@rocapine/community 0.1.0

package/templates/functions/report-to-slack/index.ts

@@ -0,0 +1,37 @@
+// Real-time report alert: a pg_net trigger on INSERT INTO reports posts the
+// record here; we enrich it with the reported account's identity and its
+// cumulative report count, then alert Slack (no-op if SLACK_WEBHOOK_URL is
+// unset — see _shared/slack.ts). Bans stay manual (dashboard).
+
+import { adminClient } from "../_shared/client.ts";
+import { postToSlack } from "../_shared/slack.ts";
+
+const supabase = adminClient();
+
+interface ReportRecord {
+  reported_user_id: string;
+  reason: string;
+  details: string | null;
+}
+
+Deno.serve(async (req) => {
+  const { record } = (await req.json()) as { record: ReportRecord };
+
+  const { data: reported } = await supabase
+    .from("profiles")
+    .select("username, amplitude_id, revenuecat_id")
+    .eq("id", record.reported_user_id)
+    .single();
+  const { count } = await supabase
+    .from("reports")
+    .select("*", { count: "exact", head: true })
+    .eq("reported_user_id", record.reported_user_id);
+
+  await postToSlack({
+    text:
+      `:rotating_light: Report (*${record.reason}*) against *${reported?.username ?? record.reported_user_id}*, ${count ?? "?"} report(s) total\n` +
+      `${record.details ? `> ${record.details}\n` : ""}` +
+      `amplitude: \`${reported?.amplitude_id ?? "?"}\` | revenuecat: \`${reported?.revenuecat_id ?? "?"}\``,
+  });
+  return new Response("ok");
+});

package/templates/functions/update-profile/index.ts

@@ -0,0 +1,131 @@
+// update-profile: the ONLY write path for profiles.handle / bio / avatar_url.
+// JWT-authenticated: uid comes from the caller's anon session token, never the
+// body. Text fields run through OpenAI omni-moderation (same category logic
+// as moderate-one); avatarPath runs image moderation on the object's public
+// URL. Fail closed: if moderation is unreachable, nothing is written.
+//
+// Fields are applied sequentially (handle, then bio, then avatar); the first
+// failure aborts and reports its field. The app's editors send one field at a
+// time, so partial application is not observable in practice.
+
+import { createClient } from "jsr:@supabase/supabase-js@2";
+import { adminClient, json, SUPABASE_URL } from "../_shared/client.ts";
+import { assertModerationConfigured, moderateInput } from "../_shared/moderation.ts";
+
+assertModerationConfigured();
+
+const admin = adminClient();
+
+Deno.serve(async (req) => {
+  const caller = createClient(SUPABASE_URL, Deno.env.get("SUPABASE_ANON_KEY")!, {
+    global: { headers: { Authorization: req.headers.get("Authorization") ?? "" } },
+  });
+  const { data: userData } = await caller.auth.getUser();
+  const uid = userData.user?.id;
+  if (!uid) return json({ status: "error", error: "unauthorized" }, 401);
+
+  let body: { handle?: unknown; bio?: unknown; avatarPath?: unknown };
+  try {
+    body = await req.json();
+  } catch {
+    return json({ status: "error", error: "bad request" }, 400);
+  }
+  const { handle, bio, avatarPath } = body;
+  if (handle === undefined && bio === undefined && avatarPath === undefined) {
+    return json({ status: "error", error: "bad request" }, 400);
+  }
+  if (
+    (handle !== undefined && typeof handle !== "string") ||
+    (bio !== undefined && typeof bio !== "string") ||
+    (avatarPath !== undefined && typeof avatarPath !== "string")
+  ) {
+    return json({ status: "error", error: "bad request" }, 400);
+  }
+
+  // ============ HANDLE ============
+  if (handle !== undefined) {
+    const h = (handle as string).trim().toLowerCase();
+    if (!/^[a-z0-9-]{3,20}$/.test(h)) {
+      return json({ status: "error", error: "invalid_handle" }, 400);
+    }
+    const verdict = await moderateInput(h);
+    if (!verdict) return json({ status: "error", error: "moderation unavailable" }, 503);
+    if (verdict.flagged) {
+      return json({ status: "rejected", field: "handle", reason: verdict.reason });
+    }
+    const { error } = await admin.from("profiles").update({ handle: h }).eq("id", uid);
+    if (error) {
+      if (error.code === "23505") {
+        return json({ status: "error", code: "handle_taken" }, 409);
+      }
+      return json({ status: "error", error: error.message }, 500);
+    }
+  }
+
+  // ============ BIO ============
+  if (bio !== undefined) {
+    const b = (bio as string).trim();
+    if (b.length > 300) {
+      return json({ status: "error", error: "bio_too_long" }, 400);
+    }
+    if (b !== "") {
+      const verdict = await moderateInput(b);
+      if (!verdict) return json({ status: "error", error: "moderation unavailable" }, 503);
+      if (verdict.flagged) {
+        return json({ status: "rejected", field: "bio", reason: verdict.reason });
+      }
+    }
+    // Clearing the bio (empty string -> null) needs no moderation.
