create-bw-app 0.23.2 → 0.24.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "create-bw-app",
   "private": false,
-  "version": "0.23.2",
+  "version": "0.24.0",
   "type": "module",
   "bin": {
     "create-bw-app": "bin/create-bw-app.mjs",

package/src/constants.mjs

@@ -173,16 +173,16 @@ export const PLATFORM_STARTER_FILES = [
 ];
 
 export const APP_DEPENDENCY_DEFAULTS = {
-  "@brightweblabs/app-shell": "^0.10.1",
-  "@brightweblabs/core-auth": "^0.9.3",
+  "@brightweblabs/app-shell": "^0.11.0",
+  "@brightweblabs/core-auth": "^0.10.0",
   "@brightweblabs/infra": "^0.7.0",
-  "@brightweblabs/module-admin": "^0.8.2",
-  "@brightweblabs/module-crm": "^0.13.1",
-  "@brightweblabs/module-marketing": "^0.3.1",
-  "@brightweblabs/module-orgs": "^0.3.18",
-  "@brightweblabs/module-projects": "^0.12.3",
-  "@brightweblabs/theme": "^0.7.1",
-  "@brightweblabs/ui": "^1.4.2",
+  "@brightweblabs/module-admin": "^0.8.5",
+  "@brightweblabs/module-crm": "^0.14.0",
+  "@brightweblabs/module-marketing": "^0.4.0",
+  "@brightweblabs/module-orgs": "^0.4.0",
+  "@brightweblabs/module-projects": "^0.13.0",
+  "@brightweblabs/theme": "^0.7.2",
+  "@brightweblabs/ui": "^1.4.4",
   "geist": "1.7.2",
   "lucide-react": "^1.8.0",
   "next": "^16.0.0",

package/src/generator.mjs

@@ -1206,6 +1206,7 @@ export function createOptionalModuleRouteFiles(selectedModules) {
     ], orgsEnabled),
     "app/api/organizations/[id]/route.ts": createOrganizationRoute([
       { method: "PATCH", handler: "handleOrganizationPatchRequest", context: true },
+      { method: "DELETE", handler: "handleOrganizationDeleteRequest", context: true },
     ], orgsEnabled),
     "app/api/organizations/[id]/invitations/route.ts": createOrganizationRoute([
       { method: "GET", handler: "handleOrganizationInvitationsGetRequest", context: true },

package/src/upgrade.mjs

@@ -59,9 +59,8 @@ export async function upgradeBrightwebApp(moduleKey, argvOptions = {}, runtimeOp
   }
   await applyMigrationWrites(migrationPlan.writes);
   appManifest.migrationCursor = migrationPlan.nextCursor;
-  for (const update of plan.packageUpdates) {
-    const key = Object.keys(catalog).find((candidate) => catalog[candidate].packageName === update.packageName);
-    if (key && appManifest.modules[key]) appManifest.modules[key].version = cleanVersion(update.to) || appManifest.modules[key].version;
+  for (const [key, entry] of Object.entries(appManifest.modules)) {
+    if (catalog[key]?.packageRoot) entry.version = catalog[key].version;
   }
   for (const relativePath of plan.starterFilesToRefresh || []) {
     const targetPath = resolveSafeRelativePath(targetDir, relativePath, "Manifest scaffold file path");

package/template/base/app/api/notifications/route.ts

@@ -1 +1 @@
-export { handleNotificationsGetRequest as GET, handleNotificationsPostRequest as POST } from "@brightweblabs/core-auth/notifications";
+export { handleNotificationsDeleteRequest as DELETE, handleNotificationsGetRequest as GET, handleNotificationsPostRequest as POST } from "@brightweblabs/core-auth/notifications";

package/template/base/app/api/organizations/[id]/route.ts

@@ -4,3 +4,8 @@ export async function PATCH(request: Request, context: { params: Promise<{ id: s
   const { handleOrganizationPatchRequest } = await import("@brightweblabs/module-orgs");
   return handleOrganizationPatchRequest(request, context);
 }
+
+export async function DELETE(request: Request, context: { params: Promise<{ id: string }> }) {
+  const { handleOrganizationDeleteRequest } = await import("@brightweblabs/module-orgs");
+  return handleOrganizationDeleteRequest(request, context);
+}

package/template/modules/marketing/app/api/marketing/_handlers.ts

@@ -67,6 +67,9 @@ export function marketingTopicsOrderPost(request: Request) {
 export function marketingTopicPatch(request: Request, context: IdRouteContext) {
   return handlers.topicPatch(request, context);
 }
+export function marketingTopicDelete(request: Request, context: IdRouteContext) {
+  return handlers.topicDelete(request, context);
+}
 export function marketingWebhookPost(request: Request) {
   return handlers.webhookPost(request);
 }
@@ -100,6 +103,9 @@ export function marketingCampaignCancelPost(request: Request, context: IdRouteCo
 export function marketingCampaignRecipientsGet(request: Request, context: IdRouteContext) {
   return handlers.recipientsGet(request, context);
 }
+export function marketingCampaignRecipientDelete(request: Request, context: { params: Promise<{ id: string; recipientId: string }> }) {
+  return handlers.recipientDelete(request, context);
+}
 export function marketingCampaignRetryPost(request: Request, context: IdRouteContext) {
   return handlers.retryPost(request, context);
 }

package/template/modules/marketing/app/api/marketing/campaigns/[id]/recipients/[recipientId]/route.ts

