create-nextblock 0.15.5 → 0.15.9

package/templates/nextblock-template/app/api/cron/reset-sandbox/sandboxResetSql.ts

@@ -7369,6 +7369,665 @@ END
 $body$;
 
 
+-- >>> FROM: 00000000000026_product_inquiries.sql <<<
+-- Purchase enquiries raised when the store cannot take payment.
+--
+-- A NextBlock store can be fully built — products, prices, images, pages — while its
+-- Stripe or Freemius credentials are still missing. Until this migration the only
+-- symptom was a shopper reaching checkout and receiving the payment provider's raw
+-- rejection ("Invalid API Key provided: sk_test_*ummy"), which tells them nothing and
+-- loses the sale outright.
+--
+-- The storefront now offers those shoppers an enquiry form in place of Add-to-Cart,
+-- and every submission lands here. The row is the product, not the email: SMTP is a
+-- separate piece of setup that the same half-configured store has usually also not
+-- done, so a notification that cannot be sent must never be the only record. The
+-- \`email_delivered\` flag records whether the owner was successfully notified; false
+-- means "read this in the CMS, nobody got a mail about it".
+--
+-- SECURITY POSTURE. Rows hold visitor-supplied PII (name, email, free text) plus a
+-- masked IP. There is deliberately NO anon policy of any kind: anonymous visitors
+-- neither read nor write this table directly. The public server action inserts with
+-- the service-role client after bot-protection and throttle checks, exactly as
+-- \`privacy_consent_logs\` does — that keeps the insert shape server-controlled and
+-- means a leaked anon key cannot enumerate or seed enquiries. ADMINs read; nobody
+-- else does, because these are sales leads and personal data.
+--
+-- \`product_id\` is a PLAIN uuid with NO foreign key, following site_script_revisions:
+-- an enquiry is evidence that someone wanted a product, and deleting the product
+-- should not delete or rewrite that evidence. \`product_slug\` and \`product_title\` are
+-- denormalised so a deleted product is still identifiable in the list.
+--
+-- Forward-only and idempotent.
+
+CREATE TABLE IF NOT EXISTS public.product_inquiries (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    -- No FK by design (see header). Null when the product was deleted after the fact.
+    product_id uuid,
+    product_slug text,
+    product_title text,
+    sender_name text NOT NULL,
+    sender_email text NOT NULL,
+    message text NOT NULL,
+    -- Which language the visitor was browsing in, so the owner can reply in kind.
+    locale text,
+    ip_masked text,
+    user_agent text,
+    -- False when SMTP was unconfigured or the send failed: the CMS list is then the
+    -- only place this enquiry exists.
+    email_delivered boolean DEFAULT false NOT NULL,
+    is_resolved boolean DEFAULT false NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT product_inquiries_pkey PRIMARY KEY (id),
+    CONSTRAINT product_inquiries_sender_name_not_blank CHECK ((char_length(btrim(sender_name)) > 0)),
+    CONSTRAINT product_inquiries_sender_email_not_blank CHECK ((char_length(btrim(sender_email)) > 0)),
+    CONSTRAINT product_inquiries_message_not_blank CHECK ((char_length(btrim(message)) > 0))
+);
+
+COMMENT ON TABLE public.product_inquiries IS 'Visitor purchase enquiries raised when the store cannot take payment. Written by the service role from a public server action; read by ADMINs only.';
+
+COMMENT ON COLUMN public.product_inquiries.product_id IS 'Plain uuid, no FK: an enquiry outlives the product it was about.';
+
+COMMENT ON COLUMN public.product_inquiries.ip_masked IS 'Partially masked IP (e.g. 203.0.113.x) - never store a full address. Also backs the per-IP submission throttle.';
+
+COMMENT ON COLUMN public.product_inquiries.email_delivered IS 'False when the owner notification could not be sent (e.g. SMTP unconfigured); the stored row is then the only record.';
+
+-- Newest-first is the only listing order the CMS needs.
+CREATE INDEX IF NOT EXISTS product_inquiries_created_idx
+    ON public.product_inquiries USING btree (created_at DESC);
+
+-- Backs the throttle lookup in the public server action: count recent rows per IP.
