@plutocms/supabase 0.7.0 → 0.7.2

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.7.2](https://github.com/plutocms/supabase/compare/v0.7.1...v0.7.2) (2026-09-13)
+
+
+### Bug Fixes
+
+* **permissions:** make requireAdmin safe on a zero-migration database ([#58](https://github.com/plutocms/supabase/issues/58)) ([a83f6d0](https://github.com/plutocms/supabase/commit/a83f6d0bfa3ae150df5b90a06fcd29fe437ad9b7))
+
+## [0.7.1](https://github.com/plutocms/supabase/compare/v0.7.0...v0.7.1) (2026-09-13)
+
+
+### Bug Fixes
+
+* **permissions:** break the migrations-page bootstrap deadlock ([#55](https://github.com/plutocms/supabase/issues/55)) ([19f4338](https://github.com/plutocms/supabase/commit/19f43388827ba1f4699a2347726e56084c06f8ef))
+
 ## [0.7.0](https://github.com/plutocms/supabase/compare/v0.6.0...v0.7.0) (2026-09-12)
 
 

package/app/pages/admin/migrations.vue

@@ -30,6 +30,13 @@ const connectionForm = ref({
 })
 
 const isRunning = ref(false)
+// True only while waitForServerAndRefresh is polling through a dev-server
+// restart. useMigrations().status reads as null on every failed poll in
+// that window (see its own doc comment), which would otherwise leave the
+// page blank below the title — the toasts alone are easy to miss. The
+// template shows a persistent banner instead, keyed on this flag, so the
+// page always explains what is happening instead of going quiet.
+const isReconnecting = ref(false)
 const lastRun = ref<Awaited<ReturnType<typeof runMigrations>> | null>(null)
 // Kept only in this page's own memory, only to show the manual .env step if
 // persisting fails — see EnvPersistWarning.vue. Never sent anywhere new.
@@ -118,8 +125,12 @@ async function applyMigrations(useForm: boolean) {
         color: 'info',
       })
 
+      isReconnecting.value = true
+
       const recovered = await waitForServerAndRefresh()
 
+      isReconnecting.value = false
+
       toast.add(
         recovered
           ? {
@@ -163,7 +174,19 @@ async function applyMigrations(useForm: boolean) {
   <AdminView>
     <h1 class="text-3xl font-bold lg:text-4xl">Migrations</h1>
 
-    <div v-if="fetchStatus === 'pending'" class="flex items-center gap-x-2">
+    <UAlert
+      v-if="isReconnecting"
+      color="info"
+      variant="outline"
+      icon="lucide:refresh-cw"
+      title="Dev server restarting"
+      description="Saving a new connection string restarts the dev server. Reconnecting — this page will update on its own once it's back."
+    />
+
+    <div
+      v-else-if="fetchStatus === 'pending'"
+      class="flex items-center gap-x-2"
+    >
       <Icon name="svg-spinners:ring-resize" />
       <span>Loading migration status…</span>
     </div>
@@ -340,5 +363,25 @@ async function applyMigrations(useForm: boolean) {
         </div>
       </UCard>
     </template>
+
+    <UAlert
+      v-else
+      color="error"
+      variant="outline"
+      icon="lucide:circle-x"
+      title="Could not load migration status"
+      description="This isn't the dev-server-restart case above — something else went wrong reading migration status. Check the server console, then try again."
+    >
+      <template #actions>
+        <UButton
+          color="error"
+          variant="outline"
+          icon="lucide:refresh-cw"
+          @click="refresh()"
+        >
+          Retry
+        </UButton>
+      </template>
+    </UAlert>
   </AdminView>
 </template>

package/app/pages/admin.vue

@@ -8,19 +8,11 @@ const route = useRoute()
 const { isLoggedIn, logout, allowedUnauthenticatedPaths } = await useAuth()
 const toast = useToast()
 
-const { load: loadPermissions, clear: clearPermissions } = usePlutoPermissions()
-
-watch(
-  isLoggedIn,
-  (loggedIn) => {
-    if (loggedIn) {
-      loadPermissions()
-    } else {
-      clearPermissions()
-    }
-  },
-  { immediate: true }
-)
+// Loading/clearing permissions on login/logout lives in
+// app/plugins/pluto-permissions-sync.ts now, not here — that plugin runs
+// on every page, not just this one, so a signed-in admin browsing a public
+// page directly (no prior visit to /admin/** this session) still gets
+// their capabilities loaded.
 
