create-nextblock 0.13.1 → 0.13.2

package/templates/nextblock-template/app/api/cron/reset-sandbox/sandboxResetSql.ts

@@ -1,37 +1,37 @@
-// AUTO-GENERATED FILE. Do not edit this file directly.
-// Regenerate it from repo root with: npm run generate:sandbox
-// Source of truth: tools/scripts/generate-sandbox-reset.ts and libs/db/src/supabase/migrations/*.sql
-
-export const SANDBOX_RESET_SQL = `
--- AUTO-GENERATED: Sandbox Reset Script. Do Not Edit Manually.
--- Generated by tools/scripts/generate-sandbox-reset.ts
-
-  -- Step A: Erase all non-demo users
-  DELETE FROM auth.users
-  WHERE id NOT IN (
-    '63a8aa07-ef6e-4cc7-bafa-ece023c74366'::uuid,
-    'e3a2c121-70a4-4239-a9df-f70ce717f5a1'::uuid
-  );
-
-  -- Step B: Wipe public schema and truncate migrations
-  DROP SCHEMA public CASCADE;
-  CREATE SCHEMA public;
-
-  -- Restore default public schema privileges so the standard migrations succeed
-  GRANT USAGE ON SCHEMA public TO postgres, anon, authenticated, service_role;
-  GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO postgres, anon, authenticated, service_role;
-  GRANT ALL PRIVILEGES ON ALL ROUTINES IN SCHEMA public TO postgres, anon, authenticated, service_role;
-  GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO postgres, anon, authenticated, service_role;
-  ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres, anon, authenticated, service_role;
-  ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON ROUTINES TO postgres, anon, authenticated, service_role;
-  ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres, anon, authenticated, service_role;
-
-  TRUNCATE TABLE supabase_migrations.schema_migrations;
-
-  -- Step C: Execute full schema & seed from production migrations
-
-
--- >>> FROM: 00000000000000_baseline_schema.sql <<<
+// AUTO-GENERATED FILE. Do not edit this file directly.
+// Regenerate it from repo root with: npm run generate:sandbox
+// Source of truth: tools/scripts/generate-sandbox-reset.ts and libs/db/src/supabase/migrations/*.sql
+
+export const SANDBOX_RESET_SQL = `
+-- AUTO-GENERATED: Sandbox Reset Script. Do Not Edit Manually.
+-- Generated by tools/scripts/generate-sandbox-reset.ts
+
+  -- Step A: Erase all non-demo users
+  DELETE FROM auth.users
+  WHERE id NOT IN (
+    '63a8aa07-ef6e-4cc7-bafa-ece023c74366'::uuid,
+    'e3a2c121-70a4-4239-a9df-f70ce717f5a1'::uuid
+  );
+
+  -- Step B: Wipe public schema and truncate migrations
+  DROP SCHEMA public CASCADE;
+  CREATE SCHEMA public;
+
+  -- Restore default public schema privileges so the standard migrations succeed
+  GRANT USAGE ON SCHEMA public TO postgres, anon, authenticated, service_role;
+  GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO postgres, anon, authenticated, service_role;
+  GRANT ALL PRIVILEGES ON ALL ROUTINES IN SCHEMA public TO postgres, anon, authenticated, service_role;
+  GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON TABLES TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON ROUTINES TO postgres, anon, authenticated, service_role;
+  ALTER DEFAULT PRIVILEGES FOR ROLE postgres IN SCHEMA public GRANT ALL ON SEQUENCES TO postgres, anon, authenticated, service_role;
+
+  TRUNCATE TABLE supabase_migrations.schema_migrations;
+
+  -- Step C: Execute full schema & seed from production migrations
+
+
+-- >>> FROM: 00000000000000_baseline_schema.sql <<<
 -- AUTO-GENERATED baseline (re-baseline of migrations 000..044). Idempotent; safe to replay.
 -- 00 · schema: enums, functions, tables, sequences, defaults
 -- Regenerate via tools/scripts/rebaseline-transform.mjs. Do not hand-edit.
@@ -2486,9 +2486,9 @@ CREATE TABLE IF NOT EXISTS public.variant_attribute_mapping (
     variant_id uuid NOT NULL,
     attribute_term_id uuid NOT NULL
 );
-
-
--- >>> FROM: 00000000000001_baseline_constraints_and_indexes.sql <<<
+
+
+-- >>> FROM: 00000000000001_baseline_constraints_and_indexes.sql <<<
 -- AUTO-GENERATED baseline (re-baseline of migrations 000..044). Idempotent; safe to replay.