+CREATE INDEX IF NOT EXISTS product_inquiries_ip_created_idx
+    ON public.product_inquiries USING btree (ip_masked, created_at DESC);
+
+-- Lets the CMS count outstanding enquiries without scanning resolved history.
+CREATE INDEX IF NOT EXISTS product_inquiries_unresolved_idx
+    ON public.product_inquiries USING btree (created_at DESC)
+    WHERE (is_resolved = false);
+
+ALTER TABLE public.product_inquiries ENABLE ROW LEVEL SECURITY;
+
+-- anon is deliberately absent: the public path goes through the service role.
+GRANT SELECT, UPDATE ON TABLE public.product_inquiries TO authenticated;
+GRANT ALL ON TABLE public.product_inquiries TO service_role;
+
+DROP POLICY IF EXISTS product_inquiries_admin_read_policy ON public.product_inquiries;
+CREATE POLICY product_inquiries_admin_read_policy ON public.product_inquiries FOR SELECT TO authenticated USING ((( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role));
+
+-- ADMINs may only flip the resolved flag; the enquiry content itself is a record.
+DROP POLICY IF EXISTS product_inquiries_admin_update_policy ON public.product_inquiries;
+CREATE POLICY product_inquiries_admin_update_policy ON public.product_inquiries FOR UPDATE TO authenticated USING ((( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role)) WITH CHECK ((( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role));
+
+DROP POLICY IF EXISTS product_inquiries_service_role_policy ON public.product_inquiries;
+CREATE POLICY product_inquiries_service_role_policy ON public.product_inquiries TO service_role USING (true) WITH CHECK (true);
+
+-- Where enquiry notifications are sent. Kept in the PUBLIC settings row rather than the
+-- secret one because it is an address, not a credential — but it is never rendered to
+-- the storefront: the public form posts a product id and the server resolves the
+-- recipient. Empty string means "fall back", see resolveSellerContactEmail().
+INSERT INTO public.site_settings (key, value)
+VALUES ('store_contact', '{"contactEmail": ""}'::jsonb)
+ON CONFLICT (key) DO NOTHING;
+
+-- Storefront copy for the enquiry flow. Public-facing, so it must be translatable;
+-- the components pass an English literal as the fallback, so an install that never
+-- runs this seed still renders correctly.
+INSERT INTO public.translations (key, translations, created_at, updated_at) VALUES
+    ('ecommerce.contact_seller', '{"en": "Contact the seller", "fr": "Contacter le vendeur"}', now(), now()),
+    ('ecommerce.contact_seller_heading', '{"en": "Interested in this product?", "fr": "Ce produit vous intéresse ?"}', now(), now()),
+    ('ecommerce.contact_seller_intro', '{"en": "Online ordering isn''t available for this item yet. Send the seller a message and they''ll get back to you about buying it.", "fr": "La commande en ligne n''est pas encore disponible pour cet article. Envoyez un message au vendeur et il vous répondra au sujet de son achat."}', now(), now()),
+    ('ecommerce.contact_seller_name', '{"en": "Your name", "fr": "Votre nom"}', now(), now()),
+    ('ecommerce.contact_seller_email', '{"en": "Your email", "fr": "Votre courriel"}', now(), now()),
+    ('ecommerce.contact_seller_message', '{"en": "Message", "fr": "Message"}', now(), now()),
+    ('ecommerce.contact_seller_send', '{"en": "Send message", "fr": "Envoyer le message"}', now(), now()),
+    ('ecommerce.contact_seller_sending', '{"en": "Sending...", "fr": "Envoi..."}', now(), now()),
+    ('ecommerce.contact_seller_sent', '{"en": "Thanks - your message has been sent to the seller. They''ll reply to the email address you gave.", "fr": "Merci - votre message a été envoyé au vendeur. Il répondra à l''adresse courriel que vous avez indiquée."}', now(), now()),
+    ('ecommerce.contact_seller_error', '{"en": "Sorry, your message couldn''t be sent. Please try again in a moment.", "fr": "Désolé, votre message n''a pas pu être envoyé. Veuillez réessayer dans un instant."}', now(), now()),
+    ('ecommerce.contact_seller_invalid', '{"en": "Please check your name, email address and message, then try again.", "fr": "Veuillez vérifier votre nom, votre adresse courriel et votre message, puis réessayer."}', now(), now()),
+    ('ecommerce.contact_seller_throttled', '{"en": "You''ve sent several messages already. Please wait a few minutes before sending another.", "fr": "Vous avez déjà envoyé plusieurs messages. Veuillez patienter quelques minutes avant d''en envoyer un autre."}', now(), now()),
+    ('ecommerce.not_available_for_purchase', '{"en": "Not available for online purchase", "fr": "Non disponible à l''achat en ligne"}', now(), now()),
+    ('ecommerce.checkout_payments_unavailable', '{"en": "This store is not able to take payments right now. Please contact the seller to complete your purchase.", "fr": "Cette boutique ne peut pas accepter de paiements pour le moment. Veuillez contacter le vendeur pour finaliser votre achat."}', now(), now())
+ON CONFLICT (key) DO NOTHING;
+
+
+-- >>> FROM: 00000000000027_message_threads.sql <<<
+-- Private conversations with anonymous visitors, and the end of the exposed form address.