 const visibility = useDocumentVisibility()
 

package/app/plugins/pluto-extension.ts

@@ -36,10 +36,12 @@ export default defineNuxtPlugin(() => {
         hasSettingsModified.value = Date.now()
       },
     },
+    // No 'system:migrate' capability: applying migrations stays admin-only,
+    // gated by requireAdmin (public.is_admin() directly), never a named
+    // capability — see server/utils/admin-guard.ts for why.
     capabilities: [
       { id: 'settings-manage', key: 'settings:manage', label: 'Manage site settings' },
       { id: 'users-read', key: 'users:read', label: 'View all user accounts' },
-      { id: 'system-migrate', key: 'system:migrate', label: 'Apply pending layer migrations' },
     ],
     permissionsDriver: {
       id: 'supabase',

package/app/plugins/pluto-permissions-sync.ts

@@ -0,0 +1,38 @@
+/**
+ * Loads (or clears) the current user's capabilities whenever their session
+ * appears or disappears — app-wide, not page-scoped.
+ *
+ * This used to live as a `watch` inside `app/pages/admin.vue`. That only
+ * ran while `admin.vue` was the mounted page, so a signed-in admin loading
+ * a public page directly (a fresh navigation or a page reload, with no
+ * earlier visit to `/admin/**` in the same app instance) never triggered a
+ * load at all — `usePlutoPermissions().granted` stayed empty, and every
+ * `can()` check for that admin read as `false` on that page, even though
+ * the same admin's capability-gated UI worked correctly inside `/admin/**`.
+ * `NavbarAdminActions.vue`'s "Edit product" quick-link (shown while
+ * viewing a live `/product/**` page) is exactly the kind of capability-
+ * gated UI that lives outside `/admin/**` by design, so it needs this to
+ * fire on every page, not just admin ones.
+ *
+ * `useSupabaseSession()` (not `useAuth()`) on purpose: it is the same
+ * primitive `useAuth()`'s own `isLoggedIn` is built from
+ * (`computed(() => !!supabaseSession.value)`), and it is genuinely
+ * app-wide reactive state already (managed by `@nuxtjs/supabase`'s own
+ * plugin), so reading it directly here needs no extra composable surface.
+ */
+export default defineNuxtPlugin(() => {
+  const session = useSupabaseSession()
+  const { load, clear } = usePlutoPermissions()
+
+  watch(
+    session,
+    (current) => {
+      if (current) {
+        load()
+      } else {
+        clear()
+      }
+    },
+    { immediate: true }
+  )
+})

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@plutocms/supabase",
   "type": "module",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "trustedDependencies": [
     "@parcel/watcher",
     "@plutocms/pluto",

package/server/api/migrations/run.post.ts

@@ -1,6 +1,6 @@
 import type { PlutoMigrationFile } from '../../../shared/types/migrations'
 import type { MigrationFileResult } from '../../utils/migrations'
-import { requireCapability } from '../../utils/capability-guard'
+import { requireAdmin } from '../../utils/admin-guard'
 import { persistDatabaseUrl } from '../../utils/env-file'
 import { resolveConnectionString, runPendingMigrations } from '../../utils/migrations'
 import { scrubConnectionString } from '../../utils/scrub-connection-string'
@@ -11,7 +11,10 @@ interface Payload {
 }
 
 export default defineEventHandler(async (event) => {
-  await requireCapability(event, 'system:migrate')
+  // requireAdmin specifically, not a named capability — see admin-guard.ts
+  // for why: this route must work even before 004_roles_and_capabilities.sql
+  // (which defines the capability system) has been applied.
+  await requireAdmin(event)
 
   const body = await readBody<Payload | undefined>(event)
 

package/server/api/migrations/status.get.ts

@@ -1,8 +1,11 @@
-import { requireCapability } from '../../utils/capability-guard'
+import { requireAdmin } from '../../utils/admin-guard'
 import { getMigrationStatus } from '../../utils/pending-migrations'
 
 export default defineEventHandler(async (event) => {
-  await requireCapability(event, 'system:migrate')
+  // requireAdmin specifically, not a named capability — see admin-guard.ts
+  // for why: this route must work even before 004_roles_and_capabilities.sql
+  // (which defines the capability system) has been applied.
+  await requireAdmin(event)
 
   const status = await getMigrationStatus(event)
 

package/server/api/permissions/me.get.ts

@@ -17,7 +17,18 @@ export default defineEventHandler(async (event) => {
   const { data, error } = await client.rpc('my_capabilities')
 
   if (error) {
-    throw createError({ statusCode: 500, statusMessage: error.message })
+    // public.my_capabilities() is defined by 004_roles_and_capabilities.sql.
+    // A site that has upgraded this package but not yet applied that
+    // migration has no such function yet — that is an expected, temporary
+    // state during an upgrade, not a server error. Degrade to an empty
+    // capability list (the same shape a signed-out caller gets above)
+    // rather than 500ing: the caller already fails every can() check with
+    // an empty list, which is the correct, safe behavior until the pending
+    // migration is applied through /admin/migrations (itself gated by
+    // requireAdmin, not a capability, precisely so this state is always
+    // recoverable — see server/utils/admin-guard.ts).
+    console.error('my_capabilities() failed, returning an empty capability list:', error.message)
+    return { capabilities: [] as string[] }
   }
 
   return { capabilities: data ?? [] }

package/server/utils/admin-guard.ts

@@ -1,19 +1,71 @@
 import type { H3Event } from 'h3'
-import { ALL_CAPABILITIES, requireCapability } from './capability-guard'
+import { serverSupabaseClient, serverSupabaseUser } from '#supabase/server'
 
