@selvajs/supabase-provider 0.20.0-beta.4 → 0.20.0-beta.5

package/supabase/migrations/20261101190000_selva_atomic_compute_save.sql

@@ -0,0 +1,136 @@
+-- ============================================================================
+-- A compute save lands whole or not at all
+--
+-- Security invoker, so the existing policies still decide who may write. Rows
+-- that stay are updated rather than deleted and reinserted: deleting clears
+-- `compute_server_org_defaults` through its FK. The update comes before an
+-- `on conflict do nothing` insert because reading `excluded.api_key` would need
+-- the SELECT that sessions no longer have on that column.
+-- ============================================================================
+
+create or replace function selva.save_platform_compute_servers(
+	servers jsonb,
+	shares jsonb,
+	default_server uuid
+)
+returns void
+language plpgsql set search_path = public
+as $$
+declare
+	submitted integer := jsonb_array_length(servers);
+	saved integer;
+	added integer;
+begin
+	delete from selva.compute_servers c
+	where c.scope = 'platform'
+	and c.id not in (select (s ->> 'id')::uuid from jsonb_array_elements(servers) s);
+
+	update selva.compute_servers c
+	set label = x.label, server_url = x.server_url, api_key = x.api_key,
+		timeout_ms = x.timeout_ms, retry_count = x.retry_count,
+		shared_with_all = x.shared_with_all
+	from jsonb_to_recordset(servers) as x(
+		id uuid, label text, server_url text, api_key text,
+		timeout_ms integer, retry_count integer, shared_with_all boolean
+	)
+	where c.id = x.id and c.scope = 'platform';
+	get diagnostics saved = row_count;
+
+	insert into selva.compute_servers
+		(id, scope, label, server_url, api_key, timeout_ms, retry_count, shared_with_all)
+	select x.id, 'platform', x.label, x.server_url, x.api_key, x.timeout_ms, x.retry_count,
+		x.shared_with_all
+	from jsonb_to_recordset(servers) as x(
+		id uuid, label text, server_url text, api_key text,
+		timeout_ms integer, retry_count integer, shared_with_all boolean
+	)
+	on conflict (id) do nothing;
+	get diagnostics added = row_count;
+
+	-- The insert skips what the update handled, so the two only fall short on a
+	-- collision.
+	if saved + added < submitted then
+		raise exception 'A compute server id is already in use' using errcode = '23505';
+	end if;
+
+	delete from selva.compute_server_shares cs
+	using selva.compute_servers c
+	where c.id = cs.server_id and c.scope = 'platform';
+
+	insert into selva.compute_server_shares (server_id, org_id)
+	select x.server_id, x.org_id
+	from jsonb_to_recordset(shares) as x(server_id uuid, org_id uuid);
+
+	update selva.compute_server_platform_default
+	set default_server_id = default_server
+	where singleton;
+end;
+$$;
+
+-- `set_default` is false to leave the org's default as it stands, whatever
+-- `default_server` holds; with it true, a null `default_server` clears it.
+create or replace function selva.save_org_compute_servers(
+	o uuid,
+	servers jsonb,
+	set_default boolean,
+	default_server uuid
+)
+returns void
+language plpgsql set search_path = public
+as $$
+declare
+	submitted integer := jsonb_array_length(servers);
+	saved integer;
+	added integer;
+begin
+	delete from selva.compute_servers c
+	where c.scope = 'org' and c.owner_org_id = o
+	and c.id not in (select (s ->> 'id')::uuid from jsonb_array_elements(servers) s);
+
+	update selva.compute_servers c
+	set label = x.label, server_url = x.server_url, api_key = x.api_key,
+		timeout_ms = x.timeout_ms, retry_count = x.retry_count
+	from jsonb_to_recordset(servers) as x(
+		id uuid, label text, server_url text, api_key text,
+		timeout_ms integer, retry_count integer
+	)
+	where c.id = x.id and c.scope = 'org' and c.owner_org_id = o;
+	get diagnostics saved = row_count;
+
+	insert into selva.compute_servers
+		(id, scope, owner_org_id, label, server_url, api_key, timeout_ms, retry_count)
+	select x.id, 'org', o, x.label, x.server_url, x.api_key, x.timeout_ms, x.retry_count
+	from jsonb_to_recordset(servers) as x(
+		id uuid, label text, server_url text, api_key text,
+		timeout_ms integer, retry_count integer
+	)
+	on conflict (id) do nothing;
+	get diagnostics added = row_count;
+
+	-- A colliding id belongs to another org or the platform, and this says no more
+	-- than that: the session may not be able to see the row.
+	if saved + added < submitted then
+		raise exception 'A compute server id is already in use' using errcode = '23505';
+	end if;
+
+	if set_default then
+		if default_server is null then
+			delete from selva.compute_server_org_defaults where org_id = o;
+		else
+			insert into selva.compute_server_org_defaults (org_id, default_server_id)
+			values (o, default_server)
+			on conflict (org_id) do update set default_server_id = excluded.default_server_id;
+		end if;
+	end if;
+end;
+$$;
+
+revoke all on function
+	selva.save_platform_compute_servers(jsonb, jsonb, uuid),
+	selva.save_org_compute_servers(uuid, jsonb, boolean, uuid)
+from public, anon;
+
+grant execute on function
+	selva.save_platform_compute_servers(jsonb, jsonb, uuid),
+	selva.save_org_compute_servers(uuid, jsonb, boolean, uuid)
+to authenticated, service_role;

package/supabase/migrations/20261101200000_selva_last_admin_lock_order.sql

@@ -0,0 +1,62 @@
+-- ============================================================================
+-- Concurrent permission writes queue instead of deadlocking
+--
+-- Each call locks its target, then the surviving admins, so two admins demoting
+-- each other hold what the other wants. Postgres kills one and that caller gets
+-- a 40P01 rather than `last_admin`. The advisory lock lets one call run at a
+-- time, which is cheap: permission writes are rare.
+-- ============================================================================
+
+create or replace function selva.set_platform_permissions(
+	p_user_id uuid,
+	p_permissions text[]
+)
+returns integer
+language plpgsql security definer set search_path = public
+as $$
+declare
+	v_is_demotion boolean;
+	v_others integer;
+	v_updated integer;
+begin
+	perform pg_advisory_xact_lock(hashtext('selva.set_platform_permissions'));
+
+	select 'instance_admin' = any(platform_permissions)
+	       and not ('instance_admin' = any(p_permissions))
+	into v_is_demotion
+	from selva.user_profiles
+	where user_id = p_user_id
+	for update;
+
+	if not found then
+		return 0;
+	end if;
+
+	if v_is_demotion then
+		-- Row locks still guard against `disabled` changing underneath the count.
+		perform 1
+		from selva.user_profiles
+		where user_id <> p_user_id
+		  and disabled = false
+		  and 'instance_admin' = any(platform_permissions)
+		for update;
+
+		select count(*) into v_others
+		from selva.user_profiles
+		where user_id <> p_user_id
+		  and disabled = false
+		  and 'instance_admin' = any(platform_permissions);
+
+		if v_others = 0 then
+			return 0;
+		end if;
+	end if;
+
+	update selva.user_profiles
+	set platform_permissions = p_permissions
+	where user_id = p_user_id;
+
+	get diagnostics v_updated = row_count;
+	return v_updated;
+end;
+$$;