+    const { error } = await admin
+      .from("profiles")
+      .update({ bio: b === "" ? null : b })
+      .eq("id", uid);
+    if (error) return json({ status: "error", error: error.message }, 500);
+  }
+
+  // ============ AVATAR ============
+  if (avatarPath !== undefined) {
+    const path = avatarPath as string;
+    if (!path.startsWith(`${uid}/`) || path.includes("..")) {
+      return json({ status: "error", error: "forbidden_path" }, 403);
+    }
+    const publicUrl = `${SUPABASE_URL}/storage/v1/object/public/avatars/${path}`;
+    const verdict = await moderateInput([{ type: "image_url", image_url: { url: publicUrl } }]);
+    if (!verdict) return json({ status: "error", error: "moderation unavailable" }, 503);
+    if (verdict.flagged) {
+      await admin.storage.from("avatars").remove([path]);
+      return json({ status: "rejected", field: "avatar", reason: verdict.reason });
+    }
+
+    const { data: prevProfile } = await admin
+      .from("profiles")
+      .select("avatar_url")
+      .eq("id", uid)
+      .single();
+    const { error } = await admin.from("profiles").update({ avatar_url: publicUrl }).eq("id", uid);
+    if (error) return json({ status: "error", error: error.message }, 500);
+
+    const previousUrl = prevProfile?.avatar_url as string | null | undefined;
+    if (previousUrl && previousUrl !== publicUrl) {
+      const marker = "/object/public/avatars/";
+      const idx = previousUrl.indexOf(marker);
+      if (idx !== -1) {
+        // Best-effort: replacement cleanup should never block the response.
+        await admin.storage.from("avatars").remove([previousUrl.slice(idx + marker.length)]);
+      }
+    }
+  }
+
+  // ============ SUCCESS ============
+  const { data: profile } = await admin
+    .from("profiles")
+    .select("handle, bio, avatar_url")
+    .eq("id", uid)
+    .single();
+  return json({
+    status: "ok",
+    handle: profile?.handle ?? null,
+    bio: profile?.bio ?? null,
+    avatarUrl: profile?.avatar_url ?? null,
+  });
+});

package/templates/migrations/core/001_tables.sql

@@ -0,0 +1,177 @@
+-- community-sdk core/001_tables.sql (schema v1)
+-- Community SDK — 01 core schema.
+-- Fresh-install consolidation of the community tables in their FINAL shape.
+-- Extracted from Eve's Rhythm (supabase/migrations 20260708090000 → 20260729120000
+-- on main); the resulting schema is identical, without the historical churn.
+
+create extension if not exists unaccent;
+
+-- ============ PROFILES ============
+-- One row per auth user (anonymous ones included), created by trigger.
+create table public.profiles (
+  id uuid primary key references auth.users(id) on delete cascade,
+  -- Display name. NOT unique: apps may publish under real first names.
+  username text,
+  -- Stable public identity (slug-1234), assigned once by trigger when
+  -- username first becomes non-null. Never client-writable.
