@rocapine/community 0.1.0 → 0.3.0

package/templates/functions/notify-reaction/index.ts

@@ -5,90 +5,22 @@
 // sweep posts with unnotified reactions older than the cooldown. Never
 // includes any reaction content — the reaction table carries no text.
 //
-// Push copy: the recipient's profiles.locale selects a built-in neutral
-// template for the common single-reactor case (COMMUNITY_REACTION_PUSH_TEXT
-// overrides that template for every locale, `{name}` substituted with the
-// reactor's display name — an app with its own reaction semantics sets its
-// own copy there). The multi-reactor case always uses the locale's own
-// "and N others" phrasing; there is no secret for it, only the built-in
-// translations below.
+// Push copy: the recipient's profiles.locale selects the built-in neutral
+// copy ("{name} is thinking of you" / "… and N others …") — an app with its
+// own reaction semantics overrides it per locale with the COMMUNITY_PUSH_COPY
+// secret (see _shared/copy.ts; the older COMMUNITY_REACTION_PUSH_TEXT single
+// string still works for the single-reactor case).
 //
-// NOTE: profiles.locale is not part of the SDK's core schema yet (task 16) —
-// it must exist before this function can run. See the internal port notes
-// for a reference migration adding it.
+// Security: same as notify-like — only `record.post_id` is read from the
+// untrusted body; everything else comes from post_reactions.
 
 import { adminClient } from "../_shared/client.ts";
 import { sendExpoPush } from "../_shared/push.ts";
-import { FALLBACK_ACTOR_NAME, REACTION_PUSH_TEXT } from "../_shared/config.ts";
+import { pushCopy } from "../_shared/copy.ts";
 
 const supabase = adminClient();
 const COOLDOWN_MS = 10 * 60 * 1000;
 
-/**
- * CLDR plural form for a count: 1 -> `one`, 2-4 -> `few`, 5+ -> `many` (the
- * Polish rule, minus the fractional `other` case a push count never hits).
- * Every other locale below needs only a singular/plural pair.
- */
-function plForm(n: number, one: string, few: string, many: string) {
-  if (n === 1) return one;
-  const lastTwo = n % 100;
-  const inTeens = lastTwo >= 10 && lastTwo < 20;
-  return !inTeens && n % 10 >= 2 && n % 10 <= 4 ? few : many;
-}
-
-// Built-in neutral push copy per recipient locale (profiles.locale). Keys
-// mirror SupportedLanguage in host apps; unknown locales fall back to en.
-// `one` is only used when COMMUNITY_REACTION_PUSH_TEXT is unset (its default
-// already matches the `en` entry below).
-const COPY = {
-  en: {
-    fallbackName: "Someone",
-    one: (name: string) => `${name} is thinking of you`,
-    many: (name: string, extra: number) =>
-      `${name} and ${extra} ${extra === 1 ? "other" : "others"} are thinking of you`,
-  },
-  "pt-PT": {
-    fallbackName: "Alguém",
-    one: (name: string) => `${name} está a pensar em ti`,
-    many: (name: string, extra: number) =>
-      `${name} e mais ${extra} ${extra === 1 ? "pessoa está" : "pessoas estão"} a pensar em ti`,
-  },
-  "pt-BR": {
-    fallbackName: "Alguém",
-    one: (name: string) => `${name} está pensando em você`,
-    many: (name: string, extra: number) =>
-      `${name} e mais ${extra} ${extra === 1 ? "pessoa está" : "pessoas estão"} pensando em você`,
-  },
-  "es-ES": {
-    fallbackName: "Alguien",
-    one: (name: string) => `${name} está pensando en ti`,
-    many: (name: string, extra: number) =>
-      `${name} y ${extra} ${extra === 1 ? "persona más está" : "personas más están"} pensando en ti`,
-  },
-  "es-419": {
-    fallbackName: "Alguien",
-    one: (name: string) => `${name} está pensando en ti`,
-    many: (name: string, extra: number) =>
-      `${name} y ${extra} ${extra === 1 ? "persona más está" : "personas más están"} pensando en ti`,
-  },
-  it: {
-    fallbackName: "Qualcuno",
-    one: (name: string) => `${name} sta pensando a te`,
-    many: (name: string, extra: number) =>
-      `${name} e altre ${extra} ${extra === 1 ? "persona sta" : "persone stanno"} pensando a te`,
-  },
-  pl: {
-    fallbackName: "Ktoś",
-    one: (name: string) => `${name} myśli o tobie`,
-    many: (name: string, extra: number) =>
-      `${name} i ${plForm(extra, `${extra} inna osoba myśli`, `${extra} inne osoby myślą`, `${extra} innych osób myśli`)} o tobie`,
-  },
-} as const;
-
-function copyFor(locale: string | null | undefined) {
-  return COPY[(locale ?? "en") as keyof typeof COPY] ?? COPY.en;
-}
-
 async function flushPost(postId: string) {
   const { data: post } = await supabase.from("posts").select("author_id").eq("id", postId).single();
   if (!post) return;
@@ -98,7 +30,7 @@ async function flushPost(postId: string) {
     .select("locale")
     .eq("id", post.author_id)
     .single();
-  const copy = copyFor(recipient?.locale);
+  const copy = pushCopy(recipient?.locale);
 
