@plutocms/supabase 0.7.0 → 0.7.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.7.1](https://github.com/plutocms/supabase/compare/v0.7.0...v0.7.1) (2026-09-13)
+
+
+### Bug Fixes
+
+* **permissions:** break the migrations-page bootstrap deadlock ([#55](https://github.com/plutocms/supabase/issues/55)) ([19f4338](https://github.com/plutocms/supabase/commit/19f43388827ba1f4699a2347726e56084c06f8ef))
+
 ## [0.7.0](https://github.com/plutocms/supabase/compare/v0.6.0...v0.7.0) (2026-09-12)
 
 

package/app/plugins/pluto-extension.ts

@@ -36,10 +36,12 @@ export default defineNuxtPlugin(() => {
         hasSettingsModified.value = Date.now()
       },
     },
+    // No 'system:migrate' capability: applying migrations stays admin-only,
+    // gated by requireAdmin (public.is_admin() directly), never a named
+    // capability — see server/utils/admin-guard.ts for why.
     capabilities: [
       { id: 'settings-manage', key: 'settings:manage', label: 'Manage site settings' },
       { id: 'users-read', key: 'users:read', label: 'View all user accounts' },
-      { id: 'system-migrate', key: 'system:migrate', label: 'Apply pending layer migrations' },
     ],
     permissionsDriver: {
       id: 'supabase',

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@plutocms/supabase",
   "type": "module",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "trustedDependencies": [
     "@parcel/watcher",
     "@plutocms/pluto",

package/server/api/migrations/run.post.ts

@@ -1,6 +1,6 @@
 import type { PlutoMigrationFile } from '../../../shared/types/migrations'
 import type { MigrationFileResult } from '../../utils/migrations'
-import { requireCapability } from '../../utils/capability-guard'
+import { requireAdmin } from '../../utils/admin-guard'
 import { persistDatabaseUrl } from '../../utils/env-file'
 import { resolveConnectionString, runPendingMigrations } from '../../utils/migrations'
 import { scrubConnectionString } from '../../utils/scrub-connection-string'
@@ -11,7 +11,10 @@ interface Payload {
 }
 
 export default defineEventHandler(async (event) => {
-  await requireCapability(event, 'system:migrate')
+  // requireAdmin specifically, not a named capability — see admin-guard.ts
+  // for why: this route must work even before 004_roles_and_capabilities.sql
+  // (which defines the capability system) has been applied.
+  await requireAdmin(event)
 
   const body = await readBody<Payload | undefined>(event)
 

package/server/api/migrations/status.get.ts

@@ -1,8 +1,11 @@
-import { requireCapability } from '../../utils/capability-guard'
+import { requireAdmin } from '../../utils/admin-guard'
 import { getMigrationStatus } from '../../utils/pending-migrations'
 
 export default defineEventHandler(async (event) => {
-  await requireCapability(event, 'system:migrate')
+  // requireAdmin specifically, not a named capability — see admin-guard.ts
+  // for why: this route must work even before 004_roles_and_capabilities.sql
+  // (which defines the capability system) has been applied.
+  await requireAdmin(event)
 
   const status = await getMigrationStatus(event)
 

package/server/api/permissions/me.get.ts

@@ -17,7 +17,18 @@ export default defineEventHandler(async (event) => {
   const { data, error } = await client.rpc('my_capabilities')
 
   if (error) {
-    throw createError({ statusCode: 500, statusMessage: error.message })
+    // public.my_capabilities() is defined by 004_roles_and_capabilities.sql.
+    // A site that has upgraded this package but not yet applied that
+    // migration has no such function yet — that is an expected, temporary
+    // state during an upgrade, not a server error. Degrade to an empty
+    // capability list (the same shape a signed-out caller gets above)
+    // rather than 500ing: the caller already fails every can() check with
+    // an empty list, which is the correct, safe behavior until the pending
+    // migration is applied through /admin/migrations (itself gated by
+    // requireAdmin, not a capability, precisely so this state is always
+    // recoverable — see server/utils/admin-guard.ts).
+    console.error('my_capabilities() failed, returning an empty capability list:', error.message)
+    return { capabilities: [] as string[] }
   }
 
   return { capabilities: data ?? [] }

package/server/utils/admin-guard.ts

@@ -1,19 +1,42 @@
 import type { H3Event } from 'h3'
-import { ALL_CAPABILITIES, requireCapability } from './capability-guard'
+import { serverSupabaseClient, serverSupabaseUser } from '#supabase/server'
 
 /**
- * Guards a server route so only an admin (or a holder of every
- * capability, which is what the built-in admin role grants) can call it.
- * A thin alias over requireCapability, kept for the routes that ask for
- * "admin, full stop" rather than one named capability.
+ * Guards a server route so only an admin can call it.
+ *
+ * Calls `public.is_admin()` directly — deliberately NOT through
+ * `requireCapability`/`public.has_capability()`. `has_capability()` is
+ * defined by `004_roles_and_capabilities.sql`; a site that has upgraded
+ * this package but not yet applied that migration has no such function in
+ * its database, and every `requireCapability` call would throw. If
+ * `requireAdmin` routed through it too, that would 403 the one route
+ * (`/api/migrations/*`) an admin needs to actually apply the migration —
+ * a deadlock with no escape through the UI. `public.is_admin()` has existed
+ * since `002_admin_hardening.sql` and is only ever `create or replace`d,
+ * never dropped, so it is always safe to call regardless of which layer
+ * migrations have been applied. This is also why the migrations routes
+ * call `requireAdmin` specifically, and not a named capability like
+ * `system:migrate` — migrations are a bootstrapping concern and must never
+ * depend on the capability system migrations themselves create.
  *
  * Throws a 401 if there is no logged-in user, or a 403 if the user is not
- * an admin. Returns the claims on success. See capability-guard.ts for
- * the user.sub vs user.id note: this function forwards straight into
- * requireCapability, which never reads either field.
+ * an admin. Returns the user's claims on success. See capability-guard.ts
+ * for the same user.sub vs user.id note — this function has the same
+ * shape but never reads either field either.
  */
 export async function requireAdmin(event: H3Event) {
-  return requireCapability(event, ALL_CAPABILITIES, {
-    message: 'Your account is not an admin.',
-  })
+  const user = await serverSupabaseUser(event)
+
+  if (!user) {
+    throw createError({ statusCode: 401, statusMessage: 'You must be logged in.' })
+  }
+
+  const client = await serverSupabaseClient<Database>(event)
+  const { data, error } = await client.rpc('is_admin')
+
+  if (error || data !== true) {
+    throw createError({ statusCode: 403, statusMessage: 'Your account is not an admin.' })
+  }
+
+  return user
 }

package/shared/types/supabase.ts

@@ -360,6 +360,10 @@ export type Database = {
         Args: Record<PropertyKey, never>
         Returns: string[]
       }
+      is_admin: {
+        Args: Record<PropertyKey, never>
+        Returns: boolean
+      }
     }
     Enums: {
       thealthcheck: "first_setup"