+  handle text unique,
+  -- Moderated fields: the update-profile Edge Function is the ONLY write path.
+  bio text check (char_length(bio) <= 300),
+  avatar_url text,
+  -- Optional links to the host app's analytics / IAP identities.
+  amplitude_id text,
+  revenuecat_id text,
+  is_banned boolean not null default false,
+  -- Team-run account: excluded from the dashboard's adoption metrics.
+  is_house boolean not null default false,
+  -- Verified seal in the app + right to post in the restricted news topic.
+  is_official boolean not null default false,
+  created_at timestamptz not null default now()
+);
+
+-- Auto-create a profile for every new auth user (incl. anonymous ones).
+create or replace function public.handle_new_user()
+returns trigger
+language plpgsql
+security definer set search_path = public
+as $$
+begin
+  insert into public.profiles (id) values (new.id);
+  return new;
+end;
+$$;
+
+create trigger on_auth_user_created
+  after insert on auth.users
+  for each row execute function public.handle_new_user();
+
+-- slug(base) + '-' + random 4-digit suffix; retries on collision and
+-- widens to 6 digits after 5 collisions (guaranteed exit). VOLATILE so
+-- the existence check sees rows already updated by the calling statement.
+create or replace function public.generate_handle(base text)
+returns text
+language plpgsql volatile security definer
+set search_path = public, extensions
+as $$
+declare
+  slug text;
+  candidate text;
+  tries int := 0;
+begin
+  slug := lower(unaccent(coalesce(base, '')));
+  slug := regexp_replace(slug, '[^a-z0-9]', '', 'g');
+  slug := left(slug, 12);
+  if slug = '' then
+    slug := 'member';
+  end if;
+  loop
+    if tries < 5 then
+      candidate := slug || '-' || (floor(random() * 9000) + 1000)::int;
+    else
+      candidate := slug || '-' || (floor(random() * 900000) + 100000)::int;
+    end if;
+    exit when not exists (select 1 from public.profiles where handle = candidate);
+    tries := tries + 1;
+  end loop;
+  return candidate;
+end;
+$$;
+
+-- Assign once, the first time username becomes non-null. A later name change
+-- never re-assigns the handle (stable identity).
+create or replace function public.assign_handle()
+returns trigger
+language plpgsql security definer
+set search_path = public, extensions
+as $$
+begin
+  if new.handle is null and new.username is not null then
+    new.handle := public.generate_handle(new.username);
+  end if;
+  return new;
+end;
+$$;
+
+create trigger profiles_assign_handle
+  before insert or update of username on public.profiles
+  for each row execute function public.assign_handle();
+
+-- ============ POSTS ============
+create table public.posts (
+  id uuid primary key default gen_random_uuid(),
+  author_id uuid not null references public.profiles(id) on delete cascade,
+  content text not null check (char_length(content) between 1 and 2000),
+  -- Optional app-defined category (client-side vocabulary, no check).
+  -- Convention: 'news' is reserved for official accounts (RLS-enforced).
+  topic text,
+  -- pending: awaiting moderation | visible: published |
+  -- hidden: masked by moderation | deleted: by author (soft delete)
+  status text not null default 'pending'
+    check (status in ('pending', 'visible', 'hidden', 'deleted')),
+  moderated_at timestamptz,          -- null = not yet seen by the AI batch
+  moderation_reason text,            -- set by the AI when hidden
+  -- Pinning is a dashboard (service role) operation; the feed orders by
+  -- pinned_at desc nulls last.
+  pinned_at timestamptz,
+  -- Human review trail (dashboard).