 -- 01 · constraints (PK / unique / check / FK) + indexes
 -- Regenerate via tools/scripts/rebaseline-transform.mjs. Do not hand-edit.
@@ -3560,9 +3560,9 @@ DO $rb$ BEGIN
         ADD CONSTRAINT variant_attribute_mapping_variant_id_fkey FOREIGN KEY (variant_id) REFERENCES public.product_variants(id) ON DELETE CASCADE;
   END IF;
 END $rb$;
-
-
--- >>> FROM: 00000000000002_baseline_security_and_grants.sql <<<
+
+
+-- >>> FROM: 00000000000002_baseline_security_and_grants.sql <<<
 -- AUTO-GENERATED baseline (re-baseline of migrations 000..044). Idempotent; safe to replay.
 -- 02 · row-level security, policies, triggers, grants
 -- Regenerate via tools/scripts/rebaseline-transform.mjs. Do not hand-edit.
@@ -4898,9 +4898,9 @@ CREATE TRIGGER on_auth_user_created
   FOR EACH ROW
   EXECUTE FUNCTION public.handle_new_user();
 REVOKE EXECUTE ON FUNCTION public.handle_new_user() FROM PUBLIC, anon, authenticated;
-
-
--- >>> FROM: 00000000000003_baseline_seed.sql <<<
+
+
+-- >>> FROM: 00000000000003_baseline_seed.sql <<<
 -- AUTO-GENERATED baseline (re-baseline of migrations 000..044). Idempotent; safe to replay.
 -- 03 · seed: canonical NextBlock demo content (no users, no secrets)
 -- Regenerate via tools/scripts/rebaseline-transform.mjs. Do not hand-edit.
@@ -5369,9 +5369,9 @@ SELECT pg_catalog.setval('public.languages_id_seq', COALESCE((SELECT MAX(id) FRO
 SELECT pg_catalog.setval('public.navigation_items_id_seq', COALESCE((SELECT MAX(id) FROM public.navigation_items), 1), true);
 SELECT pg_catalog.setval('public.pages_id_seq', COALESCE((SELECT MAX(id) FROM public.pages), 1), true);
 SELECT pg_catalog.setval('public.posts_id_seq', COALESCE((SELECT MAX(id) FROM public.posts), 1), true);
-
-
--- >>> FROM: 00000000000004_default_logo_email_safe.sql <<<
+
+
+-- >>> FROM: 00000000000004_default_logo_email_safe.sql <<<
 -- Swap the seeded DEFAULT site logo from the WebP asset to a bundled PNG.
 --
 -- WebP (and AVIF) don't render in Outlook and several other email clients, so the default
@@ -5396,9 +5396,9 @@ UPDATE public.logos
 SET media_id = 'a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d'
 WHERE id = 'd45ef03d-27fc-4099-8b46-1cdf82d658d2'
   AND media_id = 'ea6fdaf5-f8de-416c-9f2b-b689b7a4ed38';
-
-
--- >>> FROM: 00000000000005_add_custom_canonical.sql <<<
+
+
+-- >>> FROM: 00000000000005_add_custom_canonical.sql <<<
 -- Add a nullable \`custom_canonical\` column to pages, posts and products.
