@rocapine/community 0.1.0 → 0.2.0

package/lib/commands/init.js

@@ -146,7 +146,7 @@ function printNextSteps(log, modules) {
     log("  2. Set Edge Function secrets: supabase secrets set OPENAI_API_KEY=...");
     log("     optional: SLACK_WEBHOOK_URL, COMMUNITY_APP_NAME, COMMUNITY_FALLBACK_NAME");
     if (modules.includes("push")) {
-        log("     push module: EXPO_ACCESS_TOKEN (required for notify-like/notify-comment)");
+        log("     push module: EXPO_ACCESS_TOKEN (only if your Expo project enforces Enhanced Security for push); COMMUNITY_PUSH_COPY (optional per-locale copy)");
     }
     log("  3. Deploy the Edge Functions: supabase functions deploy");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rocapine/community",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "CLI to install, upgrade and adopt the Rocapine Community SDK's Supabase backend (migrations, Edge Functions) into a project.",
   "license": "MIT",
   "repository": {

package/templates/functions/_shared/client.ts

@@ -1,15 +1,48 @@
-// Shared Supabase admin client + JSON response helper.
+// Shared Supabase admin client, caller identity helpers + JSON response helper.
 
 import { createClient } from "jsr:@supabase/supabase-js@2";
 
 export const SUPABASE_URL = Deno.env.get("SUPABASE_URL")!;
 
 // Service-role client: bypasses RLS. Every function does privileged work
-// through this; callers only ever pass the public anon JWT (verify_jwt).
+// through this; callers only ever pass the public anon JWT (verify_jwt) or a
+// user JWT.
 export function adminClient() {
   return createClient(SUPABASE_URL, Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!);
 }
 
+// The gateway (verify_jwt) has already validated the bearer's signature, so
+// only the role claim needs checking here. An exact string match against the
+// injected SUPABASE_SERVICE_ROLE_KEY broke when a project migrated to the new
+// API keys: the runtime then receives the sb_secret_* value while callers
+// still hold the legacy service_role JWT. Accept either proof.
+export function isServiceCaller(req: Request): boolean {
+  const bearer = (req.headers.get("authorization") ?? "").replace(/^Bearer\s+/i, "");
+  if (bearer && bearer === Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")) return true;
+  try {
+    const payload = JSON.parse(
+      atob(bearer.split(".")[1].replace(/-/g, "+").replace(/_/g, "/")),
+    ) as { role?: string };
+    return payload.role === "service_role";
+  } catch {
+    return false;
+  }
+}
+
+// The user behind the request's bearer, or null for an anon-key-only call
+// (or an invalid/expired user JWT). Resolved through Auth so a forged `sub`
+// claim can't be smuggled in with a plain anon token.
+export async function callerUserId(req: Request): Promise<string | null> {
+  const authorization = req.headers.get("authorization");
+  if (!authorization) return null;
+  const client = createClient(SUPABASE_URL, Deno.env.get("SUPABASE_ANON_KEY")!, {
+    global: { headers: { Authorization: authorization } },
+  });
+  const { data, error } = await client.auth.getUser();
+  if (error || !data.user) return null;
+  return data.user.id;
+}
+
 // The client consumes responses via supabase.functions.invoke, which only
 // parses the body as JSON when the Content-Type says so. Without this header
 // invoke returns a raw string and verdict.status is undefined.

package/templates/functions/_shared/config.ts

@@ -1,23 +1,7 @@
-// Per-app copy used inside notifications, injected as function secrets so the
-// same function code deploys unchanged to every app:
-//
-//   supabase secrets set COMMUNITY_FALLBACK_NAME="A member"
-//   supabase secrets set COMMUNITY_APP_NAME="My App"
-//   supabase secrets set COMMUNITY_REACTION_PUSH_TEXT="{name} sent you support"
-//
-// Defaults are deliberately neutral.
-
-// Display name used when the acting user has no username yet
-// ("<name>: ..." in comment pushes, "<name> liked your post").
-export const FALLBACK_ACTOR_NAME = Deno.env.get("COMMUNITY_FALLBACK_NAME") ?? "Someone";
+// Per-app copy injected as function secrets so the same function code
+// deploys unchanged to every app. Push copy (actor fallback name, like /
+// comment / reaction titles) lives in _shared/copy.ts (COMMUNITY_PUSH_COPY).
 
