@rocapine/community 0.11.0 → 0.12.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rocapine/community",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "CLI to install, upgrade and adopt the Rocapine Community SDK's Supabase backend (migrations, Edge Functions) into a project.",
   "license": "MIT",
   "repository": {

package/templates/functions/_shared/names.ts

@@ -0,0 +1,53 @@
+// Display name / handle rules shared by update-profile and the daily sweep:
+// the app's own name is reserved (no "Unchaind Team" impersonating the app),
+// a few staff-sounding handles too, and a taken handle gets a free suggestion.
+
+const APP_NAME = Deno.env.get("COMMUNITY_APP_NAME") ?? "";
+
+/** Lowercase, accents stripped, letters and digits only. */
+function collapse(s: string): string {
+  return s
+    .normalize("NFD")
+    .replace(/\p{Diacritic}/gu, "")
+    .toLowerCase()
+    .replace(/[^a-z0-9]/g, "");
+}
+
+/** True when `value` contains the app's name. Short names (< 4 chars, "Eve") only match a whole word so "Steve" stays allowed. */
+export function containsAppName(value: string, appName: string = APP_NAME): boolean {
+  const app = collapse(appName);
+  if (app === "") return false;
+  if (app.length >= 4) return collapse(value).includes(app);
+  return value
+    .normalize("NFD")
+    .replace(/\p{Diacritic}/gu, "")
+    .toLowerCase()
+    .split(/[^a-z0-9]+/)
+    .includes(app);
+}
+
+const RESERVED_HANDLES = ["admin", "support", "official", "team", "moderator"];
+
+export function isReservedHandle(handle: string, appName: string = APP_NAME): boolean {
+  return RESERVED_HANDLES.includes(handle) || containsAppName(handle, appName);
+}
+
+/**
+ * A free handle on `handle`'s base: "superuser" -> "superuser-4821". Same
+ * digit widening as generate_handle (core/009). `isFree` checks the table.
+ */
+export async function suggestHandle(
+  handle: string,
+  isFree: (candidate: string) => Promise<boolean>,
+): Promise<string | null> {
+  const base = handle.replace(/-[0-9]+$/, "").slice(0, 15) || "user";
+  for (let tries = 0; tries < 10; tries++) {
+    const digits =
+      tries < 5
+        ? Math.floor(Math.random() * 9000) + 1000
+        : Math.floor(Math.random() * 900000) + 100000;
+    const candidate = `${base}-${digits}`;
+    if (await isFree(candidate)) return candidate;
+  }
+  return null;
+}

package/templates/functions/daily-moderation/index.ts

@@ -3,7 +3,8 @@
 // 'pending' -> promote to 'visible' (catches items whose synchronous
 // moderate-one call failed), clean 'visible' -> just stamp. Also sweeps
 // not-yet-checked usernames (profiles.username is client-writable, see
-// core/007_username_moderation.sql): flagged -> blanked. Posts a Slack
+// core/007_username_moderation.sql): flagged or containing the app's name ->
+// blanked, i.e. back to the default name (core/009). Posts a Slack
 // summary when there was something to check (no-op if SLACK_WEBHOOK_URL is
 // unset — see _shared/slack.ts). Never deletes rows. App criticism is not a
 // category (stays visible).
@@ -20,6 +21,7 @@ import {
   type ModerationResult,
 } from "../_shared/moderation.ts";
 import { fetchImagePaths, POST_IMAGES_BUCKET, postImageUrl } from "../_shared/images.ts";
+import { containsAppName } from "../_shared/names.ts";
 import { postToSlack } from "../_shared/slack.ts";
 
 assertModerationConfigured();
@@ -109,6 +111,7 @@ async function sweepUsernames(): Promise<{
     }
     results.forEach((r, idx) => {
       const cats = flaggedCategories(r);
+      if (containsAppName(batch[idx].username)) cats.push("app_name");
       if (cats.length > 0) blanked.push({ profile: batch[idx], categories: cats });
     });
     processed.push(...batch);

package/templates/functions/update-profile/index.ts

@@ -11,6 +11,7 @@
 import { createClient } from "jsr:@supabase/supabase-js@2";
 import { adminClient, json, SUPABASE_URL } from "../_shared/client.ts";
 import { assertModerationConfigured, moderateInput } from "../_shared/moderation.ts";
+import { containsAppName, isReservedHandle, suggestHandle } from "../_shared/names.ts";
 
 assertModerationConfigured();
 