+  reviewed_at timestamptz,
+  reviewed_by text,
+  created_at timestamptz not null default now()
+);
+create index posts_feed_idx on public.posts (status, created_at desc);
+create index posts_moderation_idx on public.posts (created_at) where moderated_at is null;
+create index posts_pinned_idx on public.posts (pinned_at desc) where pinned_at is not null;
+
+-- ============ COMMENTS ============
+create table public.comments (
+  id uuid primary key default gen_random_uuid(),
+  post_id uuid not null references public.posts(id) on delete cascade,
+  author_id uuid not null references public.profiles(id) on delete cascade,
+  content text not null check (char_length(content) between 1 and 1000),
+  status text not null default 'pending'
+    check (status in ('pending', 'visible', 'hidden', 'deleted')),
+  moderated_at timestamptz,
+  moderation_reason text,
+  reviewed_at timestamptz,
+  reviewed_by text,
+  created_at timestamptz not null default now()
+);
+create index comments_post_idx on public.comments (post_id, created_at);
+create index comments_moderation_idx on public.comments (created_at) where moderated_at is null;
+
+-- ============ LIKES ============
+create table public.likes (
+  post_id uuid not null references public.posts(id) on delete cascade,
+  user_id uuid not null references public.profiles(id) on delete cascade,
+  created_at timestamptz not null default now(),
+  -- Push-module coalescing marker (harmless if the push module is skipped).
+  notified_at timestamptz,
+  primary key (post_id, user_id)
+);
+
+-- ============ BLOCKS ============
+create table public.blocks (
+  blocker_id uuid not null references public.profiles(id) on delete cascade,
+  blocked_id uuid not null references public.profiles(id) on delete cascade,
+  created_at timestamptz not null default now(),
+  primary key (blocker_id, blocked_id),
+  check (blocker_id <> blocked_id)
+);
+
+-- ============ REPORTS ============
+create table public.reports (
+  id uuid primary key default gen_random_uuid(),
+  reporter_id uuid not null references public.profiles(id) on delete cascade,
+  reported_user_id uuid not null references public.profiles(id) on delete cascade,
+  post_id uuid references public.posts(id) on delete set null,
+  comment_id uuid references public.comments(id) on delete set null,
+  reason text not null check (reason in ('spam','harassment','hate','inappropriate','other')),
+  details text,
+  status text not null default 'open' check (status in ('open','resolved')),
+  -- Dashboard resolution trail.
+  resolved_at timestamptz,
+  resolved_by text,
+  resolution text check (resolution in ('content_hidden','rejected','user_banned')),
+  created_at timestamptz not null default now(),
+  check (post_id is not null or comment_id is not null)
+);

package/templates/migrations/core/002_rls.sql

@@ -0,0 +1,154 @@
+-- community-sdk core/002_rls.sql (schema v1)
+-- Community SDK — 02 RLS + grants (final state).
+-- The client never filters blocked/hidden content itself; these policies are
+-- the single enforcement point. Publication is gated server-side: clients can
+-- ONLY insert 'pending' content, promotion to 'visible' is done by the
+-- moderation Edge Functions (service role).
+
+alter table public.profiles enable row level security;
+alter table public.posts    enable row level security;
+alter table public.comments enable row level security;
+alter table public.likes    enable row level security;
+alter table public.blocks   enable row level security;
+alter table public.reports  enable row level security;
+
+-- Helper: is the current user banned? Missing profile counts as banned.
+create or replace function public.current_user_banned()
+returns boolean
+language sql stable security definer set search_path = public
+as $$
+  select coalesce((select is_banned from profiles where id = auth.uid()), true);
+$$;
+
+create or replace function public.current_user_official()
+returns boolean
+language sql stable security definer set search_path = public
+as $$
+  select coalesce((select is_official from profiles where id = auth.uid()), false);
+$$;
+
+-- ============ PROFILES ============
+create policy "profiles readable by authenticated"
+  on public.profiles for select to authenticated using (true);
+
+create policy "update own profile"
+  on public.profiles for update to authenticated
+  using (id = auth.uid())
+  with check (id = auth.uid() and is_banned = false); -- no self-unban
+
+-- Users may only write display/identity fields. is_banned is not updatable
+-- by users at all; handle/bio/avatar_url are written exclusively by the
+-- update-profile Edge Function (service role) so they are always moderated.