 // Push title fallback for official broadcast posts whose author has no
 // username (normally the official account's display name).
 export const BROADCAST_FALLBACK_TITLE = Deno.env.get("COMMUNITY_APP_NAME") ?? "Community";
-
-// notify-reaction's single-reactor push title template. `{name}` is
-// substituted with the reactor's display name (or FALLBACK_ACTOR_NAME).
-// Neutral default; an app with its own reaction semantics overrides this
-// secret rather than the function code.
-export const REACTION_PUSH_TEXT =
-  Deno.env.get("COMMUNITY_REACTION_PUSH_TEXT") ?? "{name} is thinking of you";

package/templates/functions/_shared/copy.ts

@@ -0,0 +1,247 @@
+// Locale-aware push copy for notify-comment / notify-like / notify-reaction.
+//
+// Every string below is a neutral built-in for the 9 locales the UI package
+// ships. An app with its own voice overrides ANY of them — per locale, per
+// key — through ONE JSON secret instead of forking the function bodies (the
+// way one host app had to before this existed):
+//
+//   supabase secrets set COMMUNITY_PUSH_COPY='{
+//     "fallbackName":  { "en": "A sister", "pt-PT": "Uma irmã" },
+//     "comment.title": { "pl": "Otrzymałaś komentarz" },
+//     "like.one":      { "pl": "{name} polubiła twój post" },
+//     "reaction.one":  { "en": "{name} prayed for you 🙏" },
+//     "reaction.many": { "en": "{name} and {count} others prayed for you 🙏",
+//                        "pl": { "one": "…", "few": "…", "many": "…" } }
+//   }'
+//
+// Placeholders: `{name}` (actor display name) and `{count}` (the number of
+// OTHER people in a coalesced push). A `*.many` value is either a string or a
+// `{ one, few, many, other }` object picked by the CLDR plural category of
+// `{count}` for the recipient's locale (Polish needs all three; French treats
+// 0 like 1; everything else is one/other).
+//
+// Legacy single-string secrets still apply, below the JSON and above the
+// built-ins: COMMUNITY_FALLBACK_NAME (every locale's fallbackName) and
+// COMMUNITY_REACTION_PUSH_TEXT (every locale's reaction.one).
+
+type Forms = { one?: string; few?: string; many?: string; other?: string };
+type CopyValue = string | Forms;
+type LocaleCopy = Record<string, CopyValue>;
+
+export type PushCopyKey =
+  "fallbackName" | "comment.title" | "like.one" | "like.many" | "reaction.one" | "reaction.many";
+
+const BUILTIN: Record<string, LocaleCopy> = {
+  en: {
+    fallbackName: "Someone",
+    "comment.title": "You received a comment",
+    "like.one": "{name} liked your post",
+    "like.many": {
+      one: "{name} and {count} other liked your post",
+      other: "{name} and {count} others liked your post",
+    },
+    "reaction.one": "{name} is thinking of you",
+    "reaction.many": {
+      one: "{name} and {count} other are thinking of you",
+      other: "{name} and {count} others are thinking of you",
+    },
+  },
+  "pt-PT": {
+    fallbackName: "Alguém",
+    "comment.title": "Recebeste um comentário",
+    "like.one": "{name} gostou da tua publicação",
+    "like.many": {
+      one: "{name} e mais {count} pessoa gostou da tua publicação",
+      other: "{name} e mais {count} pessoas gostaram da tua publicação",
+    },
+    "reaction.one": "{name} está a pensar em ti",
+    "reaction.many": {
+      one: "{name} e mais {count} pessoa está a pensar em ti",
+      other: "{name} e mais {count} pessoas estão a pensar em ti",
+    },
+  },
+  "pt-BR": {
+    fallbackName: "Alguém",
+    "comment.title": "Você recebeu um comentário",
+    "like.one": "{name} curtiu seu post",
+    "like.many": {
+      one: "{name} e mais {count} pessoa curtiu seu post",
+      other: "{name} e mais {count} pessoas curtiram seu post",
+    },
+    "reaction.one": "{name} está pensando em você",
+    "reaction.many": {
+      one: "{name} e mais {count} pessoa está pensando em você",
+      other: "{name} e mais {count} pessoas estão pensando em você",
+    },
+  },
+  "es-ES": {
+    fallbackName: "Alguien",
+    "comment.title": "Has recibido un comentario",
+    "like.one": "A {name} le ha gustado tu publicación",
+    "like.many": {
+      one: "A {name} y a {count} persona más les ha gustado tu publicación",
+      other: "A {name} y a {count} personas más les ha gustado tu publicación",
+    },
+    "reaction.one": "{name} está pensando en ti",
+    "reaction.many": {
+      one: "{name} y {count} persona más está pensando en ti",
+      other: "{name} y {count} personas más están pensando en ti",
+    },
+  },
+  "es-419": {
+    fallbackName: "Alguien",
+    "comment.title": "Recibiste un comentario",
+    "like.one": "A {name} le gustó tu publicación",
+    "like.many": {
+      one: "A {name} y a {count} persona más les gustó tu publicación",
+      other: "A {name} y a {count} personas más les gustó tu publicación",
+    },
+    "reaction.one": "{name} está pensando en ti",
+    "reaction.many": {
+      one: "{name} y {count} persona más está pensando en ti",
+      other: "{name} y {count} personas más están pensando en ti",
+    },
+  },
+  it: {
+    fallbackName: "Qualcuno",
+    "comment.title": "Hai ricevuto un commento",
+    "like.one": "A {name} piace il tuo post",
+    "like.many": {
+      one: "A {name} e ad altra {count} persona piace il tuo post",