@@ -0,0 +1,2 @@
+export { marketingCampaignRecipientDelete as DELETE } from "../../../../_handlers";
+export const dynamic = "force-dynamic";

package/template/modules/marketing/app/api/marketing/topics/[id]/route.ts

@@ -1,2 +1,2 @@
-export { marketingTopicPatch as PATCH } from "../../_handlers";
+export { marketingTopicDelete as DELETE, marketingTopicPatch as PATCH } from "../../_handlers";
 export const dynamic = "force-dynamic";

package/template/modules/projects/app/(shell)/projetos/projetos-server-mounts.tsx

@@ -1,6 +1,7 @@
 import { requireServerPageAccess } from "@brightweblabs/core-auth/server";
 import {
   getProjectDashboard,
+  getProjectAccess,
   getProjectsPortfolioPageData,
 } from "@brightweblabs/module-projects";
 import {
@@ -37,18 +38,25 @@ export async function ProjectsServerMount() {
 
 async function getInitialProject(params: Promise<{ projectId: string }>) {
   const { projectId } = await params;
-  const { supabase } = await requireServerPageAccess();
-  return getProjectDashboard(supabase, projectId);
+  const { supabase, profileId, role } = await requireServerPageAccess();
+  const [initialData, access] = await Promise.all([
+    getProjectDashboard(supabase, projectId),
+    getProjectAccess(supabase, projectId, profileId, role),
+  ]);
+  return { initialData, access };
 }
 
 export async function ProjectDetailServerMount({ params }: { params: Promise<{ projectId: string }> }) {
-  return <ProjectDetailPageLiveMount initialData={await getInitialProject(params)} navigation={navigation} />;
+  const { initialData, access } = await getInitialProject(params);
+  return <ProjectDetailPageLiveMount initialData={initialData} projectRole={access.projectRole} permissions={access.permissions} navigation={navigation} />;
 }
 
 export async function ProjectBoardServerMount({ params }: { params: Promise<{ projectId: string }> }) {
-  return <ProjectBoardPageLiveMount initialData={await getInitialProject(params)} navigation={navigation} />;
+  const { initialData, access } = await getInitialProject(params);
+  return <ProjectBoardPageLiveMount initialData={initialData} projectRole={access.projectRole} permissions={access.permissions} navigation={navigation} />;
 }
 
 export async function ProjectTasksServerMount({ params }: { params: Promise<{ projectId: string }> }) {
-  return <ProjectTasksPageLiveMount initialData={await getInitialProject(params)} navigation={navigation} />;
+  const { initialData, access } = await getInitialProject(params);
+  return <ProjectTasksPageLiveMount initialData={initialData} projectRole={access.projectRole} permissions={access.permissions} navigation={navigation} />;
 }

package/template/supabase/modules/core/migrations/20260801120000_core_notification_dismissals.sql

