aios-core 2.1.0

package/.aios-core/product/templates/tmpl-rls-simple.sql

@@ -0,0 +1,77 @@
+-- Simple RLS Policy Template
+-- Table: :table_name
+-- Security Model: Simple owner-based access
+-- Created: :created_date
+--
+-- This template creates a simple RLS policy where users can only
+-- access rows they own (based on user_id column)
+
+-- Enable RLS on table
+ALTER TABLE :table_name ENABLE ROW LEVEL SECURITY;
+
+-- =============================================================================
+-- SIMPLE OWNER-BASED POLICY
+-- =============================================================================
+
+-- Drop existing policies if re-running
+DROP POLICY IF EXISTS ":table_name_owner_policy" ON :table_name;
+
+-- Single policy for all operations (SELECT, INSERT, UPDATE, DELETE)
+-- Users can only access rows where user_id matches their auth.uid()
+CREATE POLICY ":table_name_owner_policy"
+ON :table_name
+FOR ALL
+TO authenticated
+USING (auth.uid() = user_id)
+WITH CHECK (auth.uid() = user_id);
+
+-- =============================================================================
+-- OPTIONAL: Allow service role to bypass RLS
+-- =============================================================================
+-- Note: This is enabled by default in Supabase
+-- The service_role can access all rows regardless of RLS policies
+-- Be careful with service_role key exposure
+
+-- =============================================================================
+-- OPTIONAL: Public read access (if needed)
+-- =============================================================================
+-- Uncomment if you want anonymous users to read data
+--
+-- DROP POLICY IF EXISTS ":table_name_public_read" ON :table_name;
+-- CREATE POLICY ":table_name_public_read"
+-- ON :table_name
+-- FOR SELECT
+-- TO anon
+-- USING (is_public = true);
+
+-- =============================================================================
+-- VERIFICATION
+-- =============================================================================
+-- Test the policy:
+--
+-- 1. As authenticated user (should see only their rows):
+--    SET LOCAL ROLE authenticated;
+--    SET LOCAL request.jwt.claims = '{"sub": "user-uuid-here"}';
+--    SELECT * FROM :table_name;
+--
+-- 2. As service role (should see all rows):
+--    SET LOCAL ROLE service_role;
+--    SELECT * FROM :table_name;
+--
+-- 3. As anonymous (should see nothing unless public_read enabled):
+--    SET LOCAL ROLE anon;
+--    SELECT * FROM :table_name;
+
+-- =============================================================================
+-- TABLE REQUIREMENTS
+-- =============================================================================
+-- This template assumes :table_name has a user_id column:
+--
+-- CREATE TABLE :table_name (
+--     id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+--     user_id UUID NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+--     -- other columns...
+--     created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+-- );
+--
+-- CREATE INDEX idx_:table_name_user_id ON :table_name(user_id);