+      other: "A {name} e ad altre {count} persone piace il tuo post",
+    },
+    "reaction.one": "{name} sta pensando a te",
+    "reaction.many": {
+      one: "{name} e altra {count} persona sta pensando a te",
+      other: "{name} e altre {count} persone stanno pensando a te",
+    },
+  },
+  pl: {
+    fallbackName: "Ktoś",
+    "comment.title": "Masz nowy komentarz",
+    "like.one": "{name} polubił(a) twój post",
+    "like.many": {
+      one: "{name} i {count} inna osoba polubiły twój post",
+      few: "{name} i {count} inne osoby polubiły twój post",
+      many: "{name} i {count} innych osób polubiło twój post",
+    },
+    "reaction.one": "{name} myśli o tobie",
+    "reaction.many": {
+      one: "{name} i {count} inna osoba myśli o tobie",
+      few: "{name} i {count} inne osoby myślą o tobie",
+      many: "{name} i {count} innych osób myśli o tobie",
+    },
+  },
+  fr: {
+    fallbackName: "Quelqu'un",
+    "comment.title": "Tu as reçu un commentaire",
+    "like.one": "{name} a aimé ta publication",
+    "like.many": {
+      one: "{name} et {count} autre personne ont aimé ta publication",
+      other: "{name} et {count} autres personnes ont aimé ta publication",
+    },
+    "reaction.one": "{name} pense à toi",
+    "reaction.many": {
+      one: "{name} et {count} autre personne pensent à toi",
+      other: "{name} et {count} autres personnes pensent à toi",
+    },
+  },
+  de: {
+    fallbackName: "Jemand",
+    "comment.title": "Du hast einen Kommentar erhalten",
+    "like.one": "{name} gefällt dein Beitrag",
+    "like.many": {
+      one: "{name} und {count} weiterer Person gefällt dein Beitrag",
+      other: "{name} und {count} weiteren Personen gefällt dein Beitrag",
+    },
+    "reaction.one": "{name} denkt an dich",
+    "reaction.many": {
+      one: "{name} und {count} weitere Person denken an dich",
+      other: "{name} und {count} weitere Personen denken an dich",
+    },
+  },
+};
+
+// Same rule set as the UI package's `pluralCategory` (packages/ui/src/i18n.ts).
+export function pluralCategory(locale: string, n: number): keyof Forms {
+  const lang = locale.split("-")[0]?.toLowerCase();
+  if (lang === "pl") {
+    if (n === 1) return "one";
+    const m10 = n % 10;
+    const m100 = n % 100;
+    if (m10 >= 2 && m10 <= 4 && !(m100 >= 12 && m100 <= 14)) return "few";
+    return "many";
+  }
+  if (lang === "fr") return n === 0 || n === 1 ? "one" : "other";
+  return n === 1 ? "one" : "other";
+}
+
+function parseOverrides(): Record<string, Record<string, CopyValue>> {
+  const raw = Deno.env.get("COMMUNITY_PUSH_COPY");
+  if (!raw) return {};
+  try {
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "object" && parsed !== null ? parsed : {};
+  } catch (e) {
+    console.error("community-sdk: COMMUNITY_PUSH_COPY is not valid JSON, ignoring it", e);
+    return {};
+  }
+}
+
+const OVERRIDES = parseOverrides();
+const LEGACY_FALLBACK_NAME = Deno.env.get("COMMUNITY_FALLBACK_NAME");
+const LEGACY_REACTION_ONE = Deno.env.get("COMMUNITY_REACTION_PUSH_TEXT");
+
+/** `es-MX` → `es-ES`, `pt-AO` → `pt-PT`, `fr-CA` → `fr`; unknown → `en`. */
+function resolveLocale(locale: string | null | undefined): string {
+  if (!locale) return "en";
+  if (BUILTIN[locale]) return locale;
+  const lang = locale.split("-")[0].toLowerCase();
+  if (BUILTIN[lang]) return lang;
+  if (lang === "es") return "es-ES";
+  if (lang === "pt") return "pt-PT";
+  return "en";
+}
+
+function pick(key: PushCopyKey, locale: string, exact: string | null | undefined): CopyValue {
+  const overrideByLocale = OVERRIDES[key] ?? {};
+  // Override lookup: exact locale as sent by the client, then the resolved one.
+  const override =
+    (exact ? overrideByLocale[exact] : undefined) ??
+    overrideByLocale[locale] ??
+    overrideByLocale[locale.split("-")[0]];
+  if (override !== undefined) return override;
+  if (key === "fallbackName" && LEGACY_FALLBACK_NAME) return LEGACY_FALLBACK_NAME;
+  if (key === "reaction.one" && LEGACY_REACTION_ONE) return LEGACY_REACTION_ONE;
+  return BUILTIN[locale][key] ?? BUILTIN.en[key];
+}
+
+function fill(template: string, params: { name?: string; count?: number }): string {
+  return template
+    .replace(/\{name\}/g, params.name ?? "")
+    .replace(/\{count\}/g, params.count === undefined ? "" : String(params.count));
+}
+
+/** Copy resolver for one recipient (`profiles.locale`). */
+export function pushCopy(recipientLocale: string | null | undefined) {
+  const locale = resolveLocale(recipientLocale);
+  const text = (key: PushCopyKey, params: { name?: string; count?: number } = {}): string => {
+    const value = pick(key, locale, recipientLocale);
+    if (typeof value === "string") return fill(value, params);
+    const category = pluralCategory(locale, params.count ?? 0);
+    const form =
+      value[category] ??
+      value.other ??
+      value.many ??
+      value.one ??
+      // A partial override object: fall through to the built-in forms.
+      (() => {
+        const builtin = BUILTIN[locale][key] ?? BUILTIN.en[key];
+        return typeof builtin === "string"
+          ? builtin
+          : (builtin[category] ?? builtin.other ?? builtin.many ?? builtin.one ?? "");
+      })();
+    return fill(form, params);
+  };
+  return { locale, fallbackName: text("fallbackName"), text };
+}