@@ -54,12 +55,17 @@ Deno.serve(async (req) => {
     if (u.length < 2 || u.length > 24) {
       return json({ status: "error", error: "invalid_username" }, 400);
     }
+    if (containsAppName(u)) return json({ status: "error", error: "reserved_name" }, 400);
     const verdict = await moderateInput(u);
     if (!verdict) return json({ status: "error", error: "moderation unavailable" }, 503);
     if (verdict.flagged) {
       return json({ status: "rejected", field: "username", reason: verdict.reason });
     }
-    const { error } = await admin.from("profiles").update({ username: u }).eq("id", uid);
+    // The user's own name: the host app's sync no longer overwrites it (core/009).
+    const { error } = await admin
+      .from("profiles")
+      .update({ username: u, username_set_by_user: true })
+      .eq("id", uid);
     if (error) return json({ status: "error", error: error.message }, 500);
   }
 
@@ -69,15 +75,26 @@ Deno.serve(async (req) => {
     if (!/^[a-z0-9-]{3,20}$/.test(h)) {
       return json({ status: "error", error: "invalid_handle" }, 400);
     }
+    if (isReservedHandle(h)) return json({ status: "error", error: "reserved_handle" }, 400);
     const verdict = await moderateInput(h);
     if (!verdict) return json({ status: "error", error: "moderation unavailable" }, 503);
     if (verdict.flagged) {
       return json({ status: "rejected", field: "handle", reason: verdict.reason });
     }
-    const { error } = await admin.from("profiles").update({ handle: h }).eq("id", uid);
+    const { error } = await admin
+      .from("profiles")
+      .update({ handle: h, handle_set_by_user: true })
+      .eq("id", uid);
     if (error) {
       if (error.code === "23505") {
-        return json({ status: "error", code: "handle_taken" }, 409);
+        const suggestion = await suggestHandle(h, async (candidate) => {
+          const { count } = await admin
+            .from("profiles")
+            .select("id", { count: "exact", head: true })
+            .eq("handle", candidate);
+          return count === 0;
+        });
+        return json({ status: "error", code: "handle_taken", suggestion }, 409);
       }
       return json({ status: "error", error: error.message }, 500);
     }