 --
 -- This is the per-content manual canonical override used by each route's
@@ -5412,9 +5412,9 @@ WHERE id = 'd45ef03d-27fc-4099-8b46-1cdf82d658d2'
 ALTER TABLE public.pages ADD COLUMN IF NOT EXISTS custom_canonical text;
 ALTER TABLE public.posts ADD COLUMN IF NOT EXISTS custom_canonical text;
 ALTER TABLE public.products ADD COLUMN IF NOT EXISTS custom_canonical text;
-
-
--- >>> FROM: 00000000000006_home_live_demo_promo.sql <<<
+
+
+-- >>> FROM: 00000000000006_home_live_demo_promo.sql <<<
 -- 00000000000006_home_sandbox_promo.sql
 -- Adds a "Live Demo" promo section to the English (slug 'home') and French
 -- (slug 'accueil') home pages that drives visitors to the public sandbox at
@@ -5482,9 +5482,9 @@ $fr$::jsonb, 1);
   END IF;
 END
 $body$;
-
-
--- >>> FROM: 00000000000007_home_live_demo_promo_copy_fix.sql <<<
+
+
+-- >>> FROM: 00000000000007_home_live_demo_promo_copy_fix.sql <<<
 -- 00000000000007_home_live_demo_promo_copy_fix.sql
 -- Corrects the "Live Demo" promo that migration 006 seeded on the EN (slug 'home')
 -- and FR (slug 'accueil') home pages. 006 was already applied to production and the
@@ -5534,9 +5534,9 @@ $fr$::jsonb,
      AND content::text LIKE '%nb-sandbox-promo%';
 END
 $body$;
-
-
--- >>> FROM: 00000000000008_setup_article_reorder.sql <<<
+
+
+-- >>> FROM: 00000000000008_setup_article_reorder.sql <<<
 -- 00000000000008_setup_article_reorder.sql
 -- Reorders and rewrites the "How to Install NextBlock" setup guide on BOTH language
 -- twins: EN (post slug 'how-to-setup-nextblock', post_id=3 / block id=40) and FR
@@ -5567,9 +5567,9 @@ $nbfr$::jsonb,
        updated_at = now()
  WHERE post_id = 4
    AND block_type = 'text';
-
-
--- >>> FROM: 00000000000009_home_live_demo_promo_contrast.sql <<<
+
+
+-- >>> FROM: 00000000000009_home_live_demo_promo_contrast.sql <<<
 -- 00000000000009_home_live_demo_promo_contrast.sql
 -- Restyles the "Live Demo" promo that migrations 006/007 seeded on the EN (slug 'home')
 -- and FR (slug 'accueil') home pages. 006/007 gave it a fixed dark-navy GRADIENT section
@@ -5622,151 +5622,180 @@ $fr$::jsonb,
      AND content::text LIKE '%nb-sandbox-promo%';
 END
 $body$;
-
-
--- >>> FROM: 00000000000010_drop_github_username.sql <<<
--- Drop the github_username profile column and remove the GitHub-auth artifacts.
---
--- GitHub OAuth sign-in / account-linking was removed from the app: it cannot be
--- provisioned as part of a one-click deployment (each install needs its own GitHub
--- OAuth app + client secret + Supabase's manual-linking toggle, none of which can
--- ship in a migration). github_username was only ever populated from that OAuth
--- flow, so the column and its seed strings are now dead.
---
--- NOTE: the self-update "Connect GitHub" flow (lib/updates/*, ConnectGitHubButton)
--- is a separate feature and is intentionally left untouched — the connect_github
--- translation is kept for it.
-
--- 1. Rewrite handle_new_user() so new signups no longer read/populate github_username.
-CREATE OR REPLACE FUNCTION public.handle_new_user() RETURNS trigger
-    LANGUAGE plpgsql SECURITY DEFINER
-    SET search_path TO 'public'
-    AS $$
-DECLARE
-  admin_flag_set boolean := false;
-  user_role public.user_role;
-  v_full_name text;
-  v_avatar_url text;
-BEGIN
-  INSERT INTO public.site_settings (key, value)
-  VALUES ('is_admin_created', 'false'::jsonb)
-  ON CONFLICT (key) DO NOTHING;
-
-  SELECT COALESCE(value::jsonb::boolean, false)
-    INTO admin_flag_set
-  FROM public.site_settings
-  WHERE key = 'is_admin_created'
-  FOR UPDATE;
-
-  IF admin_flag_set = false THEN
-    user_role := 'ADMIN'::public.user_role;
-
-    UPDATE public.site_settings
-    SET value = 'true'::jsonb
-    WHERE key = 'is_admin_created';
-  ELSE
-    user_role := 'USER'::public.user_role;
-  END IF;
-
-  v_full_name := NEW.raw_user_meta_data->>'full_name';
-  v_avatar_url := NEW.raw_user_meta_data->>'avatar_url';
-
-  INSERT INTO public.profiles (
-    id,
-    role,
-    full_name,
-    avatar_url
-  )
-  VALUES (
-    NEW.id,
-    user_role,
-    v_full_name,
-    v_avatar_url
-  )
-  ON CONFLICT (id) DO UPDATE SET
-    full_name = EXCLUDED.full_name,
-    avatar_url = EXCLUDED.avatar_url;
-
-  RETURN NEW;
-END;
-$$;
-
--- 2. Drop the column now that nothing writes it.
-ALTER TABLE public.profiles DROP COLUMN IF EXISTS github_username;
-
--- 3. Remove the GitHub-auth-only translation strings. connect_github is intentionally
---    kept — it is still used by the self-update "Connect GitHub" button.
