create-bw-app 0.27.1 → 0.27.3

package/template/supabase/modules/admin/migrations/20260906101616_atomic_admin_invitation_acceptance.sql

@@ -0,0 +1,50 @@
+-- atomic_admin_invitation_acceptance
+-- target: admin
+-- created_at: 2026-09-06T10:16:16.616Z
+
+CREATE OR REPLACE FUNCTION public.accept_admin_user_invitation(p_invitation_id uuid, p_profile_id uuid, p_user_email text)
+RETURNS jsonb LANGUAGE plpgsql SECURITY INVOKER SET search_path = '' AS $$
+DECLARE
+  v_invitation public.admin_user_invitations%ROWTYPE;
+  v_old_role text;
+BEGIN
+  SELECT * INTO v_invitation FROM public.admin_user_invitations WHERE id = p_invitation_id FOR UPDATE;
+  IF NOT FOUND THEN RAISE EXCEPTION 'Convite não encontrado.'; END IF;
+  IF lower(btrim(p_user_email)) IS DISTINCT FROM lower(btrim(v_invitation.invited_email)) THEN
+    RAISE EXCEPTION 'Este convite pertence a outro email.';
+  END IF;
+  -- Only the service role can call this RPC; the server supplies the authenticated
+  -- user's email. Require the matching auth-linked profile without granting auth-table access.
+  PERFORM p.id FROM public.profiles p
+    WHERE p.id = p_profile_id AND p.user_id IS NOT NULL
+      AND lower(btrim(p.email)) = lower(btrim(v_invitation.invited_email))
+    FOR UPDATE OF p;
+  IF NOT FOUND THEN RAISE EXCEPTION 'Este convite pertence a outro email.'; END IF;
+  IF v_invitation.status = 'accepted' AND v_invitation.accepted_by_profile_id = p_profile_id THEN
+    RETURN jsonb_build_object('status', 'accepted', 'role', v_invitation.role_code);
+  END IF;
+  IF v_invitation.status <> 'pending' THEN RAISE EXCEPTION 'Este convite já não está disponível.'; END IF;
+  IF v_invitation.expires_at <= clock_timestamp() THEN
+    UPDATE public.admin_user_invitations SET status = 'expired' WHERE id = p_invitation_id;
+    RETURN jsonb_build_object('status', 'expired');
+  END IF;
+
+  SELECT role_code INTO v_old_role FROM public.user_role_assignments WHERE profile_id = p_profile_id FOR UPDATE;
+  INSERT INTO public.user_role_assignments(profile_id, role_code, assigned_by_profile_id, assigned_at, reason)
+    VALUES(p_profile_id, v_invitation.role_code, v_invitation.invited_by_profile_id, now(), 'Convite de utilizador do portal aceite.')
+    ON CONFLICT(profile_id) DO UPDATE SET role_code = EXCLUDED.role_code,
+      assigned_by_profile_id = EXCLUDED.assigned_by_profile_id, assigned_at = EXCLUDED.assigned_at, reason = EXCLUDED.reason;
+  IF v_invitation.invited_by_profile_id IS NOT NULL THEN
+    INSERT INTO public.role_change_audit(target_profile_id, changed_by_profile_id, old_role_code, new_role_code, reason)
+      VALUES(p_profile_id, v_invitation.invited_by_profile_id, v_old_role, v_invitation.role_code, 'Convite de utilizador do portal aceite.');
+  END IF;
+  UPDATE public.admin_user_invitations SET status = 'accepted', accepted_at = now(), accepted_by_profile_id = p_profile_id
+    WHERE id = p_invitation_id;
+  PERFORM public.log_app_activity_event('admin', 'admin_user_invitation_accepted', 'admin_user_invitations', p_invitation_id,
+    'Convite de utilizador aceite.', jsonb_build_object('email', v_invitation.invited_email, 'role', v_invitation.role_code,
+      'status', 'accepted', 'accepted_by_profile_id', p_profile_id), p_profile_id);
+  RETURN jsonb_build_object('status', 'accepted', 'role', v_invitation.role_code);
+END;
+$$;
+REVOKE ALL ON FUNCTION public.accept_admin_user_invitation(uuid, uuid, text) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.accept_admin_user_invitation(uuid, uuid, text) TO service_role;

package/template/supabase/modules/admin/migrations/20260908120000_admin_profile_directory_visibility.sql