   const { data: pref } = await supabase
     .from("push_tokens")
@@ -138,15 +70,11 @@ async function flushPost(postId: string) {
     .select("username")
     .eq("id", contributors[0].user_id)
     .single();
-  // COMMUNITY_FALLBACK_NAME (the deployer-set env var, shared with
-  // notify-like/notify-comment and meant to match the client's
-  // anonymousAuthorFallback — see docs/backend-runbook.md) takes precedence
-  // over the locale table's own fallbackName default.
-  const name = actor?.username?.trim() || FALLBACK_ACTOR_NAME || copy.fallbackName;
+  const name = actor?.username?.trim() || copy.fallbackName;
   const title =
     contributors.length === 1
-      ? REACTION_PUSH_TEXT.replace("{name}", name)
-      : copy.many(name, contributors.length - 1);
+      ? copy.text("reaction.one", { name })
+      : copy.text("reaction.many", { name, count: contributors.length - 1 });
 
   await sendExpoPush({
     to: pref.expo_push_token,

package/templates/functions/report-to-slack/index.ts

@@ -2,35 +2,41 @@
 // record here; we enrich it with the reported account's identity and its
 // cumulative report count, then alert Slack (no-op if SLACK_WEBHOOK_URL is
 // unset — see _shared/slack.ts). Bans stay manual (dashboard).
+//
+// Security: reachable with the anon key, so only `record.id` is trusted; the
+// report row is re-read from the database (a forged body can't inject text
+// into the ops channel or probe another user's report count).
 
 import { adminClient } from "../_shared/client.ts";
 import { postToSlack } from "../_shared/slack.ts";
 
 const supabase = adminClient();
 
-interface ReportRecord {
-  reported_user_id: string;
-  reason: string;
-  details: string | null;
-}
-
 Deno.serve(async (req) => {
-  const { record } = (await req.json()) as { record: ReportRecord };
+  const { record } = (await req.json().catch(() => ({}))) as { record?: { id?: string } };
+  if (!record?.id) return new Response("skip: no id", { status: 400 });
+
+  const { data: report } = await supabase
+    .from("reports")
+    .select("id, reported_user_id, reason, details")
+    .eq("id", record.id)
+    .single();
+  if (!report) return new Response("skip: unknown report");
 
   const { data: reported } = await supabase
     .from("profiles")
     .select("username, amplitude_id, revenuecat_id")
-    .eq("id", record.reported_user_id)
+    .eq("id", report.reported_user_id)
     .single();
   const { count } = await supabase
     .from("reports")
     .select("*", { count: "exact", head: true })
-    .eq("reported_user_id", record.reported_user_id);
+    .eq("reported_user_id", report.reported_user_id);
 
   await postToSlack({
     text:
-      `:rotating_light: Report (*${record.reason}*) against *${reported?.username ?? record.reported_user_id}*, ${count ?? "?"} report(s) total\n` +
-      `${record.details ? `> ${record.details}\n` : ""}` +
+      `:rotating_light: Report (*${report.reason}*) against *${reported?.username ?? report.reported_user_id}*, ${count ?? "?"} report(s) total\n` +
+      `${report.details ? `> ${report.details}\n` : ""}` +
       `amplitude: \`${reported?.amplitude_id ?? "?"}\` | revenuecat: \`${reported?.revenuecat_id ?? "?"}\``,
   });
   return new Response("ok");