+--
+-- Two problems, one shape.
+--
+-- FIRST: a contact-form block stores its destination address in the block's own
+-- content, and \`FormBlockRenderer\` is a "use client" component that receives that
+-- content wholesale. Everything crossing that boundary is serialized into the RSC
+-- payload, so the shop owner's inbox is published in the markup of every page
+-- carrying a form. \`form_endpoints\` moves the address server-side and leaves behind a
+-- \`form_key\` — an opaque handle that grants nothing and is safe to serialize.
+--
+-- SECOND: a visitor who sends a message has nowhere to receive an answer. They are
+-- anonymous — \`cms_interactions\` cannot hold them, because its \`user_id\` is NOT NULL
+-- with a foreign key to \`profiles\`. So this is a separate lane: \`message_threads\` plus
+-- \`thread_messages\`, reached by a tokenised link rather than an account.
+--
+-- WHY REVIEWS AND COMMENTS ARE NOT HERE. They are already public, already tied to a
+-- registered account, and a staff answer to them is published content, not a private
+-- reply. That lane stays in \`cms_interactions\` and is handled by migration 28. One
+-- inbox reads both; the storage stays honest about the difference.
+--
+-- SECURITY POSTURE. Rows hold visitor PII (name, email, free text) and a masked IP.
+-- There is NO anon grant and NO anon policy: the tokenised visitor page verifies the
+-- token in application code and then reads with the service role, the same posture the
+-- MCP token route takes against \`mcp_access_tokens\`. ADMINs read; nobody else does.
+--
+-- \`token_hash\` stores only a SHA-256 of the visitor's token. The plaintext exists long
+-- enough to be placed in one outbound email and is never written down. A token is
+-- minted on the FIRST ADMIN REPLY, never at submission — a store that receives a
+-- hundred enquiries and answers three has three live credentials, not a hundred.
+--
+-- \`source\` is a text column with a CHECK rather than an enum, deliberately.
+-- \`interaction_type\` in this same schema is the cautionary tale: a two-value enum
+-- guarded by an exhaustive CHECK, where adding a third value needs ALTER TYPE ... ADD
+-- VALUE — and PostgreSQL forbids using a value added in the transaction that added it,
+-- which is exactly one migration file. A CHECK is replaceable in one statement.
+--
+-- Forward-only and idempotent.
+
+-- ---------------------------------------------------------------------------
+-- 1. form_endpoints — where a contact-form block's mail goes, and what its fields
+--    are called. \`fields\` is a SERVER-SIDE snapshot of the field manifest so the
+--    notification email renders labels the browser did not supply; the same rule
+--    the product-enquiry action follows when it looks the product title up itself.
+-- ---------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS public.form_endpoints (
+    form_key uuid NOT NULL,
+    label text DEFAULT 'Contact form' NOT NULL,
+    -- NULL/empty means "fall back to the resolver ladder", like store_contact.