@@ -0,0 +1,9 @@
+-- The admin directory joins role assignments to profiles using the caller's
+-- authenticated session. Grant the corresponding profile reads through RLS.
+-- Staff and clients retain their existing profile visibility and write rules.
+DROP POLICY IF EXISTS "Admins can view profiles" ON public.profiles;
+CREATE POLICY "Admins can view profiles"
+  ON public.profiles
+  FOR SELECT
+  TO authenticated
+  USING (public.is_admin());

package/template/supabase/modules/core/migrations/20260906111323_restrict_profile_identity_sync.sql

@@ -0,0 +1,4 @@
+-- Profile synchronization is an internal auth bridge, not a caller-supplied identity API.
+-- Auth triggers execute as their owner; server registration uses service_role.
+REVOKE ALL ON FUNCTION public.sync_profile_from_auth_identity(uuid, text, jsonb) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.sync_profile_from_auth_identity(uuid, text, jsonb) TO service_role;

package/template/supabase/modules/crm/migrations/20260906101616_atomic_invitation_contact_link.sql

@@ -0,0 +1,31 @@
+-- atomic_invitation_contact_link
+-- target: crm
+-- created_at: 2026-09-06T10:16:16.695Z
+
+-- This integration is installed after orgs and is never required by an orgs-only app.
+CREATE OR REPLACE FUNCTION public.link_organization_invitation_contact(p_profile_id uuid, p_organization_id uuid)
+RETURNS uuid LANGUAGE plpgsql SECURITY INVOKER SET search_path = '' AS $$
+DECLARE
+  v_profile public.profiles%ROWTYPE;
+  v_contact public.crm_contacts%ROWTYPE;
+BEGIN
+  SELECT * INTO STRICT v_profile FROM public.profiles WHERE id = p_profile_id FOR UPDATE;
+  SELECT * INTO v_contact FROM public.crm_contacts
+    WHERE profile_id = p_profile_id OR lower(btrim(email)) = lower(btrim(v_profile.email))
+    ORDER BY (profile_id = p_profile_id) DESC NULLS LAST, id LIMIT 1 FOR UPDATE;
+  IF FOUND THEN
+    IF v_contact.profile_id IS NOT NULL AND v_contact.profile_id <> p_profile_id THEN
+      RAISE EXCEPTION 'O contacto CRM já está ligado a outro perfil.';
+    END IF;
+    UPDATE public.crm_contacts SET profile_id = p_profile_id WHERE id = v_contact.id;
+  ELSE
+    INSERT INTO public.crm_contacts(profile_id, first_name, last_name, email, status, source, organization_id)
+      VALUES(p_profile_id, v_profile.first_name, v_profile.last_name, lower(btrim(v_profile.email)), 'lead',
+        'organization_invitation_accept', p_organization_id) RETURNING * INTO v_contact;
+  END IF;
+  PERFORM public.link_crm_contact_organization(v_contact.id, p_organization_id);
+  RETURN v_contact.id;
+END;
+$$;
+REVOKE ALL ON FUNCTION public.link_organization_invitation_contact(uuid, uuid) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.link_organization_invitation_contact(uuid, uuid) TO service_role;

package/template/supabase/modules/marketing/migrations/20260906120900_atomic_marketing_workflow_nodes.sql