+revoke update on table public.profiles from authenticated;
+grant update (username, amplitude_id, revenuecat_id) on table public.profiles to authenticated;
+
+-- Column-scoped select: the RLS policy above only decides which ROWS are
+-- visible, not which COLUMNS — PostgREST otherwise happily returns every
+-- column, including amplitude_id/revenuecat_id/is_banned/is_house, to any
+-- authenticated (or anon, before the policy's `to authenticated` even
+-- applies at the grant level) caller. The client only ever reads the public
+-- identity surface (service.ts FEED_SELECT/PROFILE_SELECT, plus the
+-- update-profile Edge Function payloads) — is_official stays readable, it's
+-- the UI's "official" seal.
+revoke select on public.profiles from anon, authenticated;
+grant select (id, username, handle, bio, avatar_url, is_official, created_at)
+  on public.profiles to anon, authenticated;
+
+-- ============ POSTS ============
+-- The heart of blocking: blocked authors' posts vanish from every query.
+create policy "read visible posts, minus blocked authors"
+  on public.posts for select to authenticated
+  using (
+    author_id = auth.uid()  -- authors always see their own posts (even hidden)
+    or (
+      status = 'visible'
+      and not exists (
+        select 1 from public.blocks b
+        where b.blocker_id = auth.uid() and b.blocked_id = posts.author_id
+      )
+    )
+  );
+
+-- pending-only insert + the news guard: a tampered client can neither
+-- self-publish nor post under the brand channel.
+create policy "insert own posts if not banned"
+  on public.posts for insert to authenticated
+  with check (
+    author_id = auth.uid()
+    and not public.current_user_banned()
+    and status = 'pending'
+    and (topic is distinct from 'news' or public.current_user_official())
+  );
+
+create policy "author can soft-delete own post"
+  on public.posts for update to authenticated
+  using (author_id = auth.uid())
+  with check (author_id = auth.uid() and status = 'deleted'); -- only allowed change
+
+-- Column-scoped grants: the app only ever inserts (author_id, topic, content);
+-- id/status/created_at come from defaults. Without this, a tampered client
+-- could pre-set pinned_at or stamp the moderation trail at insert time.
+revoke insert on table public.posts from authenticated;
+grant insert (author_id, topic, content) on table public.posts to authenticated;
+-- Authors may only write status (soft delete); content and the moderation
+-- trail stay immutable from the client.
+revoke update on table public.posts from authenticated;
+grant update (status) on table public.posts to authenticated;
+
+-- ============ COMMENTS ============ (same rules)
+create policy "read visible comments, minus blocked authors"
+  on public.comments for select to authenticated
+  using (
+    author_id = auth.uid()
+    or (
+      status = 'visible'
+      and not exists (
+        select 1 from public.blocks b
+        where b.blocker_id = auth.uid() and b.blocked_id = comments.author_id
+      )
+    )
+  );
+
+create policy "insert own comments if not banned"
+  on public.comments for insert to authenticated
+  with check (
+    author_id = auth.uid() and not public.current_user_banned() and status = 'pending'
+  );
+
+create policy "author can soft-delete own comment"
+  on public.comments for update to authenticated
+  using (author_id = auth.uid())
+  with check (author_id = auth.uid() and status = 'deleted');
+
+revoke insert on table public.comments from authenticated;
+grant insert (post_id, author_id, content) on table public.comments to authenticated;
+revoke update on table public.comments from authenticated;
+grant update (status) on table public.comments to authenticated;
+
+-- ============ LIKES ============
+-- Only readable where the underlying post is readable, so the like graph of
+-- hidden/deleted/blocked posts does not leak. The subquery on posts runs
+-- under the posts RLS of the querying user.
+create policy "likes readable where post readable"
+  on public.likes for select to authenticated
+  using (exists (select 1 from public.posts p where p.id = likes.post_id));
+
+create policy "like as self" on public.likes for insert to authenticated
+  with check (user_id = auth.uid() and not public.current_user_banned());
+
+create policy "unlike as self" on public.likes for delete to authenticated
+  using (user_id = auth.uid());
+
+-- ============ BLOCKS ============
+create policy "manage own blocks" on public.blocks for all to authenticated
+  using (blocker_id = auth.uid()) with check (blocker_id = auth.uid());
+
+-- ============ REPORTS ============
+create policy "report as self" on public.reports for insert to authenticated
+  with check (reporter_id = auth.uid());
+-- No SELECT for users: reports are read via service role / dashboard only.