-DELETE FROM public.translations
-WHERE key IN (
-  'continue_with_github',
-  'github_username',
-  'github_username_help',
-  'github_link_failed',
-  'github_connected'
-);
-
-
--- >>> FROM: 00000000000011_language_detection_admin_only.sql <<<
--- Restrict writes to the language-detection settings row to ADMIN only.
---
--- \`site_settings.language_detection_settings\` is a non-sensitive, anon-READABLE
--- key (the request proxy reads it with the anon client to pick a visitor's first
--- language). The CMS surfaces it under /cms/settings (ADMIN-only) and the server
--- action guards with an ADMIN check, but the baseline write policies let ADMIN
--- *or* WRITER write any non-sensitive key — so a WRITER could change site-wide
--- detection directly via PostgREST. This migration adds the key to the ADMIN-only
--- write group (INSERT/UPDATE/DELETE) to match the UI boundary, while leaving the
--- SELECT policy untouched so the proxy's anon read keeps working.
---
--- Forward-only; recreates the three write policies idempotently.
-
-DROP POLICY IF EXISTS site_settings_insert_policy ON public.site_settings;
-CREATE POLICY site_settings_insert_policy ON public.site_settings FOR INSERT TO authenticated WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
-
-DROP POLICY IF EXISTS site_settings_update_policy ON public.site_settings;
-CREATE POLICY site_settings_update_policy ON public.site_settings FOR UPDATE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role)))) WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
-
-DROP POLICY IF EXISTS site_settings_delete_policy ON public.site_settings;
-CREATE POLICY site_settings_delete_policy ON public.site_settings FOR DELETE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
-
-
-  -- Step D: Record the applied migrations in history (truncated in Step B) so
-  -- \`npm run db:migrate:check\` reports up to date instead of listing every file as pending.
-  INSERT INTO supabase_migrations.schema_migrations (version, name) VALUES
-    ('00000000000000', 'baseline_schema'),
-    ('00000000000001', 'baseline_constraints_and_indexes'),
-    ('00000000000002', 'baseline_security_and_grants'),
-    ('00000000000003', 'baseline_seed'),
-    ('00000000000004', 'default_logo_email_safe'),
-    ('00000000000005', 'add_custom_canonical'),
-    ('00000000000006', 'home_live_demo_promo'),
-    ('00000000000007', 'home_live_demo_promo_copy_fix'),
-    ('00000000000008', 'setup_article_reorder'),
-    ('00000000000009', 'home_live_demo_promo_contrast'),
-    ('00000000000010', 'drop_github_username'),
-    ('00000000000011', 'language_detection_admin_only')
-  ON CONFLICT (version) DO NOTHING;
-
-  -- Step E: Anchor preserved profiles
-  INSERT INTO public.profiles (id, updated_at, full_name, avatar_url, website, role)
-  SELECT preserved_user.id, NULL, NULL, NULL, NULL, 'ADMIN'
-  FROM (
-    VALUES
-      ('63a8aa07-ef6e-4cc7-bafa-ece023c74366'::uuid),
-      ('e3a2c121-70a4-4239-a9df-f70ce717f5a1'::uuid)
-  ) AS preserved_user(id)
-  WHERE EXISTS (SELECT 1 FROM auth.users WHERE id = preserved_user.id)
-    AND NOT EXISTS (SELECT 1 FROM public.profiles WHERE id = preserved_user.id);
-
-  -- Step F: Re-assert the "first admin exists" flag. The sandbox preserves its demo
-  -- ADMIN users across the wipe (Steps A & E), but the reseeded baseline resets
-  -- is_admin_created to 'false' and handle_new_user() only flips it on a NEW auth.users
-  -- INSERT -- which never fires for preserved users. Without this the proxy setup-gate
-  -- funnels ALL sandbox traffic (including this reset cron on its next run) to /setup even
-  -- though admins already exist. Guarded on an ADMIN profile actually being present.
-  UPDATE public.site_settings
-  SET value = 'true'::jsonb
-  WHERE key = 'is_admin_created'
-    AND EXISTS (SELECT 1 FROM public.profiles WHERE role = 'ADMIN'::public.user_role);
-
-`;
+
+
+-- >>> FROM: 00000000000010_drop_github_username.sql <<<
+-- Drop the github_username profile column and remove the GitHub-auth artifacts.
+--
+-- GitHub OAuth sign-in / account-linking was removed from the app: it cannot be
+-- provisioned as part of a one-click deployment (each install needs its own GitHub
+-- OAuth app + client secret + Supabase's manual-linking toggle, none of which can
+-- ship in a migration). github_username was only ever populated from that OAuth
+-- flow, so the column and its seed strings are now dead.