package/templates/functions/translate-one/index.ts

@@ -0,0 +1,20 @@
+// Translate one published post or comment into every target locale. Called by
+// the pg_net triggers in translation/001 (anon key, untrusted body: only
+// `kind` and `id` are read, the row is re-read). Idempotent: an item that
+// already has every translation costs no API call.
+
+import { adminClient, json } from "../_shared/client.ts";
+import { ensureTranslations } from "../_shared/translation.ts";
+
+const supabase = adminClient();
+
+Deno.serve(async (req) => {
+  const body = (await req.json().catch(() => ({}))) as { kind?: unknown; id?: unknown };
+  const kind = body.kind === "post" || body.kind === "comment" ? body.kind : null;
+  if (!kind || typeof body.id !== "string")
+    return json({ status: "error", error: "bad request" }, 400);
+
+  const rows = await ensureTranslations(supabase, kind, body.id);
+  if (rows === null) return json({ status: "failed" }, 502);
+  return json({ status: rows.length === 0 ? "skipped" : "ok", locales: rows.map((r) => r.locale) });
+});

package/templates/migrations/core/007_username_moderation.sql

@@ -0,0 +1,44 @@
+-- Username moderation (daily sweep).
+--
+-- `profiles.username` is client-writable by design: the host app syncs its
+-- own onboarding display name straight into it, so it never went through
+-- update-profile's synchronous moderation (handle / bio / avatar do). Revoking
+-- the grant would break the pre-SDK app versions still installed, which write
+-- the column directly, so moderation happens asynchronously instead: the
+-- daily-moderation sweep checks every username it has not checked yet
+-- (`username_checked_at is null`) and blanks the ones the moderation API
+-- flags — the app then shows its anonymous fallback name. `username_rejected`
+-- remembers the last blanked value so a client that re-syncs the same name
+-- (every launch, in both source apps) is silently kept blank instead of
+-- getting re-flagged every night.
+--
+-- Neither column is in the client-facing SELECT / UPDATE grants (core/002
+-- scopes both to an explicit column list), so clients can't read or tamper
+-- with the moderation state.
+alter table public.profiles
+  add column if not exists username_checked_at timestamptz,
+  add column if not exists username_rejected text;
+
+create or replace function public.profiles_username_changed()
+returns trigger language plpgsql as $$
+begin
+  if new.username is distinct from old.username then
+    if new.username is not null and new.username = old.username_rejected then
+      -- Re-sync of a name the sweep already blanked: keep it blank.
+      new.username := null;
+    else
+      -- A genuinely new name: re-check it on the next sweep.
+      new.username_checked_at := null;
+    end if;
+  end if;
+  return new;
+end;
+$$;
+
+drop trigger if exists profiles_username_changed_trg on public.profiles;
+create trigger profiles_username_changed_trg
+  before update of username on public.profiles
+  for each row execute function public.profiles_username_changed();
+
+-- Existing usernames are checked by the first sweeps after this migration
+-- (batches of up to 1000 per run, see daily-moderation).

package/templates/migrations/polls/001_polls.sql

@@ -118,3 +118,27 @@ $$;
 
 revoke execute on function public.create_poll_post(text, text, text[]) from public, anon;
 grant execute on function public.create_poll_post(text, text, text[]) to authenticated;
+
+-- ============ TRANSLATION (installed after the translation module) ============
+-- translation/001 creates poll_option_translations only when poll_options
+-- already exists; when polls is added later (`upgrade --add-modules polls` on
+-- a translation-enabled backend) this block creates it instead. Same
+-- definition as translation/001's guarded block.
+do $$
+begin
+  if to_regclass('public.post_translations') is not null then
+    create table if not exists public.poll_option_translations (
+      option_id uuid not null references public.poll_options(id) on delete cascade,
+      locale    text not null,
+      content   text not null,
+      primary key (option_id, locale)
+    );
+    alter table public.poll_option_translations enable row level security;
+    drop policy if exists "poll option translations readable where option readable"
+      on public.poll_option_translations;
+    create policy "poll option translations readable where option readable"
+      on public.poll_option_translations for select to authenticated
+      using (exists (select 1 from public.poll_options o where o.id = poll_option_translations.option_id));
+    grant select on public.poll_option_translations to authenticated;
+  end if;
+end $$;