package/templates/functions/broadcast-post/index.ts

@@ -4,30 +4,12 @@
 // Guarded by a service-role check — the public anon key passes the platform's
 // verify_jwt but must NOT be able to trigger a broadcast.
 
-import { adminClient } from "../_shared/client.ts";
+import { adminClient, isServiceCaller } from "../_shared/client.ts";
 import { sendExpoPushBatch } from "../_shared/push.ts";
 import { BROADCAST_FALLBACK_TITLE } from "../_shared/config.ts";
 
 const supabase = adminClient();
 
-// The gateway (verify_jwt) has already validated the bearer's signature, so
-// only the role claim needs checking here. An exact string match against the
-// injected SUPABASE_SERVICE_ROLE_KEY broke when the project migrated to the
-// new API keys: the runtime now receives the sb_secret_* value while callers
-// still hold the legacy service_role JWT. Accept either proof.
-function isServiceCaller(req: Request): boolean {
-  const bearer = (req.headers.get("authorization") ?? "").replace(/^Bearer\s+/i, "");
-  if (bearer && bearer === Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")) return true;
-  try {
-    const payload = JSON.parse(
-      atob(bearer.split(".")[1].replace(/-/g, "+").replace(/_/g, "/")),
-    ) as { role?: string };
-    return payload.role === "service_role";
-  } catch {
-    return false;
-  }
-}
-
 Deno.serve(async (req) => {
   if (!isServiceCaller(req)) {
     return new Response("unauthorized", { status: 401 });

package/templates/functions/daily-moderation/index.ts

@@ -41,7 +41,7 @@ Deno.serve(async () => {
   const { data: posts, error: postsError } = await supabase
     .from("posts")
     .select(
-      "id, content, author_id, status, poll_options(idx, label), profiles!posts_author_id_fkey(username, amplitude_id, revenuecat_id)",
+      "id, content, author_id, status, profiles!posts_author_id_fkey(username, amplitude_id, revenuecat_id)",
     )
     .is("moderated_at", null)
     .in("status", ["pending", "visible"]);
@@ -57,16 +57,34 @@ Deno.serve(async () => {
   }
 
   // Poll option labels are user content: fold them into the post's moderated
-  // text (same treatment as the synchronous moderate-one function).
+  // text (same treatment as the synchronous moderate-one function). The polls
+  // module is optional: without it the table doesn't exist, the query errors,
+  // and posts are moderated on their text alone (a separate query instead of
+  // an embed so a core-only install doesn't 400 the whole sweep).
+  const optionsByPost = new Map<string, { idx: number; label: string }[]>();
+  if (posts && posts.length > 0) {
+    const { data: options, error } = await supabase
+      .from("poll_options")
+      .select("post_id, idx, label")
+      .in(
+        "post_id",
+        posts.map((p) => p.id),
+      );
+    if (!error) {
+      for (const o of options ?? []) {
+        const list = optionsByPost.get(o.post_id) ?? [];
+        list.push({ idx: o.idx, label: o.label });
+        optionsByPost.set(o.post_id, list);
+      }
+    }
+  }
   const items: Item[] = [
     ...(posts ?? []).map((p) => ({
       ...p,
       profiles: toOne(p.profiles),
       content: [
         p.content,
-        ...(p.poll_options ?? [])
-          .sort((a: { idx: number }, b: { idx: number }) => a.idx - b.idx)
-          .map((o: { label: string }) => o.label),
+        ...(optionsByPost.get(p.id) ?? []).sort((a, b) => a.idx - b.idx).map((o) => o.label),
       ].join("\n"),
       table: "posts" as const,
     })),
@@ -116,11 +134,15 @@ Deno.serve(async () => {
   const totalItems = items.length;
 