 /**
- * Guards a server route so only an admin (or a holder of every
- * capability, which is what the built-in admin role grants) can call it.
- * A thin alias over requireCapability, kept for the routes that ask for
- * "admin, full stop" rather than one named capability.
+ * Guards a server route so only an admin can call it.
+ *
+ * Queries `public.profiles.is_admin` directly — deliberately NOT
+ * `public.is_admin()` or `public.has_capability()`. Both of those are
+ * defined by migrations (`002_admin_hardening.sql`,
+ * `004_roles_and_capabilities.sql` respectively); a genuinely fresh site
+ * that has never applied any migration beyond the original baseline
+ * schema — an expected, normal state, not a broken one — has neither
+ * function. `/api/migrations/*` (the only routes that call `requireAdmin`
+ * today) are the one place this actually bites: they are the routes that
+ * apply a pending migration, so they must work with zero migrations
+ * applied, not just with `002`+ already in place. An earlier version of
+ * this function called `public.is_admin()` on the theory that it "always
+ * exists" — true for a site that has applied at least `002`, false for a
+ * fresh one that has not, which is exactly the case that matters here.
+ * `profiles.is_admin` (the column) is part of the original baseline
+ * schema itself, before any of this project's layered migrations existed,
+ * so querying it directly has no migration dependency at all.
+ *
+ * The trade-off: a user granted the `admin` role only through
+ * `user_roles` (see `permissions-storage/SKILL.md`'s "Granting a role by
+ * hand"), with `profiles.is_admin` left `false`, cannot pass this check —
+ * only RLS and `has_capability()`-gated routes recognize a role-only
+ * admin. That is an acceptable, narrow limitation: `user_roles` cannot
+ * exist before `004` has been applied, so a role-only admin can only
+ * exist on a site that has already applied every current migration, at
+ * which point there is nothing left for that admin to need
+ * `/admin/migrations` for. If a future migration ever needs applying by
+ * a role-only admin, grant them `profiles.is_admin = true` too.
+ *
+ * `serverSupabaseUser` (from `@nuxtjs/supabase`, backed by
+ * `client.auth.getClaims()`) returns decoded JWT claims, not a Supabase
+ * `User` row — the claims object has no `id` field, only `sub`. Querying
+ * `.eq('id', user.id)` silently matches zero rows and looks exactly like
+ * "not an admin" even for a real admin. Always read `user.sub`.
  *
  * Throws a 401 if there is no logged-in user, or a 403 if the user is not
- * an admin. Returns the claims on success. See capability-guard.ts for
- * the user.sub vs user.id note: this function forwards straight into
- * requireCapability, which never reads either field.
+ * an admin. Returns the user's claims on success.
  */
 export async function requireAdmin(event: H3Event) {
-  return requireCapability(event, ALL_CAPABILITIES, {
-    message: 'Your account is not an admin.',
-  })
+  const user = await serverSupabaseUser(event)
+
+  if (!user) {
+    throw createError({ statusCode: 401, statusMessage: 'You must be logged in.' })
+  }
+
+  const client = await serverSupabaseClient<Database>(event)
+  const { data: profile, error } = await client
+    .from('profiles')
+    .select('is_admin')
+    .eq('id', user.sub)
+    .single()
+
+  if (error) {
+    // Logged, never returned: the 403 below must not tell an untrusted
+    // caller whether it hit a real error (a missing column, a connection
+    // problem) or a genuine non-admin. Server logs are where that
+    // distinction has to live instead.
+    console.error('requireAdmin: profiles lookup failed:', error.message)
+  }
+
+  if (error || !profile?.is_admin) {
+    throw createError({ statusCode: 403, statusMessage: 'Your account is not an admin.' })
+  }
+
+  return user
 }

package/shared/types/supabase.ts

@@ -360,6 +360,10 @@ export type Database = {
         Args: Record<PropertyKey, never>
         Returns: string[]
       }
+      is_admin: {
+        Args: Record<PropertyKey, never>
+        Returns: boolean
+      }
     }
     Enums: {
       thealthcheck: "first_setup"