package/templates/migrations/translation/001_translations.sql

@@ -0,0 +1,190 @@
+-- Translation module: posts, comments and poll option labels translated at
+-- publication into the app's declared locales (COMMUNITY_TRANSLATION_LOCALES
+-- secret, mirrored by the client's modules.translation.locales), shown in the
+-- reader's language by @rocapine/community-ui with a per-item "see original".
+--
+-- Written only by the service role (translate-one / daily-translation Edge
+-- Functions). Readable by authenticated users where the parent row is
+-- readable (RLS on posts/comments does the filtering, same pattern as
+-- likes). Additive: no core table changes. poll_option_translations is
+-- guarded so this module installs on a backend without the polls module.
+--
+-- ⚠️ PLACEHOLDERS: before pushing, replace __SUPABASE_PROJECT_URL__ with the
+-- app's project URL (https://<ref>.supabase.co) and __SUPABASE_ANON_KEY__ with
+-- its anon key. The anon key is public by design (shipped inside the app
+-- binary): the Edge Functions do privileged work through their own
+-- service-role env, the JWT only passes verify_jwt.
+--
+-- The DO block below fails the migration loudly if the placeholders were not
+-- replaced.
+do $$ begin
+  if '__SUPABASE_PROJECT_URL__' like '\_\_SUPABASE%' escape '\' then
+    raise exception 'community-sdk: placeholders not substituted. Run: npx @rocapine/community init';
+  end if;
+end $$;
+
+create table public.post_translations (
+  post_id       uuid not null references public.posts(id) on delete cascade,
+  locale        text not null,
+  source_locale text not null,
+  content       text not null,
+  engine        text not null,
+  created_at    timestamptz not null default now(),
+  primary key (post_id, locale)
+);
+alter table public.post_translations enable row level security;
+create policy "post translations readable where post readable"
+  on public.post_translations for select to authenticated
+  using (exists (select 1 from public.posts p where p.id = post_translations.post_id));
+grant select on public.post_translations to authenticated;
+
+create table public.comment_translations (
+  comment_id    uuid not null references public.comments(id) on delete cascade,
+  locale        text not null,
+  source_locale text not null,
+  content       text not null,
+  engine        text not null,
+  created_at    timestamptz not null default now(),
+  primary key (comment_id, locale)
+);
+alter table public.comment_translations enable row level security;
+create policy "comment translations readable where comment readable"
+  on public.comment_translations for select to authenticated
+  using (exists (select 1 from public.comments c where c.id = comment_translations.comment_id));
+grant select on public.comment_translations to authenticated;
+
+do $$
+begin
+  if to_regclass('public.poll_options') is not null then
+    create table if not exists public.poll_option_translations (
+      option_id uuid not null references public.poll_options(id) on delete cascade,
+      locale    text not null,
+      content   text not null,
+      primary key (option_id, locale)
+    );
+    alter table public.poll_option_translations enable row level security;
+    drop policy if exists "poll option translations readable where option readable"
+      on public.poll_option_translations;
+    create policy "poll option translations readable where option readable"
+      on public.poll_option_translations for select to authenticated
+      using (exists (select 1 from public.poll_options o where o.id = poll_option_translations.option_id));
+    grant select on public.poll_option_translations to authenticated;
+  end if;
+end $$;
+
+-- ============ SWEEP HELPER ============
+-- Visible items that lack at least one target locale other than their own
+-- source language. Marker rows are not translations: 'source' (the detected
+-- source had nothing to translate) and 'attempt' (a translation claim, deleted
+-- on success). Items with no row at all have an unknown source and are always
+-- returned; an item with an 'attempt' younger than 6 h is skipped (in flight,
+-- or failed recently — retried once it ages out). Service role only.
+create or replace function public.items_missing_translations(
+  kind text, target_locales text[], max_items int
+) returns table (id uuid)
+language sql stable security definer set search_path = public as $$
+  select x.id from (
+    select p.id, p.created_at,
+      exists (select 1 from public.post_translations t where t.post_id = p.id) as has_any,
+      (select array_agg(t.locale) filter (where t.locale not in ('source', 'attempt'))