   const flaggedIds = new Set(flagged.map((f) => f.item.id));
+  // Status guards: a row the author soft-deleted while the sweep ran must not
+  // be resurrected as hidden/visible, so every write re-checks the status it
+  // was selected with.
   for (const { item, categories } of flagged) {
     await supabase
       .from(item.table)
       .update({ status: "hidden", moderation_reason: categories.join(",") })
-      .eq("id", item.id);
+      .eq("id", item.id)
+      .in("status", ["pending", "visible"]);
   }
   // Backstop: promote clean 'pending' items to 'visible' (their synchronous
   // moderate-one call must have failed).
@@ -128,10 +150,18 @@ Deno.serve(async () => {
   const promotePostIds = promote.filter((i) => i.table === "posts").map((i) => i.id);
   const promoteCommentIds = promote.filter((i) => i.table === "comments").map((i) => i.id);
   if (promotePostIds.length > 0) {
-    await supabase.from("posts").update({ status: "visible" }).in("id", promotePostIds);
+    await supabase
+      .from("posts")
+      .update({ status: "visible" })
+      .in("id", promotePostIds)
+      .eq("status", "pending");
   }
   if (promoteCommentIds.length > 0) {
-    await supabase.from("comments").update({ status: "visible" }).in("id", promoteCommentIds);
+    await supabase
+      .from("comments")
+      .update({ status: "visible" })
+      .in("id", promoteCommentIds)
+      .eq("status", "pending");
   }
   const now = new Date().toISOString();
   const processedPostIds = processed.filter((i) => i.table === "posts").map((i) => i.id);

package/templates/functions/moderate-one/index.ts

@@ -3,8 +3,14 @@
 // promoted to 'visible' (published); flagged -> 'hidden' (rejected) with the
 // reason. On an OpenAI error we fail closed (leave it pending); the daily
 // backstop re-checks stale pending items so nothing is silently lost.
+//
+// Security: the caller must be the row's author (resolved from their user
+// JWT through Auth) or the service role — an anon-key-only call can't
+// moderate someone else's pending item. Every status write is guarded with
+// `status = 'pending'` so a row the author deleted mid-flight is never
+// resurrected.
 
-import { adminClient, json } from "../_shared/client.ts";
+import { adminClient, callerUserId, isServiceCaller, json } from "../_shared/client.ts";
 import { assertModerationConfigured, moderateInput } from "../_shared/moderation.ts";
 
 assertModerationConfigured();
@@ -12,7 +18,10 @@ assertModerationConfigured();
 const supabase = adminClient();
 
 Deno.serve(async (req) => {
-  const { kind, id } = (await req.json()) as { kind: "post" | "comment"; id: string };
+  const { kind, id } = (await req.json().catch(() => ({}))) as {
+    kind?: "post" | "comment";
+    id?: string;
+  };
   if ((kind !== "post" && kind !== "comment") || !id) {
     return json({ status: "error", error: "bad request" }, 400);
   }
@@ -20,25 +29,33 @@ Deno.serve(async (req) => {
 
   const { data: row } = await supabase
     .from(table)
-    .select("id, content, status")
+    .select("id, author_id, content, status")
     .eq("id", id)
     .single();
   if (!row) return json({ status: "error", error: "not found" });
+
+  if (!isServiceCaller(req)) {
+    const uid = await callerUserId(req);
+    if (!uid || uid !== row.author_id) return json({ status: "error", error: "forbidden" }, 403);
+  }
+
   // Idempotent: only pending rows are moderated here.
   if (row.status !== "pending") {
     return json({ status: row.status === "visible" ? "published" : row.status });
   }
 
   // A poll post's option labels are user content too: moderate them together
-  // with the question, one verdict for the whole post.
+  // with the question, one verdict for the whole post. The polls module is
+  // optional — on an install without it the table doesn't exist and the
+  // query errors, which simply means "no options".
   let input = row.content;
   if (kind === "post") {
-    const { data: options } = await supabase
+    const { data: options, error } = await supabase
       .from("poll_options")
       .select("label")
       .eq("post_id", id)
       .order("idx");
-    if (options && options.length > 0) {
+    if (!error && options && options.length > 0) {
       input = [row.content, ...options.map((o) => o.label)].join("\n");
     }
   }
@@ -54,9 +71,17 @@ Deno.serve(async (req) => {
     await supabase
       .from(table)
       .update({ status: "hidden", moderation_reason: verdict.reason, moderated_at: now })
-      .eq("id", id);
+      .eq("id", id)
+      .eq("status", "pending");
     return json({ status: "rejected", reason: verdict.reason });
   }
-  await supabase.from(table).update({ status: "visible", moderated_at: now }).eq("id", id);
+  const { data: updated } = await supabase
+    .from(table)
+    .update({ status: "visible", moderated_at: now })
+    .eq("id", id)
+    .eq("status", "pending")
+    .select("id");
+  // Nothing updated: the author deleted (or a sweep moderated) it meanwhile.
+  if (!updated || updated.length === 0) return json({ status: "pending" });
   return json({ status: "published" });
 });