+    recipient_email text,
+    fields jsonb DEFAULT '[]'::jsonb NOT NULL,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT form_endpoints_pkey PRIMARY KEY (form_key),
+    CONSTRAINT form_endpoints_label_not_blank CHECK ((char_length(btrim(label)) > 0)),
+    CONSTRAINT form_endpoints_fields_array CHECK ((jsonb_typeof(fields) = 'array'))
+);
+
+COMMENT ON TABLE public.form_endpoints IS 'Server-side destination and field manifest for a contact-form block, keyed by the non-secret form_key carried in block content. The address never reaches the browser.';
+
+COMMENT ON COLUMN public.form_endpoints.form_key IS 'Non-secret opaque handle. Safe in the RSC payload: it grants nothing, it is only a lookup key.';
+
+COMMENT ON COLUMN public.form_endpoints.fields IS 'Snapshot of [{temp_id,label,field_type}] written by the CMS editor, so labels in emails and the inbox are server-trusted.';
+
+DROP TRIGGER IF EXISTS set_form_endpoints_updated_at ON public.form_endpoints;
+CREATE TRIGGER set_form_endpoints_updated_at BEFORE UPDATE ON public.form_endpoints
+    FOR EACH ROW EXECUTE FUNCTION public.set_current_timestamp_updated_at();
+
+ALTER TABLE public.form_endpoints ENABLE ROW LEVEL SECURITY;
+
+-- anon deliberately absent: the public submit path goes through the service role.
+GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE public.form_endpoints TO authenticated;
+GRANT ALL ON TABLE public.form_endpoints TO service_role;
+
+DROP POLICY IF EXISTS form_endpoints_editor_read_policy ON public.form_endpoints;
+CREATE POLICY form_endpoints_editor_read_policy ON public.form_endpoints FOR SELECT TO authenticated USING ((( SELECT public.get_current_user_role() AS get_current_user_role) = ANY (ARRAY['ADMIN'::public.user_role, 'WRITER'::public.user_role])));
+
+DROP POLICY IF EXISTS form_endpoints_admin_write_policy ON public.form_endpoints;
+CREATE POLICY form_endpoints_admin_write_policy ON public.form_endpoints FOR ALL TO authenticated USING ((( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role)) WITH CHECK ((( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role));
+
+DROP POLICY IF EXISTS form_endpoints_service_role_policy ON public.form_endpoints;
+CREATE POLICY form_endpoints_service_role_policy ON public.form_endpoints TO service_role USING (true) WITH CHECK (true);
+
+-- ---------------------------------------------------------------------------
+-- 2. message_threads — the private-lane spine and the only home of a thread token.
+--    \`subject_id\` and \`form_key\` are PLAIN uuids with NO foreign key: a conversation
+--    outlives the product or the form block it started from.
+-- ---------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS public.message_threads (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    source text NOT NULL,
+    -- product_inquiries.id when source = 'product_inquiry'.
+    subject_id uuid,
+    -- form_endpoints.form_key when source = 'contact_form'.
+    form_key uuid,
+    -- Denormalised so a deleted product or removed form block stays identifiable.
+    subject_label text DEFAULT 'Message' NOT NULL,
+    sender_name text,
+    -- NULL when a contact form collected no email field. Such a thread can never be
+    -- answered, and the CMS says so rather than failing silently at reply time.
+    sender_email text,
+    locale text,
+    -- Submitted field map for a contact form: {temp_id: value}.
+    fields jsonb DEFAULT '{}'::jsonb NOT NULL,
+    status text DEFAULT 'open' NOT NULL,
+    unread_for_admin boolean DEFAULT true NOT NULL,
+    unread_for_visitor boolean DEFAULT false NOT NULL,
+    -- SHA-256 hex of the visitor's token; NULL until the first admin reply.