package/.aios-core/product/templates/tmpl-rls-tenant.sql

@@ -0,0 +1,152 @@
+-- Multi-Tenant RLS Policy Template
+-- Table: :table_name
+-- Security Model: Tenant isolation with user permissions
+-- Created: :created_date
+--
+-- This template creates RLS policies for multi-tenant applications
+-- where data is isolated by organization/tenant
+
+-- =============================================================================
+-- PREREQUISITES: Tenant Infrastructure
+-- =============================================================================
+
+-- Tenants/Organizations table (if not exists)
+CREATE TABLE IF NOT EXISTS tenants (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    name TEXT NOT NULL,
+    slug TEXT UNIQUE NOT NULL,
+    settings JSONB DEFAULT '{}'::JSONB,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+-- Tenant memberships (which users belong to which tenants)
+CREATE TABLE IF NOT EXISTS tenant_members (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    tenant_id UUID NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+    user_id UUID NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+    role TEXT NOT NULL DEFAULT 'member' CHECK (role IN ('owner', 'admin', 'member', 'viewer')),
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+
+    UNIQUE(tenant_id, user_id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_tenant_members_user ON tenant_members(user_id);
+CREATE INDEX IF NOT EXISTS idx_tenant_members_tenant ON tenant_members(tenant_id);
+
+-- =============================================================================
+-- HELPER FUNCTIONS
+-- =============================================================================
+
+-- Get current user's tenant IDs
+CREATE OR REPLACE FUNCTION get_user_tenant_ids()
+RETURNS UUID[] AS $$
+BEGIN
+    RETURN ARRAY(
+        SELECT tenant_id
+        FROM tenant_members
+        WHERE user_id = auth.uid()
+    );
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER STABLE;
+
+-- Check if user is member of tenant
+CREATE OR REPLACE FUNCTION is_tenant_member(check_tenant_id UUID)
+RETURNS BOOLEAN AS $$
+BEGIN
+    RETURN EXISTS (
+        SELECT 1
+        FROM tenant_members
+        WHERE tenant_id = check_tenant_id
+        AND user_id = auth.uid()
+    );
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER STABLE;
+
+-- Check user's role in tenant
+CREATE OR REPLACE FUNCTION get_tenant_role(check_tenant_id UUID)
+RETURNS TEXT AS $$
+BEGIN
+    RETURN (
+        SELECT role
+        FROM tenant_members
+        WHERE tenant_id = check_tenant_id
+        AND user_id = auth.uid()
+    );
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER STABLE;
+
+-- =============================================================================
+-- TABLE WITH TENANT COLUMN
+-- =============================================================================
+-- Your table should have a tenant_id column:
+--
+-- ALTER TABLE :table_name ADD COLUMN IF NOT EXISTS tenant_id UUID REFERENCES tenants(id);
+-- CREATE INDEX IF NOT EXISTS idx_:table_name_tenant ON :table_name(tenant_id);
+
+-- =============================================================================
+-- RLS POLICIES FOR TENANT ISOLATION
+-- =============================================================================
+
+ALTER TABLE :table_name ENABLE ROW LEVEL SECURITY;
+
+-- SELECT: Users can only see rows from their tenants
+DROP POLICY IF EXISTS ":table_name_tenant_select" ON :table_name;
+CREATE POLICY ":table_name_tenant_select"
+ON :table_name
+FOR SELECT
+TO authenticated
+USING (
+    tenant_id = ANY(get_user_tenant_ids())
+);
+
+-- INSERT: Users can only insert into tenants they belong to
+DROP POLICY IF EXISTS ":table_name_tenant_insert" ON :table_name;
+CREATE POLICY ":table_name_tenant_insert"
+ON :table_name
+FOR INSERT
+TO authenticated
+WITH CHECK (
+    is_tenant_member(tenant_id)
+);
+
+-- UPDATE: Only admins/owners can update
+DROP POLICY IF EXISTS ":table_name_tenant_update" ON :table_name;
+CREATE POLICY ":table_name_tenant_update"
+ON :table_name
+FOR UPDATE
+TO authenticated
+USING (
+    tenant_id = ANY(get_user_tenant_ids())
+    AND get_tenant_role(tenant_id) IN ('owner', 'admin')
+)
+WITH CHECK (
+    tenant_id = ANY(get_user_tenant_ids())
+);
+
+-- DELETE: Only owners can delete
+DROP POLICY IF EXISTS ":table_name_tenant_delete" ON :table_name;
+CREATE POLICY ":table_name_tenant_delete"
+ON :table_name
+FOR DELETE
+TO authenticated
+USING (
+    get_tenant_role(tenant_id) = 'owner'
+);
+
+-- =============================================================================
+-- RLS ON TENANT TABLES THEMSELVES
+-- =============================================================================
+
+ALTER TABLE tenants ENABLE ROW LEVEL SECURITY;
+ALTER TABLE tenant_members ENABLE ROW LEVEL SECURITY;
+
+-- Tenants: Members can see their tenants
+CREATE POLICY "tenants_member_select" ON tenants
+FOR SELECT TO authenticated
+USING (id = ANY(get_user_tenant_ids()));
+
+-- Tenant members: Members can see their tenant's members
+CREATE POLICY "tenant_members_select" ON tenant_members
+FOR SELECT TO authenticated
+USING (tenant_id = ANY(get_user_tenant_ids()));