@@ -0,0 +1,97 @@
+-- Check position uniqueness at the end of the statement so retained node IDs
+-- can exchange positions without breaking their step-history references.
+ALTER TABLE public.marketing_workflow_nodes
+  DROP CONSTRAINT marketing_workflow_nodes_workflow_id_position_key;
+ALTER TABLE public.marketing_workflow_nodes
+  ADD CONSTRAINT marketing_workflow_nodes_workflow_id_position_key
+  UNIQUE (workflow_id, position) DEFERRABLE INITIALLY IMMEDIATE;
+
+CREATE OR REPLACE FUNCTION public.replace_marketing_workflow_nodes(p_workflow_id uuid, p_nodes jsonb)
+RETURNS SETOF public.marketing_workflow_nodes
+LANGUAGE plpgsql SECURITY INVOKER SET search_path = '' AS $$
+DECLARE
+  v_status text;
+BEGIN
+  SELECT status INTO v_status FROM public.marketing_workflows WHERE id = p_workflow_id FOR UPDATE;
+  IF NOT FOUND THEN RAISE EXCEPTION 'Workflow not found.'; END IF;
+  IF v_status = 'active' THEN RAISE EXCEPTION 'Pause the workflow before editing its nodes.'; END IF;
+  IF jsonb_typeof(p_nodes) IS DISTINCT FROM 'array' THEN RAISE EXCEPTION 'Workflow nodes must be an array.'; END IF;
+  IF EXISTS (
+    SELECT 1 FROM jsonb_array_elements(p_nodes) AS node
+    WHERE jsonb_typeof(node) IS DISTINCT FROM 'object'
+      OR node->>'node_type' IS NULL
+      OR node->>'node_type' NOT IN ('send_email', 'wait', 'add_tag')
+      OR (node ? 'config' AND jsonb_typeof(node->'config') IS DISTINCT FROM 'object')
+  ) THEN RAISE EXCEPTION 'Invalid workflow node.'; END IF;
+  IF EXISTS (
+    SELECT 1 FROM jsonb_array_elements(p_nodes) AS node
+    WHERE node->>'id' IS NOT NULL
+    GROUP BY (node->>'id')::uuid HAVING count(*) > 1
+  ) THEN RAISE EXCEPTION 'Duplicate workflow node ID.'; END IF;
+  PERFORM id FROM public.marketing_workflow_nodes WHERE workflow_id = p_workflow_id ORDER BY id FOR UPDATE;
+  IF EXISTS (
+    SELECT 1 FROM jsonb_array_elements(p_nodes) AS node
+    WHERE node->>'id' IS NOT NULL AND NOT EXISTS (
+      SELECT 1 FROM public.marketing_workflow_nodes existing
+      WHERE existing.id = (node->>'id')::uuid AND existing.workflow_id = p_workflow_id
+    )
+  ) THEN RAISE EXCEPTION 'Workflow node does not belong to this workflow.'; END IF;
+
+  DELETE FROM public.marketing_workflow_nodes existing
+    WHERE existing.workflow_id = p_workflow_id AND NOT EXISTS (
+      SELECT 1 FROM jsonb_array_elements(p_nodes) AS node WHERE (node->>'id')::uuid = existing.id
+    );
+  INSERT INTO public.marketing_workflow_nodes(id, workflow_id, position, node_type, config)
+    SELECT coalesce((node->>'id')::uuid, gen_random_uuid()), p_workflow_id,
+      (ordinality - 1)::integer, node->>'node_type', coalesce(node->'config', '{}'::jsonb)
+    FROM jsonb_array_elements(p_nodes) WITH ORDINALITY AS input(node, ordinality)
+    ON CONFLICT(id) DO UPDATE SET position = EXCLUDED.position, node_type = EXCLUDED.node_type, config = EXCLUDED.config;
+  RETURN QUERY SELECT * FROM public.marketing_workflow_nodes WHERE workflow_id = p_workflow_id ORDER BY position;