+    token_hash text,
+    token_expires_at timestamp with time zone,
+    token_revoked_at timestamp with time zone,
+    token_last_used_at timestamp with time zone,
+    last_message_at timestamp with time zone DEFAULT now() NOT NULL,
+    ip_masked text,
+    user_agent text,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT message_threads_pkey PRIMARY KEY (id),
+    CONSTRAINT message_threads_token_hash_key UNIQUE (token_hash),
+    CONSTRAINT message_threads_source_check
+        CHECK ((source = ANY (ARRAY['product_inquiry'::text, 'contact_form'::text]))),
+    CONSTRAINT message_threads_status_check
+        CHECK ((status = ANY (ARRAY['open'::text, 'closed'::text]))),
+    CONSTRAINT message_threads_subject_check CHECK (
+        (((source = 'product_inquiry'::text) AND (subject_id IS NOT NULL)) OR
+         ((source = 'contact_form'::text) AND (form_key IS NOT NULL)))),
+    CONSTRAINT message_threads_fields_object CHECK ((jsonb_typeof(fields) = 'object'))
+);
+
+COMMENT ON TABLE public.message_threads IS 'Private conversations with anonymous visitors (product enquiries and contact-form submissions). Written by the service role from public server actions; read by ADMINs only. Public reviews and comments are NOT here - they live in cms_interactions.';
+
+COMMENT ON COLUMN public.message_threads.token_hash IS 'SHA-256 hex of the visitor thread token. The raw token is never stored; it is minted on the first admin reply and mailed once.';
+
+COMMENT ON COLUMN public.message_threads.subject_id IS 'product_inquiries.id. Plain uuid, no FK: a conversation outlives the enquiry record it grew from.';
+
+CREATE INDEX IF NOT EXISTS message_threads_last_message_idx
+    ON public.message_threads USING btree (last_message_at DESC);
+
+CREATE INDEX IF NOT EXISTS message_threads_source_last_idx
+    ON public.message_threads USING btree (source, last_message_at DESC);
+
+-- Backs the CMS nav unread badge without scanning read history.
+CREATE INDEX IF NOT EXISTS message_threads_unread_idx
+    ON public.message_threads USING btree (last_message_at DESC)
+    WHERE (unread_for_admin = true);
+
+-- Idempotent backfill / dedupe of enquiry threads.
+CREATE INDEX IF NOT EXISTS message_threads_subject_idx
+    ON public.message_threads USING btree (subject_id) WHERE (subject_id IS NOT NULL);
+
+-- No separate token index: message_threads_token_hash_key is already the unique
+-- btree the /thread lookup probes.
+
+DROP TRIGGER IF EXISTS set_message_threads_updated_at ON public.message_threads;
+CREATE TRIGGER set_message_threads_updated_at BEFORE UPDATE ON public.message_threads
+    FOR EACH ROW EXECUTE FUNCTION public.set_current_timestamp_updated_at();
+
+ALTER TABLE public.message_threads ENABLE ROW LEVEL SECURITY;
+
+GRANT SELECT, UPDATE ON TABLE public.message_threads TO authenticated;
+GRANT ALL ON TABLE public.message_threads TO service_role;
+
+DROP POLICY IF EXISTS message_threads_admin_read_policy ON public.message_threads;
+CREATE POLICY message_threads_admin_read_policy ON public.message_threads FOR SELECT TO authenticated USING ((( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role));
+
+DROP POLICY IF EXISTS message_threads_admin_update_policy ON public.message_threads;
+CREATE POLICY message_threads_admin_update_policy ON public.message_threads FOR UPDATE TO authenticated USING ((( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role)) WITH CHECK ((( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role));
+
+DROP POLICY IF EXISTS message_threads_service_role_policy ON public.message_threads;
+CREATE POLICY message_threads_service_role_policy ON public.message_threads TO service_role USING (true) WITH CHECK (true);
+
+-- ---------------------------------------------------------------------------
+-- 3. thread_messages — one turn of a private conversation.
+-- ---------------------------------------------------------------------------
+CREATE TABLE IF NOT EXISTS public.thread_messages (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    thread_id uuid NOT NULL,
+    direction text NOT NULL,
+    body text NOT NULL,
+    -- profiles.id for an outbound reply. No FK: a departing admin must not take the
+    -- conversation with them.
+    author_id uuid,
+    author_name text,
+    -- False when SMTP was unconfigured or the send failed. sendEmail() throws when
+    -- unconfigured, so this row - not the mail - is the record.