package/.aios-core/product/templates/tmpl-rollback-script.sql

@@ -0,0 +1,77 @@
+-- Rollback Script Template
+-- Rollback for Migration: :migration_name
+-- Created: :created_date
+-- Author: :author
+-- Description: Reverses the changes made by :migration_name
+--
+-- IMPORTANT: Test this rollback in development before using in production
+-- WARNING: Data migrations may not be fully reversible
+
+BEGIN;
+
+-- =============================================================================
+-- PRE-ROLLBACK VERIFICATION
+-- =============================================================================
+
+DO $$
+BEGIN
+    -- Verify we're rolling back the correct migration
+    RAISE NOTICE 'Starting rollback of migration: :migration_name';
+
+    -- Add any safety checks here
+    -- Example: Check if dependent objects exist
+END $$;
+
+-- =============================================================================
+-- REVERSE DATA MIGRATION (if applicable)
+-- =============================================================================
+
+-- If data was migrated, restore from backup or reverse transformation
+-- WARNING: This may result in data loss if no backup exists
+-- INSERT INTO :old_table (old_col1, old_col2)
+-- SELECT col1, col2 FROM :new_table;
+
+-- =============================================================================
+-- REVERSE SCHEMA CHANGES
+-- =============================================================================
+
+-- Remove triggers
+DROP TRIGGER IF EXISTS trigger_update_:table_name_updated_at ON :table_name;
+
+-- Remove indexes
+-- DROP INDEX IF EXISTS idx_:table_:column;
+
+-- Remove columns from existing tables
+-- ALTER TABLE :existing_table DROP COLUMN IF EXISTS :new_column;
+
+-- Drop tables (DANGEROUS - ensure data is backed up)
+-- DROP TABLE IF EXISTS :table_name CASCADE;
+
+-- =============================================================================
+-- POST-ROLLBACK VERIFICATION
+-- =============================================================================
+
+DO $$
+BEGIN
+    -- Verify rollback was successful
+    -- Example: Verify table no longer exists
+    -- ASSERT NOT (SELECT EXISTS (
+    --     SELECT 1 FROM information_schema.tables
+    --     WHERE table_name = ':table_name'
+    -- )), 'Table :table_name still exists after rollback';
+
+    RAISE NOTICE 'Rollback completed successfully';
+END $$;
+
+COMMIT;
+
+-- =============================================================================
+-- POST-ROLLBACK NOTES
+-- =============================================================================
+--
+-- After running this rollback:
+-- 1. Verify application still functions correctly
+-- 2. Check for any orphaned data
+-- 3. Update migration tracking if applicable
+-- 4. Document reason for rollback
+--