+--
+-- NOTE: the self-update "Connect GitHub" flow (lib/updates/*, ConnectGitHubButton)
+-- is a separate feature and is intentionally left untouched — the connect_github
+-- translation is kept for it.
+
+-- 1. Rewrite handle_new_user() so new signups no longer read/populate github_username.
+CREATE OR REPLACE FUNCTION public.handle_new_user() RETURNS trigger
+    LANGUAGE plpgsql SECURITY DEFINER
+    SET search_path TO 'public'
+    AS $$
+DECLARE
+  admin_flag_set boolean := false;
+  user_role public.user_role;
+  v_full_name text;
+  v_avatar_url text;
+BEGIN
+  INSERT INTO public.site_settings (key, value)
+  VALUES ('is_admin_created', 'false'::jsonb)
+  ON CONFLICT (key) DO NOTHING;
+
+  SELECT COALESCE(value::jsonb::boolean, false)
+    INTO admin_flag_set
+  FROM public.site_settings
+  WHERE key = 'is_admin_created'
+  FOR UPDATE;
+
+  IF admin_flag_set = false THEN
+    user_role := 'ADMIN'::public.user_role;
+
+    UPDATE public.site_settings
+    SET value = 'true'::jsonb
+    WHERE key = 'is_admin_created';
+  ELSE
+    user_role := 'USER'::public.user_role;
+  END IF;
+
+  v_full_name := NEW.raw_user_meta_data->>'full_name';
+  v_avatar_url := NEW.raw_user_meta_data->>'avatar_url';
+
+  INSERT INTO public.profiles (
+    id,
+    role,
+    full_name,
+    avatar_url
+  )
+  VALUES (
+    NEW.id,
+    user_role,
+    v_full_name,
+    v_avatar_url
+  )
+  ON CONFLICT (id) DO UPDATE SET
+    full_name = EXCLUDED.full_name,
+    avatar_url = EXCLUDED.avatar_url;
+
+  RETURN NEW;
+END;
+$$;
+
+-- 2. Drop the column now that nothing writes it.
+ALTER TABLE public.profiles DROP COLUMN IF EXISTS github_username;
+
+-- 3. Remove the GitHub-auth-only translation strings. connect_github is intentionally
+--    kept — it is still used by the self-update "Connect GitHub" button.
+DELETE FROM public.translations
+WHERE key IN (
+  'continue_with_github',
+  'github_username',
+  'github_username_help',
+  'github_link_failed',
+  'github_connected'
+);
+
+
+-- >>> FROM: 00000000000011_language_detection_admin_only.sql <<<
+-- Restrict writes to the language-detection settings row to ADMIN only.
+--
+-- \`site_settings.language_detection_settings\` is a non-sensitive, anon-READABLE
+-- key (the request proxy reads it with the anon client to pick a visitor's first
+-- language). The CMS surfaces it under /cms/settings (ADMIN-only) and the server
+-- action guards with an ADMIN check, but the baseline write policies let ADMIN
+-- *or* WRITER write any non-sensitive key — so a WRITER could change site-wide
+-- detection directly via PostgREST. This migration adds the key to the ADMIN-only
+-- write group (INSERT/UPDATE/DELETE) to match the UI boundary, while leaving the
+-- SELECT policy untouched so the proxy's anon read keeps working.
+--
+-- Forward-only; recreates the three write policies idempotently.
+
+DROP POLICY IF EXISTS site_settings_insert_policy ON public.site_settings;
+CREATE POLICY site_settings_insert_policy ON public.site_settings FOR INSERT TO authenticated WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+DROP POLICY IF EXISTS site_settings_update_policy ON public.site_settings;
+CREATE POLICY site_settings_update_policy ON public.site_settings FOR UPDATE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role)))) WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+DROP POLICY IF EXISTS site_settings_delete_policy ON public.site_settings;
+CREATE POLICY site_settings_delete_policy ON public.site_settings FOR DELETE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+
+-- >>> FROM: 00000000000012_cortex_ai_stock_photo_settings.sql <<<
+-- Protect the Cortex AI stock-photo provider API keys stored in site_settings.
+--
+-- The stock-photo search tool (search_stock_photos) can read a Pexels or Unsplash
+-- API key from site_settings so the key lives in the database instead of an env var.
