migrations
+      add constraint pluto_migrations_layer_migration_key unique (layer_name, migration_name);
+  end if;
+end
+$$;
+
+alter table public.pluto_migrations enable row level security;
+
+do $$
+begin
+  if not exists (
+    select 1 from pg_policies where tablename = 'pluto_migrations' and policyname = 'Enable read access for authenticated users on pluto_migrations'
+  ) then
+    create policy "Enable read access for authenticated users on pluto_migrations"
+    on public.pluto_migrations
+    for select
+    to authenticated, dashboard_user
+    using (true);
+  end if;
+end
+$$;
+`
+
+async function runLedgerSteps(
+  tx: postgres.Sql | postgres.TransactionSql
+): Promise<void> {
+  const probe = await tx.unsafe(PROBE_SQL)
+
+  if (probe.length > 0) {
+    // Already in the target shape. Skip all DDL below.
+    return
+  }
+
+  for (const statement of splitStatements(ledgerDdl)) {
+    await tx.unsafe(statement)
+  }
+}
+
+/**
+ * Ensures `public.pluto_migrations` is in the versioned, per-migration
+ * shape, running every DDL step in one transaction.
+ *
+ * Accepts either a plain connection or a connection already inside a
+ * transaction. A plain connection (it has `.begin`) opens its own
+ * transaction here; a connection already inside a transaction runs the
+ * same steps directly, since the caller's transaction already wraps them.
+ */
+export async function ensureLedger(
+  sql: postgres.Sql | postgres.TransactionSql
+): Promise<void> {
+  if (typeof (sql as postgres.Sql).begin === 'function') {
+    await (sql as postgres.Sql).begin((tx) => runLedgerSteps(tx))
+    return
+  }
+
+  await runLedgerSteps(sql as postgres.TransactionSql)
+}