package/.aios-core/product/templates/tmpl-seed-data.sql

@@ -0,0 +1,140 @@
+-- Seed Data Template
+-- Purpose: Idempotent seed data for development and testing
+-- Created: :created_date
+-- Author: :author
+--
+-- IMPORTANT: All seed operations should be idempotent (safe to run multiple times)
+
+-- =============================================================================
+-- SEED CONFIGURATION
+-- =============================================================================
+
+-- Disable triggers during seeding (optional, speeds up bulk insert)
+-- SET session_replication_role = replica;
+
+BEGIN;
+
+-- =============================================================================
+-- SEED: REFERENCE DATA (Lookup tables, static data)
+-- =============================================================================
+
+-- Example: Status types
+INSERT INTO status_types (id, name, description, sort_order)
+VALUES
+    ('11111111-1111-1111-1111-111111111001', 'draft', 'Initial draft state', 1),
+    ('11111111-1111-1111-1111-111111111002', 'pending', 'Awaiting action', 2),
+    ('11111111-1111-1111-1111-111111111003', 'active', 'Currently active', 3),
+    ('11111111-1111-1111-1111-111111111004', 'completed', 'Work completed', 4),
+    ('11111111-1111-1111-1111-111111111005', 'archived', 'No longer active', 5)
+ON CONFLICT (id) DO UPDATE SET
+    name = EXCLUDED.name,
+    description = EXCLUDED.description,
+    sort_order = EXCLUDED.sort_order;
+
+-- Example: Categories
+INSERT INTO categories (id, name, slug, parent_id)
+VALUES
+    ('22222222-2222-2222-2222-222222222001', 'General', 'general', NULL),
+    ('22222222-2222-2222-2222-222222222002', 'Development', 'development', NULL),
+    ('22222222-2222-2222-2222-222222222003', 'Frontend', 'frontend', '22222222-2222-2222-2222-222222222002'),
+    ('22222222-2222-2222-2222-222222222004', 'Backend', 'backend', '22222222-2222-2222-2222-222222222002')
+ON CONFLICT (id) DO UPDATE SET
+    name = EXCLUDED.name,
+    slug = EXCLUDED.slug,
+    parent_id = EXCLUDED.parent_id;
+
+-- =============================================================================
+-- SEED: ROLES AND PERMISSIONS
+-- =============================================================================
+
+INSERT INTO roles (id, name, description, permissions)
+VALUES
+    ('33333333-3333-3333-3333-333333333001', 'admin', 'Full system access', '["*"]'::JSONB),
+    ('33333333-3333-3333-3333-333333333002', 'editor', 'Can edit content', '["read", "write", "update"]'::JSONB),
+    ('33333333-3333-3333-3333-333333333003', 'viewer', 'Read-only access', '["read"]'::JSONB)
+ON CONFLICT (id) DO UPDATE SET
+    description = EXCLUDED.description,
+    permissions = EXCLUDED.permissions;
+
+-- =============================================================================
+-- SEED: TEST USERS (Development only!)
+-- =============================================================================
+
+-- NOTE: Only run in development environment
+-- These are fake users for testing - DO NOT use in production
+
+-- Check environment before inserting test data
+DO $$
+BEGIN
+    -- Only seed test users if this appears to be a dev environment
+    IF current_database() LIKE '%dev%' OR current_database() LIKE '%test%' THEN
+        -- Test Admin User
+        INSERT INTO auth.users (
+            id,
+            email,
+            encrypted_password,
+            email_confirmed_at,
+            raw_user_meta_data
+        ) VALUES (
+            '00000000-0000-0000-0000-000000000001',
+            'admin@test.local',
+            crypt('testpassword123', gen_salt('bf')),
+            NOW(),
+            '{"full_name": "Test Admin"}'::JSONB
+        ) ON CONFLICT (id) DO NOTHING;
+
+        -- Test Regular User
+        INSERT INTO auth.users (
+            id,
+            email,
+            encrypted_password,
+            email_confirmed_at,
+            raw_user_meta_data
+        ) VALUES (
+            '00000000-0000-0000-0000-000000000002',
+            'user@test.local',
+            crypt('testpassword123', gen_salt('bf')),
+            NOW(),
+            '{"full_name": "Test User"}'::JSONB
+        ) ON CONFLICT (id) DO NOTHING;
+
+        RAISE NOTICE 'Test users seeded successfully';
+    ELSE
+        RAISE NOTICE 'Skipping test user seeding - not a dev/test environment';
+    END IF;
+END $$;
+
+-- =============================================================================
+-- SEED: SAMPLE DATA (Development only!)
+-- =============================================================================
+
+-- Example: Sample projects for testing
+INSERT INTO :table_name (id, name, description, user_id, status, created_at)
+VALUES
+    ('44444444-4444-4444-4444-444444444001', 'Sample Project 1', 'First sample project for testing', '00000000-0000-0000-0000-000000000001', 'active', NOW()),
+    ('44444444-4444-4444-4444-444444444002', 'Sample Project 2', 'Second sample project for testing', '00000000-0000-0000-0000-000000000002', 'draft', NOW())
+ON CONFLICT (id) DO UPDATE SET
+    name = EXCLUDED.name,
+    description = EXCLUDED.description,
+    updated_at = NOW();
+
+COMMIT;
+
+-- =============================================================================
+-- RE-ENABLE TRIGGERS
+-- =============================================================================
+
+-- SET session_replication_role = DEFAULT;
+
+-- =============================================================================
+-- VERIFICATION
+-- =============================================================================
+
+SELECT
+    'status_types' as table_name,
+    COUNT(*) as row_count
+FROM status_types
+UNION ALL
+SELECT 'categories', COUNT(*) FROM categories
+UNION ALL
+SELECT 'roles', COUNT(*) FROM roles;

package/.aios-core/product/templates/tmpl-smoke-test.sql

@@ -0,0 +1,16 @@
+-- Basic post-migration checks (fill placeholders)
+SET client_min_messages = warning;
+
+-- Count tables/policies/functions expected
+SELECT COUNT(*) AS tables FROM information_schema.tables WHERE table_schema='public';
+SELECT COUNT(*) AS policies FROM pg_policies WHERE schemaname='public';
+SELECT proname FROM pg_proc WHERE pronamespace = 'public'::regnamespace
+  AND proname IN ('current_mind_id','provision_user_profile','set_fragment_mind_id');
+
+-- Sanity queries (examples)
+-- SELECT * FROM categories LIMIT 5;
+-- SELECT * FROM minds LIMIT 5;
+
+-- RLS sanity (should not error even if it returns 0)
+-- SET LOCAL request.jwt.claims = '{"sub":"<user-uuid>","role":"authenticated"}';
+-- SELECT 1 FROM fragments WHERE false;