+END;
+$$;
+REVOKE ALL ON FUNCTION public.replace_marketing_workflow_nodes(uuid, jsonb) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.replace_marketing_workflow_nodes(uuid, jsonb) TO service_role;
+
+-- Activation must share the node editor's parent lock; otherwise it can approve
+-- an old non-empty snapshot while a concurrent edit clears the node set.
+CREATE OR REPLACE FUNCTION public.set_marketing_workflow_status(p_workflow_id uuid, p_status text)
+RETURNS jsonb LANGUAGE plpgsql SECURITY INVOKER SET search_path = '' AS $$
+DECLARE
+  v_workflow public.marketing_workflows%ROWTYPE;
+BEGIN
+  IF p_status IS NULL OR p_status NOT IN ('active', 'paused') THEN RAISE EXCEPTION 'Invalid workflow status.'; END IF;
+  SELECT * INTO v_workflow FROM public.marketing_workflows WHERE id = p_workflow_id FOR UPDATE;
+  IF NOT FOUND THEN RAISE EXCEPTION 'Workflow not found.'; END IF;
+  IF p_status = 'active' AND NOT EXISTS (SELECT 1 FROM public.marketing_workflow_nodes WHERE workflow_id = p_workflow_id) THEN
+    RAISE EXCEPTION 'A workflow must have at least one node before activation.';
+  END IF;
+  UPDATE public.marketing_workflows SET status = p_status WHERE id = p_workflow_id RETURNING * INTO v_workflow;
+  RETURN to_jsonb(v_workflow);
+END;
+$$;
+REVOKE ALL ON FUNCTION public.set_marketing_workflow_status(uuid, text) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.set_marketing_workflow_status(uuid, text) TO service_role;
+
+CREATE OR REPLACE FUNCTION public.delete_marketing_workflow_node(p_workflow_id uuid, p_node_id uuid)
+RETURNS SETOF public.marketing_workflow_nodes
+LANGUAGE plpgsql SECURITY INVOKER SET search_path = '' AS $$
+DECLARE
+  v_status text;
+BEGIN
+  SELECT status INTO v_status FROM public.marketing_workflows WHERE id = p_workflow_id FOR UPDATE;
+  IF NOT FOUND THEN RAISE EXCEPTION 'Workflow not found.'; END IF;
+  IF v_status = 'active' THEN RAISE EXCEPTION 'Pause the workflow before editing its nodes.'; END IF;
+  -- Remove only the requested node, never a stale replacement snapshot supplied
+  -- by the server before another editor appended or changed a different node.
+  DELETE FROM public.marketing_workflow_nodes WHERE workflow_id = p_workflow_id AND id = p_node_id;
+  WITH positions AS (
+    SELECT id, (row_number() OVER (ORDER BY position, id) - 1)::integer AS position
+    FROM public.marketing_workflow_nodes WHERE workflow_id = p_workflow_id
+  )
+  UPDATE public.marketing_workflow_nodes node SET position = positions.position
+    FROM positions WHERE node.id = positions.id AND node.position <> positions.position;
+  RETURN QUERY SELECT * FROM public.marketing_workflow_nodes WHERE workflow_id = p_workflow_id ORDER BY position;
+END;
+$$;
+REVOKE ALL ON FUNCTION public.delete_marketing_workflow_node(uuid, uuid) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.delete_marketing_workflow_node(uuid, uuid) TO service_role;