@@ -0,0 +1,78 @@
+-- Per-profile notification dismissal without deleting shared audit events.
+
+CREATE TABLE IF NOT EXISTS public.user_notification_dismissals (
+  profile_id uuid NOT NULL REFERENCES public.profiles(id) ON DELETE CASCADE,
+  activity_event_id uuid NOT NULL REFERENCES public.app_activity_events(id) ON DELETE CASCADE,
+  dismissed_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (profile_id, activity_event_id)
+);
+
+ALTER TABLE public.user_notification_dismissals ENABLE ROW LEVEL SECURITY;
+REVOKE ALL ON TABLE public.user_notification_dismissals FROM PUBLIC, anon, authenticated;
+GRANT ALL ON TABLE public.user_notification_dismissals TO service_role;
+
+CREATE OR REPLACE FUNCTION public.current_notification_summary(p_profile_id uuid)
+RETURNS TABLE(seen_at timestamptz, unread_count bigint)
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path = public
+AS $$
+  WITH notification_state AS (
+    SELECT state.alerts_seen_at FROM public.user_notification_state state
+    WHERE state.profile_id = p_profile_id LIMIT 1
+  )
+  SELECT (SELECT alerts_seen_at FROM notification_state), count(event.id)
+  FROM public.app_activity_events event
+  WHERE public.can_profile_view_app_activity_event(p_profile_id, event.domain, event.entity_table, event.entity_id, event.payload)
+    AND ((SELECT alerts_seen_at FROM notification_state) IS NULL OR event.created_at > (SELECT alerts_seen_at FROM notification_state))
+    AND (event.actor_profile_id IS NULL OR event.actor_profile_id <> p_profile_id)
+    AND NOT EXISTS (
+      SELECT 1 FROM public.user_notification_dismissals dismissal
+      WHERE dismissal.profile_id = p_profile_id AND dismissal.activity_event_id = event.id
+    )
+$$;
+
+DROP FUNCTION IF EXISTS public.current_notification_items(uuid, integer);
+CREATE FUNCTION public.current_notification_items(p_profile_id uuid, p_limit integer DEFAULT 8)
+RETURNS TABLE(id uuid, created_at timestamptz, domain text, event_type text, entity_table text, entity_id uuid, actor_profile_id uuid, summary text, payload jsonb)
+LANGUAGE sql STABLE SECURITY DEFINER SET search_path = public
+AS $$
+  SELECT event.id, event.created_at, event.domain, event.event_type, event.entity_table,
+    event.entity_id, event.actor_profile_id, event.summary, COALESCE(event.payload, '{}'::jsonb)
+  FROM public.app_activity_events event
+  WHERE public.can_profile_view_app_activity_event(p_profile_id, event.domain, event.entity_table, event.entity_id, event.payload)
+    AND (event.actor_profile_id IS NULL OR event.actor_profile_id <> p_profile_id)
+    AND NOT EXISTS (
+      SELECT 1 FROM public.user_notification_dismissals dismissal
+      WHERE dismissal.profile_id = p_profile_id AND dismissal.activity_event_id = event.id
+    )
+  ORDER BY event.created_at DESC
+  LIMIT LEAST(GREATEST(COALESCE(p_limit, 8), 0), 50)
+$$;
+
+CREATE OR REPLACE FUNCTION public.dismiss_current_notifications(p_profile_id uuid, p_activity_event_id uuid DEFAULT NULL)
+RETURNS integer
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = public
+AS $$
+DECLARE v_count integer;
+BEGIN
+  IF p_activity_event_id IS NULL THEN
+    RETURN 0;
+  END IF;
+
+  INSERT INTO public.user_notification_dismissals(profile_id, activity_event_id)
+  SELECT p_profile_id, event.id
+  FROM public.app_activity_events event
+  WHERE event.id = p_activity_event_id
+    AND public.can_profile_view_app_activity_event(p_profile_id, event.domain, event.entity_table, event.entity_id, event.payload)
+    AND (event.actor_profile_id IS NULL OR event.actor_profile_id <> p_profile_id)
+  ON CONFLICT (profile_id, activity_event_id) DO NOTHING;
+  GET DIAGNOSTICS v_count = ROW_COUNT;
+  RETURN v_count;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.current_notification_summary(uuid) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.current_notification_items(uuid, integer) FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.dismiss_current_notifications(uuid, uuid) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.current_notification_summary(uuid) TO service_role;
+GRANT EXECUTE ON FUNCTION public.current_notification_items(uuid, integer) TO service_role;
+GRANT EXECUTE ON FUNCTION public.dismiss_current_notifications(uuid, uuid) TO service_role;

package/template/supabase/modules/marketing/migrations/20260801121000_marketing_deletion_safety.sql