package/.aios-core/product/templates/tmpl-staging-copy-merge.sql

@@ -0,0 +1,139 @@
+-- Staging Copy Merge Template
+-- Purpose: Safely load external data through staging table and merge to target
+-- Created: :created_date
+-- Author: :author
+--
+-- This pattern prevents data corruption by validating in staging before merge
+
+-- =============================================================================
+-- STEP 1: CREATE STAGING TABLE (temporary)
+-- =============================================================================
+
+-- Create staging table mirroring target structure
+CREATE TEMP TABLE IF NOT EXISTS :staging_table (
+    -- Match target table columns
+    id UUID,
+    :column1 :type1,
+    :column2 :type2,
+    -- Metadata for import tracking
+    _row_number INTEGER,
+    _import_status TEXT DEFAULT 'pending',
+    _import_error TEXT
+);
+
+-- =============================================================================
+-- STEP 2: COPY DATA TO STAGING
+-- =============================================================================
+
+-- Option A: From CSV file
+-- COPY :staging_table (id, :column1, :column2)
+-- FROM '/path/to/file.csv'
+-- WITH (FORMAT csv, HEADER true);
+
+-- Option B: From STDIN (programmatic)
+-- COPY :staging_table (id, :column1, :column2) FROM STDIN;
+
+-- Option C: Insert from another query
+-- INSERT INTO :staging_table (id, :column1, :column2)
+-- SELECT id, col1, col2 FROM external_source;
+
+-- =============================================================================
+-- STEP 3: VALIDATE STAGING DATA
+-- =============================================================================
+
+-- Mark rows with validation errors
+UPDATE :staging_table
+SET
+    _import_status = 'error',
+    _import_error = 'Missing required field'
+WHERE :column1 IS NULL;
+
+-- Check for duplicates
+UPDATE :staging_table s
+SET
+    _import_status = 'duplicate',
+    _import_error = 'Duplicate ID found'
+WHERE EXISTS (
+    SELECT 1 FROM :staging_table s2
+    WHERE s2.id = s.id
+    AND s2._row_number < s._row_number
+);
+
+-- Check for existing records (will update instead of insert)
+UPDATE :staging_table s
+SET _import_status = 'update'
+WHERE EXISTS (
+    SELECT 1 FROM :target_table t
+    WHERE t.id = s.id
+)
+AND s._import_status = 'pending';
+
+-- Mark remaining as new inserts
+UPDATE :staging_table
+SET _import_status = 'insert'
+WHERE _import_status = 'pending';
+
+-- =============================================================================
+-- STEP 4: REPORT VALIDATION RESULTS
+-- =============================================================================
+
+-- Get summary of staging data
+SELECT
+    _import_status,
+    COUNT(*) as count,
+    STRING_AGG(DISTINCT _import_error, ', ') as errors
+FROM :staging_table
+GROUP BY _import_status
+ORDER BY _import_status;
+
+-- =============================================================================
+-- STEP 5: MERGE TO TARGET (UPSERT)
+-- =============================================================================
+
+BEGIN;
+
+-- Insert new records
+INSERT INTO :target_table (id, :column1, :column2, created_at)
+SELECT id, :column1, :column2, NOW()
+FROM :staging_table
+WHERE _import_status = 'insert';
+
+-- Update existing records
+UPDATE :target_table t
+SET
+    :column1 = s.:column1,
+    :column2 = s.:column2,
+    updated_at = NOW()
+FROM :staging_table s
+WHERE t.id = s.id
+AND s._import_status = 'update';
+
+COMMIT;
+
+-- =============================================================================
+-- STEP 6: VERIFY AND CLEANUP
+-- =============================================================================
+
+-- Verify merge results
+SELECT
+    'inserted' as operation,
+    COUNT(*) as count
+FROM :staging_table WHERE _import_status = 'insert'
+UNION ALL
+SELECT
+    'updated' as operation,
+    COUNT(*) as count
+FROM :staging_table WHERE _import_status = 'update'
+UNION ALL
+SELECT
+    'errors' as operation,
+    COUNT(*) as count
+FROM :staging_table WHERE _import_status = 'error';
+
+-- Get error details for review
+SELECT id, :column1, _import_error
+FROM :staging_table
+WHERE _import_status = 'error';
+
+-- Drop staging table (automatic for TEMP, but explicit is clearer)
+DROP TABLE IF EXISTS :staging_table;