+         from public.post_translations t where t.post_id = p.id) as have,
+      (select min(t.source_locale) filter (where t.locale <> 'attempt')
+         from public.post_translations t where t.post_id = p.id) as src,
+      exists (select 1 from public.post_translations t
+               where t.post_id = p.id and t.locale = 'attempt'
+                 and t.created_at > now() - interval '6 hours') as fresh_attempt
+    from public.posts p where kind = 'post' and p.status = 'visible'
+    union all
+    select c.id, c.created_at,
+      exists (select 1 from public.comment_translations t where t.comment_id = c.id) as has_any,
+      (select array_agg(t.locale) filter (where t.locale not in ('source', 'attempt'))
+         from public.comment_translations t where t.comment_id = c.id) as have,
+      (select min(t.source_locale) filter (where t.locale <> 'attempt')
+         from public.comment_translations t where t.comment_id = c.id) as src,
+      exists (select 1 from public.comment_translations t
+               where t.comment_id = c.id and t.locale = 'attempt'
+                 and t.created_at > now() - interval '6 hours') as fresh_attempt
+    from public.comments c where kind = 'comment' and c.status = 'visible'
+  ) x
+  where not x.fresh_attempt
+    and (not x.has_any
+      or exists (
+        select 1 from unnest(target_locales) l
+        -- `is distinct from`: src is null when the only row is a stale attempt
+        -- (a failed try), and that item must be retried.
+        where split_part(l, '-', 1) is distinct from x.src
+          and not (l = any (coalesce(x.have, '{}')))
+      ))
+  order by x.created_at desc
+  limit max_items
+$$;
+revoke execute on function public.items_missing_translations(text, text[], int) from public, anon, authenticated;
+grant execute on function public.items_missing_translations(text, text[], int) to service_role;
+
+-- ============ TRIGGERS ============
+create or replace function public.translate_post_webhook()
+returns trigger language plpgsql security definer set search_path = public as $$
+begin
+  perform net.http_post(
+    url := '__SUPABASE_PROJECT_URL__/functions/v1/translate-one',
+    headers := jsonb_build_object('Content-Type','application/json','Authorization','Bearer __SUPABASE_ANON_KEY__'),
+    body := jsonb_build_object('kind', 'post', 'id', new.id)
+  );
+  return new;
+end; $$;
+
+create or replace function public.translate_comment_webhook()
+returns trigger language plpgsql security definer set search_path = public as $$
+begin
+  perform net.http_post(
+    url := '__SUPABASE_PROJECT_URL__/functions/v1/translate-one',
+    headers := jsonb_build_object('Content-Type','application/json','Authorization','Bearer __SUPABASE_ANON_KEY__'),
+    body := jsonb_build_object('kind', 'comment', 'id', new.id)
+  );
+  return new;
+end; $$;
+
+drop trigger if exists on_post_published_translate on public.posts;
+create trigger on_post_published_translate
+  after update of status on public.posts for each row
+  when (old.status = 'pending' and new.status = 'visible')
+  execute function public.translate_post_webhook();
+drop trigger if exists on_post_created_visible_translate on public.posts;
+create trigger on_post_created_visible_translate
+  after insert on public.posts for each row
+  when (new.status = 'visible')
+  execute function public.translate_post_webhook();
+
+drop trigger if exists on_comment_published_translate on public.comments;
+create trigger on_comment_published_translate
+  after update of status on public.comments for each row
+  when (old.status = 'pending' and new.status = 'visible')
+  execute function public.translate_comment_webhook();
+drop trigger if exists on_comment_created_visible_translate on public.comments;
+create trigger on_comment_created_visible_translate
+  after insert on public.comments for each row
+  when (new.status = 'visible')
+  execute function public.translate_comment_webhook();
+
+-- ============ CRON ============
+-- Daily sweep at 08:30 UTC (after the 08:00 moderation sweep): back-fills the
+-- history on first installation, then catches anything translate-one missed.
+do $$
+begin
+  perform cron.schedule(
+    'community-translation-sweep',
+    '30 8 * * *',
+    $cron$
+    select net.http_post(
+      url := '__SUPABASE_PROJECT_URL__/functions/v1/daily-translation',
+      headers := jsonb_build_object('Authorization', 'Bearer __SUPABASE_ANON_KEY__')
+    );
+    $cron$
+  );
+exception when others then
+  if sqlerrm like '%already exists%' then
+    raise notice 'cron job community-translation-sweep already scheduled, skipping';
+  else
+    raise;
+  end if;
+end $$;