package/templates/functions/notify-comment/index.ts

@@ -1,29 +1,35 @@
-// Real-time comment notification: a pg_net trigger on comments posts the new
-// row here. We push to the post author (unless self, opted out, no token, or
-// the author has blocked the commenter).
+// Real-time comment notification: a pg_net trigger fires here when a comment
+// becomes visible (published). We push to the post author (unless self, opted
+// out, no token, or the author has blocked the commenter).
+//
+// Security: this function is reachable with the public anon key (the trigger
+// calls it that way), so the body is UNTRUSTED. Only `record.id` is used; the
+// comment is re-read from the database and must be visible — nothing in the
+// push comes from the request itself.
 
 import { adminClient } from "../_shared/client.ts";
 import { sendExpoPush } from "../_shared/push.ts";
-import { FALLBACK_ACTOR_NAME } from "../_shared/config.ts";
+import { pushCopy } from "../_shared/copy.ts";
 
 const supabase = adminClient();
 
-interface CommentRecord {
-  id: string;
-  post_id: string;
-  author_id: string;
-  content: string;
-}
-
 Deno.serve(async (req) => {
-  const { record } = (await req.json()) as { record: CommentRecord };
+  const { record } = (await req.json().catch(() => ({}))) as { record?: { id?: string } };
+  if (!record?.id) return new Response("skip: no id", { status: 400 });
+
+  const { data: comment } = await supabase
+    .from("comments")
+    .select("id, post_id, author_id, content, status")
+    .eq("id", record.id)
+    .single();
+  if (!comment || comment.status !== "visible") return new Response("skip: not visible");
 
   const { data: post } = await supabase
     .from("posts")
     .select("author_id")
-    .eq("id", record.post_id)
+    .eq("id", comment.post_id)
     .single();
-  if (!post || post.author_id === record.author_id) return new Response("skip: self/none");
+  if (!post || post.author_id === comment.author_id) return new Response("skip: self/none");
 
   const { data: pref } = await supabase
     .from("push_tokens")
@@ -36,25 +42,32 @@ Deno.serve(async (req) => {
     .from("blocks")
     .select("blocker_id")
     .eq("blocker_id", post.author_id)
-    .eq("blocked_id", record.author_id)
+    .eq("blocked_id", comment.author_id)
     .maybeSingle();
   if (blocked) return new Response("skip: blocked");
 
+  const { data: recipient } = await supabase
+    .from("profiles")
+    .select("locale")
+    .eq("id", post.author_id)
+    .single();
+  const copy = pushCopy(recipient?.locale);
+
   const { data: actor } = await supabase
     .from("profiles")
     .select("username")
-    .eq("id", record.author_id)
+    .eq("id", comment.author_id)
     .single();
-  const name = actor?.username?.trim() || FALLBACK_ACTOR_NAME;
+  const name = actor?.username?.trim() || copy.fallbackName;
   const excerpt =
-    record.content.length > 140 ? `${record.content.slice(0, 137)}...` : record.content;
+    comment.content.length > 140 ? `${comment.content.slice(0, 137)}...` : comment.content;
   // Title states the event; body is the commenter's name then the comment in
   // quotes, e.g.  Marie: "So happy for you!".
   const body = `${name}: "${excerpt}"`;
 
   await sendExpoPush({
     to: pref.expo_push_token,
-    title: "You received a comment",
+    title: copy.text("comment.title"),
     body,
     data: { route: "/community", kind: "community_comment" },
     badge: 1,

package/templates/functions/notify-like/index.ts

@@ -1,11 +1,18 @@
 // Coalesced like notifications. Trigger path (body has record): apply a 10-min
 // per-post cooldown so bursts do not spam. Digest path (no record, from cron):
 // sweep posts with unnotified likes older than the cooldown. Either way, group
-// as "<name> liked your post" (1) or "<name> and N others liked your post".
+// as "<name> liked your post" (1) or "<name> and N others liked your post",
+// in the recipient's locale (profiles.locale) — see _shared/copy.ts for the
+// built-in copy and the COMMUNITY_PUSH_COPY override.
+//
+// Security: the trigger path only takes `record.post_id` from the (anon-key
+// reachable, hence untrusted) body and re-derives everything from the likes
+// table, so a forged body can at most flush a real post's pending like
+// notifications early.
 