@@ -0,0 +1,107 @@
+-- Serialize destructive campaign operations with delivery state transitions.
+
+CREATE OR REPLACE FUNCTION public.maintain_marketing_campaign_recipient_count()
+RETURNS trigger
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+BEGIN
+  IF TG_OP = 'INSERT' THEN
+    UPDATE public.marketing_campaigns
+    SET total_recipients = total_recipients + 1
+    WHERE id = NEW.campaign_id;
+    RETURN NEW;
+  END IF;
+
+  UPDATE public.marketing_campaigns
+  SET total_recipients = GREATEST(0, total_recipients - 1)
+  WHERE id = OLD.campaign_id;
+  RETURN OLD;
+END;
+$$;
+
+UPDATE public.marketing_campaigns campaign
+SET total_recipients = (
+  SELECT count(*)::integer
+  FROM public.marketing_campaign_recipients recipient
+  WHERE recipient.campaign_id = campaign.id
+);
+
+DROP TRIGGER IF EXISTS trg_maintain_marketing_campaign_recipient_count
+  ON public.marketing_campaign_recipients;
+CREATE TRIGGER trg_maintain_marketing_campaign_recipient_count
+AFTER INSERT OR DELETE ON public.marketing_campaign_recipients
+FOR EACH ROW
+EXECUTE FUNCTION public.maintain_marketing_campaign_recipient_count();
+
+CREATE OR REPLACE FUNCTION public.delete_marketing_campaign_safely(p_campaign_id uuid)
+RETURNS text
+LANGUAGE plpgsql
+SECURITY INVOKER
+SET search_path = public
+AS $$
+DECLARE
+  v_status text;
+BEGIN
+  SELECT status INTO v_status
+  FROM public.marketing_campaigns
+  WHERE id = p_campaign_id
+  FOR UPDATE;
+
+  IF NOT FOUND THEN
+    RETURN 'not_found';
+  END IF;
+  IF v_status NOT IN ('draft', 'canceled') THEN
+    RETURN 'invalid_status';
+  END IF;
+
+  DELETE FROM public.marketing_campaigns WHERE id = p_campaign_id;
+  RETURN 'deleted';
+END;
+$$;
+
+CREATE OR REPLACE FUNCTION public.delete_marketing_campaign_recipient_safely(
+  p_campaign_id uuid,
+  p_recipient_id uuid
+)
+RETURNS text
+LANGUAGE plpgsql
+SECURITY INVOKER
+SET search_path = public
+AS $$
+DECLARE
+  v_campaign_status text;
+  v_deleted_id uuid;
+BEGIN
+  SELECT status INTO v_campaign_status
+  FROM public.marketing_campaigns
+  WHERE id = p_campaign_id
+  FOR UPDATE;
+
+  IF NOT FOUND THEN
+    RETURN 'campaign_not_found';
+  END IF;
+  IF v_campaign_status NOT IN ('draft', 'scheduled', 'canceled') THEN
+    RETURN 'campaign_locked';
+  END IF;
+
+  DELETE FROM public.marketing_campaign_recipients
+  WHERE id = p_recipient_id
+    AND campaign_id = p_campaign_id
+    AND status IN ('queued', 'suppressed', 'skipped')
+  RETURNING id INTO v_deleted_id;
+
+  IF v_deleted_id IS NULL THEN
+    RETURN 'recipient_not_deletable';
+  END IF;
+
+  RETURN 'deleted';
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.maintain_marketing_campaign_recipient_count() FROM PUBLIC, anon, authenticated;
+REVOKE ALL ON FUNCTION public.delete_marketing_campaign_safely(uuid) FROM PUBLIC, anon;
+REVOKE ALL ON FUNCTION public.delete_marketing_campaign_recipient_safely(uuid, uuid) FROM PUBLIC, anon;
+GRANT EXECUTE ON FUNCTION public.delete_marketing_campaign_safely(uuid) TO authenticated, service_role;
+GRANT EXECUTE ON FUNCTION public.delete_marketing_campaign_recipient_safely(uuid, uuid) TO authenticated, service_role;

package/template/supabase/modules/projects/migrations/20260801122000_project_member_sync.sql

@@ -0,0 +1,45 @@
+-- Apply exact project membership and owner changes in one serialized transaction.
+
+CREATE OR REPLACE FUNCTION public.sync_project_members_exact(
+  p_project_id uuid,
+  p_members jsonb,
+  p_owner_profile_id uuid DEFAULT NULL
+)
+RETURNS void
+LANGUAGE plpgsql
+SECURITY INVOKER
+SET search_path = public
+AS $$
+BEGIN
+  IF jsonb_typeof(COALESCE(p_members, '[]'::jsonb)) <> 'array' THEN
+    RAISE EXCEPTION 'Project members must be a JSON array.' USING ERRCODE = '22023';
+  END IF;
+
+  PERFORM 1 FROM public.projects WHERE id = p_project_id FOR UPDATE;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'Projeto não encontrado.' USING ERRCODE = 'P0002';
+  END IF;
+
+  INSERT INTO public.project_members(project_id, profile_id, role)
+  SELECT p_project_id, member.profile_id, member.role
+  FROM jsonb_to_recordset(COALESCE(p_members, '[]'::jsonb))
+    AS member(profile_id uuid, role text)
+  ON CONFLICT (project_id, profile_id) DO UPDATE SET role = EXCLUDED.role;
+
+  DELETE FROM public.project_members existing
+  WHERE existing.project_id = p_project_id
+    AND NOT EXISTS (
+      SELECT 1
+      FROM jsonb_to_recordset(COALESCE(p_members, '[]'::jsonb))
+        AS member(profile_id uuid, role text)
+      WHERE member.profile_id = existing.profile_id
+    );
+
+  UPDATE public.projects
+  SET owner_profile_id = p_owner_profile_id
+  WHERE id = p_project_id;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.sync_project_members_exact(uuid, jsonb, uuid) FROM PUBLIC, anon;
+GRANT EXECUTE ON FUNCTION public.sync_project_members_exact(uuid, jsonb, uuid) TO authenticated, service_role;