package/template/supabase/modules/orgs/migrations/20260906101616_atomic_organization_invitation_acceptance.sql

@@ -0,0 +1,61 @@
+-- atomic_organization_invitation_acceptance
+-- target: orgs
+-- created_at: 2026-09-06T10:16:16.656Z
+
+CREATE OR REPLACE FUNCTION public.accept_organization_invitation(p_invitation_id uuid, p_profile_id uuid, p_user_email text)
+RETURNS jsonb LANGUAGE plpgsql SECURITY INVOKER SET search_path = '' AS $$
+DECLARE
+  v_invitation public.organization_invitations%ROWTYPE;
+  v_contact_id uuid;
+BEGIN
+  SELECT * INTO v_invitation FROM public.organization_invitations WHERE id = p_invitation_id FOR UPDATE;
+  IF NOT FOUND THEN RAISE EXCEPTION 'Convite não encontrado.'; END IF;
+  IF lower(btrim(p_user_email)) IS DISTINCT FROM lower(btrim(v_invitation.invited_email)) THEN
+    RAISE EXCEPTION 'Este convite pertence a outro email.';
+  END IF;
+  -- Only the service role can call this RPC; the server supplies the authenticated
+  -- user's email. Require the matching auth-linked profile without granting auth-table access.
+  PERFORM p.id FROM public.profiles p
+    WHERE p.id = p_profile_id AND p.user_id IS NOT NULL
+      AND lower(btrim(p.email)) = lower(btrim(v_invitation.invited_email))
+    FOR UPDATE OF p;
+  IF NOT FOUND THEN RAISE EXCEPTION 'Este convite pertence a outro email.'; END IF;
+  IF v_invitation.status = 'accepted' AND v_invitation.accepted_by_profile_id = p_profile_id THEN
+    RETURN jsonb_build_object('status', 'accepted', 'organizationId', v_invitation.organization_id);
+  END IF;
+  IF v_invitation.status <> 'pending' THEN RAISE EXCEPTION 'Este convite já não está disponível.'; END IF;
+  IF v_invitation.expires_at <= clock_timestamp() THEN
+    UPDATE public.organization_invitations SET status = 'expired' WHERE id = p_invitation_id;
+    RETURN jsonb_build_object('status', 'expired');
+  END IF;
+
+  -- Serialize different invitations for the same organization's primary-contact choice.
+  PERFORM id FROM public.organizations WHERE id = v_invitation.organization_id FOR UPDATE;
+  -- Client-owned integration takes precedence; package updates never create or replace it.
+  IF to_regprocedure('public.client_organization_invitation_contact_hook(uuid,uuid)') IS NOT NULL THEN
+    EXECUTE 'SELECT public.client_organization_invitation_contact_hook($1, $2)' INTO v_contact_id
+      USING p_profile_id, v_invitation.organization_id;
+  ELSIF to_regclass('public.crm_contacts') IS NOT NULL THEN
+    IF to_regprocedure('public.link_organization_invitation_contact(uuid,uuid)') IS NULL THEN
+      RAISE EXCEPTION 'Aplique a migration atomic_invitation_contact_link antes de aceitar o convite.';
+    END IF;
+    EXECUTE 'SELECT public.link_organization_invitation_contact($1, $2)' INTO v_contact_id
+      USING p_profile_id, v_invitation.organization_id;
+  END IF;
+  INSERT INTO public.organization_members(organization_id, profile_id, role)
+    VALUES(v_invitation.organization_id, p_profile_id, v_invitation.role)
+    ON CONFLICT(organization_id, profile_id) DO UPDATE SET role = EXCLUDED.role;
+    UPDATE public.organizations SET primary_contact_id = (
+      SELECT profile_id FROM public.organization_members WHERE organization_id = v_invitation.organization_id AND role = 'admin'
+      ORDER BY joined_at, profile_id LIMIT 1
+    ) WHERE id = v_invitation.organization_id;
+  UPDATE public.organization_invitations SET status = 'accepted', accepted_at = now(), accepted_by_profile_id = p_profile_id,
+    accepted_contact_id = v_contact_id WHERE id = p_invitation_id;
+  PERFORM public.log_app_activity_event('crm', 'crm_organization_invitation_accepted', 'organizations', v_invitation.organization_id,
+    'Convite de organização aceite.', jsonb_build_object('invitation_id', p_invitation_id,
+      'organization_id', v_invitation.organization_id, 'email', v_invitation.invited_email), p_profile_id);
+  RETURN jsonb_build_object('status', 'accepted', 'organizationId', v_invitation.organization_id);
+END;
+$$;
+REVOKE ALL ON FUNCTION public.accept_organization_invitation(uuid, uuid, text) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.accept_organization_invitation(uuid, uuid, text) TO service_role;

package/template/supabase/modules/orgs/migrations/20260906113855_atomic_organization_member_assignment.sql