+
+-- ============ RPC SURFACE HYGIENE ============
+-- generate_handle is internal to the assign trigger (security definer, owner
+-- keeps execute); no client needs to call it.
+revoke execute on function public.generate_handle(text) from public, anon, authenticated;

package/templates/migrations/core/003_moderation.sql

@@ -0,0 +1,68 @@
+-- community-sdk core/003_moderation.sql (schema v1)
+-- Community SDK — 03 moderation plumbing: daily cron batch + real-time report
+-- webhook.
+--
+-- ⚠️ PLACEHOLDERS: before pushing, replace __SUPABASE_PROJECT_URL__ with the
+-- app's project URL (https://<ref>.supabase.co) and __SUPABASE_ANON_KEY__ with
+-- its anon key. The anon key is public by design (shipped inside the app
+-- binary): the Edge Functions do privileged work through their own
+-- service-role env, the JWT only passes verify_jwt.
+--
+-- The DO block below fails the migration loudly if the placeholders were not
+-- replaced.
+do $$ begin
+  if '__SUPABASE_PROJECT_URL__' like '\_\_SUPABASE%' escape '\' then
+    raise exception 'community-sdk: placeholders not substituted. Run: npx @rocapine/community init';
+  end if;
+end $$;
+
+create extension if not exists pg_cron;
+create extension if not exists pg_net;
+
+-- Real-time: forward each new report to the report-to-slack Edge Function.
+create or replace function public.notify_report_webhook()
+returns trigger
+language plpgsql
+security definer set search_path = public
+as $$
+begin
+  perform net.http_post(
+    url := '__SUPABASE_PROJECT_URL__/functions/v1/report-to-slack',
+    headers := jsonb_build_object(
+      'Content-Type', 'application/json',
+      'Authorization', 'Bearer __SUPABASE_ANON_KEY__'
+    ),
+    body := jsonb_build_object('record', to_jsonb(new))
+  );
+  return new;
+end;
+$$;
+
+drop trigger if exists on_report_created on public.reports;
+create trigger on_report_created
+  after insert on public.reports
+  for each row execute function public.notify_report_webhook();
+
+-- Daily 08:00 UTC moderation batch. Wrapped defensively: cron.schedule
+-- upserts by job name, but if a prior manual run already created the job
+-- and this raises anyway, do not fail the whole migration on a rerun.
+do $$
+begin
+  perform cron.schedule(
+    'daily-moderation',
+    '0 8 * * *',
+    $cron$
+    select net.http_post(
+      url := '__SUPABASE_PROJECT_URL__/functions/v1/daily-moderation',
+      headers := jsonb_build_object('Authorization', 'Bearer __SUPABASE_ANON_KEY__')
+    );
+    $cron$
+  );
+exception when others then
+  if sqlerrm like '%already exists%' then
+    raise notice 'cron job daily-moderation already scheduled, skipping';
+  else
+    raise;
+  end if;
+end;
+$$;

package/templates/migrations/core/004_dashboard.sql

@@ -0,0 +1,102 @@
+-- community-sdk core/004_dashboard.sql (schema v1)
+-- Community SDK — 04 dashboard support: what the Rocactopus dashboard needs
+-- to moderate this app (admin allow-list, audit log, aggregation view,
+-- metrics RPC). The review/resolution columns live in core/001_tables.sql.
+--
+-- admin_user_stats and admin_daily_metrics are service-role/dashboard only:
+-- the view runs with security_invoker=off (so it can see every row) and both
+-- expose PII (amplitude_id, revenuecat_id, is_banned) — client roles must
+-- never be able to select/execute them.
+
+create table public.admin_users (
+  email text primary key,
+  created_at timestamptz not null default now()
+);
+alter table public.admin_users enable row level security;
+-- No policy: readable only by the service role.