 import { adminClient } from "../_shared/client.ts";
 import { sendExpoPush } from "../_shared/push.ts";
-import { FALLBACK_ACTOR_NAME } from "../_shared/config.ts";
+import { pushCopy } from "../_shared/copy.ts";
 
 const supabase = adminClient();
 const COOLDOWN_MS = 10 * 60 * 1000;
@@ -52,16 +59,23 @@ async function flushPost(postId: string) {
   );
   if (contributors.length === 0) return;
 
+  const { data: recipient } = await supabase
+    .from("profiles")
+    .select("locale")
+    .eq("id", post.author_id)
+    .single();
+  const copy = pushCopy(recipient?.locale);
+
   const { data: actor } = await supabase
     .from("profiles")
     .select("username")
     .eq("id", contributors[0].user_id)
     .single();
-  const name = actor?.username?.trim() || FALLBACK_ACTOR_NAME;
+  const name = actor?.username?.trim() || copy.fallbackName;
   const title =
     contributors.length === 1
-      ? `${name} liked your post`
-      : `${name} and ${contributors.length - 1} others liked your post`;
+      ? copy.text("like.one", { name })
+      : copy.text("like.many", { name, count: contributors.length - 1 });
 
   await sendExpoPush({
     to: pref.expo_push_token,

package/templates/functions/notify-reaction/index.ts

@@ -5,90 +5,22 @@
 // sweep posts with unnotified reactions older than the cooldown. Never
 // includes any reaction content — the reaction table carries no text.
 //
-// Push copy: the recipient's profiles.locale selects a built-in neutral
-// template for the common single-reactor case (COMMUNITY_REACTION_PUSH_TEXT
-// overrides that template for every locale, `{name}` substituted with the
-// reactor's display name — an app with its own reaction semantics sets its
-// own copy there). The multi-reactor case always uses the locale's own
-// "and N others" phrasing; there is no secret for it, only the built-in
-// translations below.
+// Push copy: the recipient's profiles.locale selects the built-in neutral
+// copy ("{name} is thinking of you" / "… and N others …") — an app with its
+// own reaction semantics overrides it per locale with the COMMUNITY_PUSH_COPY
+// secret (see _shared/copy.ts; the older COMMUNITY_REACTION_PUSH_TEXT single
+// string still works for the single-reactor case).
 //
-// NOTE: profiles.locale is not part of the SDK's core schema yet (task 16) —
-// it must exist before this function can run. See the internal port notes
-// for a reference migration adding it.
+// Security: same as notify-like — only `record.post_id` is read from the
+// untrusted body; everything else comes from post_reactions.
 
 import { adminClient } from "../_shared/client.ts";
 import { sendExpoPush } from "../_shared/push.ts";
-import { FALLBACK_ACTOR_NAME, REACTION_PUSH_TEXT } from "../_shared/config.ts";
+import { pushCopy } from "../_shared/copy.ts";
 
 const supabase = adminClient();
 const COOLDOWN_MS = 10 * 60 * 1000;
 
-/**
- * CLDR plural form for a count: 1 -> `one`, 2-4 -> `few`, 5+ -> `many` (the
- * Polish rule, minus the fractional `other` case a push count never hits).
- * Every other locale below needs only a singular/plural pair.
- */
-function plForm(n: number, one: string, few: string, many: string) {
-  if (n === 1) return one;
-  const lastTwo = n % 100;
-  const inTeens = lastTwo >= 10 && lastTwo < 20;
-  return !inTeens && n % 10 >= 2 && n % 10 <= 4 ? few : many;
-}
-
-// Built-in neutral push copy per recipient locale (profiles.locale). Keys
-// mirror SupportedLanguage in host apps; unknown locales fall back to en.
-// `one` is only used when COMMUNITY_REACTION_PUSH_TEXT is unset (its default
-// already matches the `en` entry below).
-const COPY = {
-  en: {
-    fallbackName: "Someone",
-    one: (name: string) => `${name} is thinking of you`,
-    many: (name: string, extra: number) =>
-      `${name} and ${extra} ${extra === 1 ? "other" : "others"} are thinking of you`,
-  },
-  "pt-PT": {
-    fallbackName: "Alguém",
-    one: (name: string) => `${name} está a pensar em ti`,
-    many: (name: string, extra: number) =>
-      `${name} e mais ${extra} ${extra === 1 ? "pessoa está" : "pessoas estão"} a pensar em ti`,
-  },
-  "pt-BR": {
-    fallbackName: "Alguém",
-    one: (name: string) => `${name} está pensando em você`,
-    many: (name: string, extra: number) =>
-      `${name} e mais ${extra} ${extra === 1 ? "pessoa está" : "pessoas estão"} pensando em você`,
-  },
-  "es-ES": {
-    fallbackName: "Alguien",
-    one: (name: string) => `${name} está pensando en ti`,
-    many: (name: string, extra: number) =>
-      `${name} y ${extra} ${extra === 1 ? "persona más está" : "personas más están"} pensando en ti`,
-  },
-  "es-419": {
-    fallbackName: "Alguien",
-    one: (name: string) => `${name} está pensando en ti`,
-    many: (name: string, extra: number) =>
-      `${name} y ${extra} ${extra === 1 ? "persona más está" : "personas más están"} pensando en ti`,
-  },
-  it: {
-    fallbackName: "Qualcuno",
-    one: (name: string) => `${name} sta pensando a te`,
-    many: (name: string, extra: number) =>
-      `${name} e altre ${extra} ${extra === 1 ? "persona sta" : "persone stanno"} pensando a te`,
-  },
-  pl: {
-    fallbackName: "Ktoś",
-    one: (name: string) => `${name} myśli o tobie`,
-    many: (name: string, extra: number) =>
-      `${name} i ${plForm(extra, `${extra} inna osoba myśli`, `${extra} inne osoby myślą`, `${extra} innych osób myśli`)} o tobie`,
-  },
-} as const;
-
-function copyFor(locale: string | null | undefined) {
-  return COPY[(locale ?? "en") as keyof typeof COPY] ?? COPY.en;
-}
-
 async function flushPost(postId: string) {
   const { data: post } = await supabase.from("posts").select("author_id").eq("id", postId).single();
   if (!post) return;
@@ -98,7 +30,7 @@ async function flushPost(postId: string) {
     .select("locale")
     .eq("id", post.author_id)
     .single();
-  const copy = copyFor(recipient?.locale);
+  const copy = pushCopy(recipient?.locale);
 