@@ -0,0 +1,76 @@
+-- Each direct assignment, including database integration and reconciliation, commits together.
+CREATE OR REPLACE FUNCTION public.assign_organization_member_atomic(
+  p_organization_id uuid, p_profile_id uuid, p_email text, p_role text, p_actor_profile_id uuid
+) RETURNS jsonb LANGUAGE plpgsql SECURITY INVOKER SET search_path = '' AS $$
+DECLARE
+  v_role text;
+  v_inserted boolean;
+  v_status text;
+  v_contact_id uuid;
+BEGIN
+  IF p_role IS NULL OR p_role NOT IN ('admin', 'member') THEN
+    RAISE EXCEPTION 'Função de membro inválida.';
+  END IF;
+  IF p_email IS NULL OR btrim(p_email) = '' THEN
+    RAISE EXCEPTION 'Email de membro inválido.';
+  END IF;
+  PERFORM id FROM public.profiles WHERE id = p_actor_profile_id;
+  IF NOT FOUND THEN RAISE EXCEPTION 'Perfil do autor não encontrado.'; END IF;
+
+  -- Match acceptance's invitation -> profile -> organization lock order. Lock
+  -- terminal rows too: acceptance may still be checking an idempotent retry.
+  PERFORM id FROM public.organization_invitations
+    WHERE organization_id = p_organization_id AND lower(btrim(invited_email)) = lower(btrim(p_email))
+    ORDER BY id FOR UPDATE;
+  PERFORM id FROM public.profiles WHERE id = p_profile_id
+    AND lower(btrim(email)) = lower(btrim(p_email)) FOR UPDATE;
+  IF NOT FOUND THEN RAISE EXCEPTION 'O perfil não corresponde ao email do membro.'; END IF;
+  PERFORM id FROM public.organizations WHERE id = p_organization_id FOR UPDATE;
+  IF NOT FOUND THEN RAISE EXCEPTION 'Organização não encontrada.'; END IF;
+
+  -- A writer outside this RPC may have inserted since the caller's snapshot.
+  -- Wait for that row, then derive the outcome from its committed current role.
+  INSERT INTO public.organization_members(organization_id, profile_id, role)
+    VALUES(p_organization_id, p_profile_id, p_role)
+    ON CONFLICT(organization_id, profile_id) DO NOTHING;
+  v_inserted := FOUND;
+  SELECT role INTO STRICT v_role FROM public.organization_members
+    WHERE organization_id = p_organization_id AND profile_id = p_profile_id FOR UPDATE;
+  IF v_inserted THEN v_status := 'immediate_access';
+  ELSIF v_role = p_role THEN v_status := 'already_member';
+  ELSE
+    UPDATE public.organization_members SET role = p_role
+      WHERE organization_id = p_organization_id AND profile_id = p_profile_id;
+    v_status := 'membership_updated';
+  END IF;
+
+  BEGIN
+    -- Client-owned SQL is transactional and takes precedence over stock CRM.
+    IF to_regprocedure('public.client_organization_invitation_contact_hook(uuid,uuid)') IS NOT NULL THEN
+      EXECUTE 'SELECT public.client_organization_invitation_contact_hook($1, $2)' INTO v_contact_id
+        USING p_profile_id, p_organization_id;
+    ELSIF to_regclass('public.crm_contacts') IS NOT NULL THEN
+      IF to_regprocedure('public.link_organization_invitation_contact(uuid,uuid)') IS NULL THEN
+        RAISE EXCEPTION 'Aplique a migration atomic_invitation_contact_link.';
+      END IF;
+      EXECUTE 'SELECT public.link_organization_invitation_contact($1, $2)' INTO v_contact_id
+        USING p_profile_id, p_organization_id;
+    END IF;
+  EXCEPTION WHEN OTHERS THEN
+    RAISE EXCEPTION 'ORGANIZATION_CONTACT_LINK_FAILED: %', SQLERRM USING ERRCODE = 'BW001';
+  END;
+
+  UPDATE public.organizations SET primary_contact_id = (
+    SELECT profile_id FROM public.organization_members
+      WHERE organization_id = p_organization_id AND role = 'admin'
+      ORDER BY joined_at, profile_id LIMIT 1
+  ) WHERE id = p_organization_id;
+  UPDATE public.organization_invitations SET status = 'accepted', accepted_at = now(),
+    accepted_by_profile_id = p_profile_id, accepted_contact_id = v_contact_id
+    WHERE organization_id = p_organization_id AND lower(btrim(invited_email)) = lower(btrim(p_email))
+      AND status = 'pending';
+  RETURN jsonb_build_object('status', v_status, 'profileId', p_profile_id, 'organizationId', p_organization_id);
+END;
+$$;
+REVOKE ALL ON FUNCTION public.assign_organization_member_atomic(uuid, uuid, text, text, uuid) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.assign_organization_member_atomic(uuid, uuid, text, text, uuid) TO service_role;