package/templates/migrations/core/009_default_names.sql

@@ -0,0 +1,199 @@
+-- community-sdk core/009_default_names.sql
+-- Default names: every profile gets "<label> <digits>" / "<prefix>-<digits>"
+-- (assign_default_profile, called by the client once per launch). The host
+-- app's name seeds the profile until the user edits it through update-profile;
+-- from then on a client write of `username` is ignored (the user wins). See
+-- docs/superpowers/specs/2026-10-26-default-names-design.md.
+
+alter table public.profiles
+  add column if not exists default_username text,
+  add column if not exists default_handle text,
+  add column if not exists username_set_by_user boolean not null default false,
+  add column if not exists handle_set_by_user boolean not null default false;
+
+-- generate_handle with the slug to use when `base` has no usable letters
+-- (a Korean or emoji-only name): the app's handle prefix instead of "member".
+create or replace function public.generate_handle(base text, fallback text)
+returns text
+language plpgsql volatile security definer
+set search_path = public, extensions
+as $$
+declare
+  slug text;
+  candidate text;
+  tries int := 0;
+begin
+  slug := left(regexp_replace(lower(unaccent(coalesce(base, ''))), '[^a-z0-9]', '', 'g'), 12);
+  if slug = '' then
+    slug := left(regexp_replace(lower(coalesce(fallback, '')), '[^a-z0-9]', '', 'g'), 12);
+  end if;
+  if slug = '' then
+    slug := 'member';
+  end if;
+  loop
+    if tries < 5 then
+      candidate := slug || '-' || (floor(random() * 9000) + 1000)::int;
+    else
+      candidate := slug || '-' || (floor(random() * 900000) + 100000)::int;
+    end if;
+    exit when not exists (select 1 from public.profiles where handle = candidate);
+    tries := tries + 1;
+  end loop;
+  return candidate;
+end;
+$$;
+
+create or replace function public.generate_handle(base text)
+returns text
+language sql volatile security definer
+set search_path = public, extensions
+as $$ select public.generate_handle(base, 'member') $$;
+
+-- The default handle when it is still free, else a fresh one on its prefix.
+create or replace function public.default_handle_for(p_id uuid, p_default text)
+returns text
+language plpgsql volatile security definer
+set search_path = public, extensions
+as $$
+begin
+  if p_default is null then
+    return null;
+  end if;
+  if not exists (select 1 from public.profiles where handle = p_default and id <> p_id) then
+    return p_default;
+  end if;
+  return public.generate_handle('', regexp_replace(p_default, '-[0-9]+$', ''));
+end;
+$$;
+
+-- One trigger owns username + handle consistency (replaces core/001's
+-- assign_handle and core/007's profiles_username_changed, whose relative order
+-- mattered). "Trusted" writes are update-profile (service role) and this
+-- file's security definer functions (they set community.trusted).
+create or replace function public.profiles_names()
+returns trigger
+language plpgsql security definer
+set search_path = public, extensions
+as $$
+declare
+  trusted boolean := coalesce(auth.role(), '') = 'service_role'
+    or coalesce(current_setting('community.trusted', true), '') = 'on';
+  prefix text;
+begin
+  if tg_op = 'UPDATE' and new.username is distinct from old.username then
+    if not trusted and old.username_set_by_user then
+      -- Host sync after the user picked their own name: the user wins.
+      new.username := old.username;
+    elsif new.username is null
+      or (new.username = old.username_rejected and not trusted) then
+      -- Blanked (moderation sweep, old clients, account scrub) or a re-sync of
+      -- a name the sweep already blanked: back to the default name.
+      new.username := old.default_username;
+      new.username_checked_at := now();
+    elsif new.username is not distinct from new.default_username then
+      new.username_checked_at := now();
+    else
+      -- A genuinely new name: re-check it on the next sweep.
+      new.username_checked_at := null;
+    end if;
+  end if;
+
+  if new.username is not null and new.handle is null then
+    new.handle := public.generate_handle(new.username,
+      regexp_replace(coalesce(new.default_handle, ''), '-[0-9]+$', ''));
+  elsif tg_op = 'UPDATE'
+    and not new.handle_set_by_user
+    and not new.username_set_by_user
+    and new.username is distinct from old.username
+    and new.handle is not distinct from old.handle then
+    -- The host's name changed (or the sweep blanked it) and the user never
+    -- picked a handle: follow it.
+    if new.username is not distinct from new.default_username then
+      new.handle := coalesce(public.default_handle_for(new.id, new.default_handle), new.handle);
+    else
+      prefix := regexp_replace(coalesce(new.default_handle, ''), '-[0-9]+$', '');
+      new.handle := public.generate_handle(new.username, prefix);
+    end if;
+  end if;
+  return new;
+end;
+$$;
+
+drop trigger if exists profiles_assign_handle on public.profiles;
+drop trigger if exists profiles_username_changed_trg on public.profiles;
+drop function if exists public.assign_handle();
+drop function if exists public.profiles_username_changed();
+
+create trigger profiles_names_trg
+  before insert or update of username, handle on public.profiles
+  for each row execute function public.profiles_names();
+
+-- Called by the client once per launch; idempotent. `p_label` is the app's
+-- default name in the user's language ("Frère"), `p_handle` its ASCII handle
+-- prefix ("brother"). Fills username / handle only when still null.
+create or replace function public.assign_default_profile(p_label text, p_handle text)
+returns void
+language plpgsql volatile security definer
+set search_path = public, extensions
+as $$
+declare
+  uid uuid := auth.uid();
+  label text := left(btrim(coalesce(p_label, '')), 17);
+  h text;
+  name text;
+begin
+  if uid is null then
+    return;
+  end if;
+  if exists (select 1 from public.profiles where id = uid and default_username is not null) then
+    return;
+  end if;
+  if label = '' then
+    label := 'User';
+  end if;
+  h := public.generate_handle('', coalesce(nullif(p_handle, ''), 'user'));
+  name := label || ' ' || substring(h from '-([0-9]+)$');
+  perform set_config('community.trusted', 'on', true);
+  update public.profiles
+     set default_username = name,
+         default_handle = h,
+         username = coalesce(username, name),
+         handle = coalesce(handle, h)
+   where id = uid;
+  perform set_config('community.trusted', '', true);
+end;
+$$;
+
+-- Account deletion: default name and handle back, bio / avatar / edits cleared.
+create or replace function public.reset_profile_identity()
+returns void
+language plpgsql volatile security definer
+set search_path = public, extensions
+as $$
+declare
+  uid uuid := auth.uid();
+begin
+  if uid is null then
+    return;
+  end if;
+  perform set_config('community.trusted', 'on', true);
+  update public.profiles
+     set username = default_username,
+         handle = coalesce(public.default_handle_for(id, default_handle), handle),
+         username_set_by_user = false,
+         handle_set_by_user = false,
+         bio = null,
+         avatar_url = null
+   where id = uid;
+  perform set_config('community.trusted', '', true);
+end;
+$$;
+
+revoke execute on function public.generate_handle(text, text) from public, anon, authenticated;
+revoke execute on function public.generate_handle(text) from public, anon, authenticated;
+revoke execute on function public.default_handle_for(uuid, text) from public, anon, authenticated;
+revoke execute on function public.profiles_names() from public, anon, authenticated;
+revoke execute on function public.assign_default_profile(text, text) from public, anon;
+revoke execute on function public.reset_profile_identity() from public, anon;
+grant execute on function public.assign_default_profile(text, text) to authenticated;
+grant execute on function public.reset_profile_identity() to authenticated;