   const { data: pref } = await supabase
     .from("push_tokens")
@@ -138,15 +70,11 @@ async function flushPost(postId: string) {
     .select("username")
     .eq("id", contributors[0].user_id)
     .single();
-  // COMMUNITY_FALLBACK_NAME (the deployer-set env var, shared with
-  // notify-like/notify-comment and meant to match the client's
-  // anonymousAuthorFallback — see docs/backend-runbook.md) takes precedence
-  // over the locale table's own fallbackName default.
-  const name = actor?.username?.trim() || FALLBACK_ACTOR_NAME || copy.fallbackName;
+  const name = actor?.username?.trim() || copy.fallbackName;
   const title =
     contributors.length === 1
-      ? REACTION_PUSH_TEXT.replace("{name}", name)
-      : copy.many(name, contributors.length - 1);
+      ? copy.text("reaction.one", { name })
+      : copy.text("reaction.many", { name, count: contributors.length - 1 });
 
   await sendExpoPush({
     to: pref.expo_push_token,

package/templates/functions/report-to-slack/index.ts

@@ -2,35 +2,41 @@
 // record here; we enrich it with the reported account's identity and its
 // cumulative report count, then alert Slack (no-op if SLACK_WEBHOOK_URL is
 // unset — see _shared/slack.ts). Bans stay manual (dashboard).
+//
+// Security: reachable with the anon key, so only `record.id` is trusted; the
+// report row is re-read from the database (a forged body can't inject text
+// into the ops channel or probe another user's report count).
 
 import { adminClient } from "../_shared/client.ts";
 import { postToSlack } from "../_shared/slack.ts";
 
 const supabase = adminClient();
 
-interface ReportRecord {
-  reported_user_id: string;
-  reason: string;
-  details: string | null;
-}
-
 Deno.serve(async (req) => {
-  const { record } = (await req.json()) as { record: ReportRecord };
+  const { record } = (await req.json().catch(() => ({}))) as { record?: { id?: string } };
+  if (!record?.id) return new Response("skip: no id", { status: 400 });
+
+  const { data: report } = await supabase
+    .from("reports")
+    .select("id, reported_user_id, reason, details")
+    .eq("id", record.id)
+    .single();
+  if (!report) return new Response("skip: unknown report");
 
   const { data: reported } = await supabase
     .from("profiles")
     .select("username, amplitude_id, revenuecat_id")
-    .eq("id", record.reported_user_id)
+    .eq("id", report.reported_user_id)
     .single();
   const { count } = await supabase
     .from("reports")
     .select("*", { count: "exact", head: true })
-    .eq("reported_user_id", record.reported_user_id);
+    .eq("reported_user_id", report.reported_user_id);
 
   await postToSlack({
     text:
-      `:rotating_light: Report (*${record.reason}*) against *${reported?.username ?? record.reported_user_id}*, ${count ?? "?"} report(s) total\n` +
-      `${record.details ? `> ${record.details}\n` : ""}` +
+      `:rotating_light: Report (*${report.reason}*) against *${reported?.username ?? report.reported_user_id}*, ${count ?? "?"} report(s) total\n` +
+      `${report.details ? `> ${report.details}\n` : ""}` +
       `amplitude: \`${reported?.amplitude_id ?? "?"}\` | revenuecat: \`${reported?.revenuecat_id ?? "?"}\``,
   });
   return new Response("ok");