+
+create table public.moderation_actions (
+  id uuid primary key default gen_random_uuid(),
+  actor_email text not null,
+  action text not null check (action in
+    ('hide','restore','confirm_hide','reject_report','ban','unban')),
+  target_post_id uuid references public.posts(id) on delete set null,
+  target_comment_id uuid references public.comments(id) on delete set null,
+  target_user_id uuid references public.profiles(id) on delete set null,
+  note text,
+  created_at timestamptz not null default now()
+);
+alter table public.moderation_actions enable row level security;
+create index moderation_actions_user_idx on public.moderation_actions (target_user_id, created_at desc);
+
+create view public.admin_user_stats
+with (security_invoker = off) as
+select
+  p.id, p.username, p.is_banned, p.is_house, p.created_at,
+  p.amplitude_id, p.revenuecat_id,
+  (select count(*) from posts    where author_id = p.id and status <> 'deleted') as post_count,
+  (select count(*) from comments where author_id = p.id and status <> 'deleted') as comment_count,
+  (select count(*) from posts    where author_id = p.id and status = 'hidden')
+    + (select count(*) from comments where author_id = p.id and status = 'hidden') as hidden_count,
+  (select count(*) from reports  where reported_user_id = p.id) as reports_received,
+  (select count(*) from blocks   where blocked_id = p.id) as blocked_by_count
+from profiles p;
+
+revoke select on public.admin_user_stats from public, anon, authenticated;
+
+-- Daily series for /overview in one call. Adoption metrics exclude house accounts.
+create or replace function public.admin_daily_metrics(from_date date, to_date date)
+returns jsonb
+language sql
+stable
+as $$
+  with days as (
+    select generate_series(from_date, to_date, interval '1 day')::date as day
+  ),
+  human as (select id from profiles where is_house = false),
+  daily_posts as (
+    select p.created_at::date as day, count(*) as n
+    from posts p
+    where p.status <> 'deleted' and p.created_at::date between from_date and to_date
+    group by 1),
+  daily_comments as (
+    select c.created_at::date as day, count(*) as n
+    from comments c
+    where c.status <> 'deleted' and c.created_at::date between from_date and to_date
+    group by 1),
+  first_post as (
+    select author_id, min(created_at)::date as first_day
+    from posts where author_id in (select id from human) group by author_id),
+  new_posters as (
+    select first_day as day, count(*) as n from first_post
+    where first_day between from_date and to_date group by 1),
+  daily_hidden as (
+    select moderated_at::date as day, count(*) as n
+    from posts where status='hidden' and moderated_at::date between from_date and to_date
+    group by 1),
+  topics as (
+    select coalesce(topic,'(sans)') as topic, count(*) as n
+    from posts where status <> 'deleted' and created_at::date between from_date and to_date
+    group by 1),
+  reply_rate as (
+    select count(*) filter (where exists (
+        select 1 from comments c
+        where c.post_id = p.id and c.created_at <= p.created_at + interval '24 hours'))::float
+      / nullif(count(*),0) as rate
+    from posts p
+    where p.status <> 'deleted' and p.author_id in (select id from human)
+      and p.created_at::date between from_date and to_date)
+  select jsonb_build_object(
+    'daily', (select coalesce(jsonb_agg(jsonb_build_object(
+        'day', d.day, 'posts', coalesce(dp.n,0), 'comments', coalesce(dc.n,0),
+        'new_posters', coalesce(np.n,0), 'hidden', coalesce(dh.n,0)) order by d.day), '[]'::jsonb)
+      from days d
+      left join daily_posts dp on dp.day=d.day
+      left join daily_comments dc on dc.day=d.day
+      left join new_posters np on np.day=d.day
+      left join daily_hidden dh on dh.day=d.day),
+    'topics', (select coalesce(jsonb_agg(jsonb_build_object('topic',topic,'count',n) order by n desc),'[]'::jsonb) from topics),
+    'reply_rate', (select coalesce(rate,0) from reply_rate));
+$$;
+
+revoke execute on function public.admin_daily_metrics(date, date) from public, anon, authenticated;