+-- Those two rows are SECRETS and must never be publicly readable: like the OpenRouter
+-- BYOK key, they belong in the sensitive-keys group that only authenticated ADMINs can
+-- read or write. The baseline site_settings SELECT policy makes any key NOT in that
+-- group anon-readable, so we add the two stock-photo keys to every policy's sensitive
+-- array. The value stored is an encrypted envelope, but we protect the row regardless.
+--
+-- Forward-only; recreates all four site_settings policies idempotently, preserving the
+-- existing sensitive keys (including language_detection_settings on the write policies,
+-- which stays anon-READABLE and is therefore not added to the SELECT policy).
+
+DROP POLICY IF EXISTS site_settings_read_policy ON public.site_settings;
+CREATE POLICY site_settings_read_policy ON public.site_settings FOR SELECT USING (((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text])) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text])) AND (( SELECT auth.role() AS role) = 'authenticated'::text) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+DROP POLICY IF EXISTS site_settings_insert_policy ON public.site_settings;
+CREATE POLICY site_settings_insert_policy ON public.site_settings FOR INSERT TO authenticated WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+DROP POLICY IF EXISTS site_settings_update_policy ON public.site_settings;
+CREATE POLICY site_settings_update_policy ON public.site_settings FOR UPDATE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role)))) WITH CHECK ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+DROP POLICY IF EXISTS site_settings_delete_policy ON public.site_settings;
+CREATE POLICY site_settings_delete_policy ON public.site_settings FOR DELETE TO authenticated USING ((((key <> ALL (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role]))) OR ((key = ANY (ARRAY['cortex_ai_openrouter_api_key'::text, 'bot_protection_secret'::text, 'email_secret'::text, 'payment_secret'::text, 'language_detection_settings'::text, 'cortex_ai_pexels_api_key'::text, 'cortex_ai_unsplash_access_key'::text])) AND (( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role))));
+
+
+  -- Step D: Record the applied migrations in history (truncated in Step B) so
+  -- \`npm run db:migrate:check\` reports up to date instead of listing every file as pending.
+  INSERT INTO supabase_migrations.schema_migrations (version, name) VALUES
+    ('00000000000000', 'baseline_schema'),
+    ('00000000000001', 'baseline_constraints_and_indexes'),
+    ('00000000000002', 'baseline_security_and_grants'),
+    ('00000000000003', 'baseline_seed'),
+    ('00000000000004', 'default_logo_email_safe'),
+    ('00000000000005', 'add_custom_canonical'),
+    ('00000000000006', 'home_live_demo_promo'),
+    ('00000000000007', 'home_live_demo_promo_copy_fix'),
+    ('00000000000008', 'setup_article_reorder'),
+    ('00000000000009', 'home_live_demo_promo_contrast'),
+    ('00000000000010', 'drop_github_username'),
+    ('00000000000011', 'language_detection_admin_only'),
+    ('00000000000012', 'cortex_ai_stock_photo_settings')
+  ON CONFLICT (version) DO NOTHING;
+
+  -- Step E: Anchor preserved profiles
+  INSERT INTO public.profiles (id, updated_at, full_name, avatar_url, website, role)
+  SELECT preserved_user.id, NULL, NULL, NULL, NULL, 'ADMIN'
+  FROM (
+    VALUES
+      ('63a8aa07-ef6e-4cc7-bafa-ece023c74366'::uuid),
+      ('e3a2c121-70a4-4239-a9df-f70ce717f5a1'::uuid)
+  ) AS preserved_user(id)
+  WHERE EXISTS (SELECT 1 FROM auth.users WHERE id = preserved_user.id)
+    AND NOT EXISTS (SELECT 1 FROM public.profiles WHERE id = preserved_user.id);
+
+  -- Step F: Re-assert the "first admin exists" flag. The sandbox preserves its demo
+  -- ADMIN users across the wipe (Steps A & E), but the reseeded baseline resets
+  -- is_admin_created to 'false' and handle_new_user() only flips it on a NEW auth.users
+  -- INSERT -- which never fires for preserved users. Without this the proxy setup-gate
+  -- funnels ALL sandbox traffic (including this reset cron on its next run) to /setup even
+  -- though admins already exist. Guarded on an ADMIN profile actually being present.
+  UPDATE public.site_settings
+  SET value = 'true'::jsonb
+  WHERE key = 'is_admin_created'
+    AND EXISTS (SELECT 1 FROM public.profiles WHERE role = 'ADMIN'::public.user_role);
+
+`;