+    email_delivered boolean DEFAULT false NOT NULL,
+    email_error text,
+    ip_masked text,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT thread_messages_pkey PRIMARY KEY (id),
+    CONSTRAINT thread_messages_direction_check
+        CHECK ((direction = ANY (ARRAY['inbound'::text, 'outbound'::text]))),
+    CONSTRAINT thread_messages_body_not_blank CHECK ((char_length(btrim(body)) > 0))
+);
+
+COMMENT ON TABLE public.thread_messages IS 'Turns of a private conversation. Content is append-only; only the delivery flags may change after insert.';
+
+-- A real foreign key here, unlike the outward pointers above: a message has no
+-- meaning without its thread.
+DO $rb$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint
+                 WHERE conname = 'thread_messages_thread_id_fkey'
+                   AND conrelid = 'public.thread_messages'::regclass) THEN
+    ALTER TABLE ONLY public.thread_messages
+      ADD CONSTRAINT thread_messages_thread_id_fkey FOREIGN KEY (thread_id)
+      REFERENCES public.message_threads(id) ON DELETE CASCADE;
+  END IF;
+END $rb$;
+
+CREATE INDEX IF NOT EXISTS thread_messages_thread_created_idx
+    ON public.thread_messages USING btree (thread_id, created_at);
+
+-- Backs the per-IP reply throttle on the public thread page.
+CREATE INDEX IF NOT EXISTS thread_messages_ip_created_idx
+    ON public.thread_messages USING btree (ip_masked, created_at DESC);
+
+-- Message TEXT is append-only — not the whole row, because email_delivered has to be
+-- settable after the send completes. The trigger blocks rewrites of the load-bearing
+-- columns only, and it binds the service role too, which otherwise bypasses RLS.
+CREATE OR REPLACE FUNCTION public.prevent_thread_message_rewrite() RETURNS trigger
+    LANGUAGE plpgsql SET search_path = '' AS $$
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    RAISE EXCEPTION 'thread_messages is append-only; DELETE is not permitted'
+      USING ERRCODE = 'restrict_violation';
+  END IF;
+  IF NEW.body IS DISTINCT FROM OLD.body
+     OR NEW.direction IS DISTINCT FROM OLD.direction
+     OR NEW.thread_id IS DISTINCT FROM OLD.thread_id
+     OR NEW.created_at IS DISTINCT FROM OLD.created_at THEN
+    RAISE EXCEPTION 'thread_messages content is append-only; only delivery flags may change'
+      USING ERRCODE = 'restrict_violation';
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS trg_thread_messages_append_only ON public.thread_messages;
+CREATE TRIGGER trg_thread_messages_append_only BEFORE UPDATE OR DELETE ON public.thread_messages
+    FOR EACH ROW EXECUTE FUNCTION public.prevent_thread_message_rewrite();
+
+-- NB: the ON DELETE CASCADE above fires this trigger, so deleting a thread is
+-- impossible by design. "Delete" in the CMS means status='closed' plus a revoked
+-- token, and the UI says so.
+
+ALTER TABLE public.thread_messages ENABLE ROW LEVEL SECURITY;
+
+GRANT SELECT ON TABLE public.thread_messages TO authenticated;
+GRANT ALL ON TABLE public.thread_messages TO service_role;
+
+DROP POLICY IF EXISTS thread_messages_admin_read_policy ON public.thread_messages;
+CREATE POLICY thread_messages_admin_read_policy ON public.thread_messages FOR SELECT TO authenticated USING ((( SELECT public.get_current_user_role() AS get_current_user_role) = 'ADMIN'::public.user_role));
+
+DROP POLICY IF EXISTS thread_messages_service_role_policy ON public.thread_messages;
+CREATE POLICY thread_messages_service_role_policy ON public.thread_messages TO service_role USING (true) WITH CHECK (true);
+
+-- ---------------------------------------------------------------------------
+-- 4. Backfill: every existing enquiry becomes a thread whose first inbound turn is
+--    the original message. product_inquiries is KEPT and kept written — it is the
+--    enquiry's own record and owns the ip_masked the submission throttle counts.
+--    The thread is a conversation ABOUT the enquiry, not a replacement for it.
+-- ---------------------------------------------------------------------------
+INSERT INTO public.message_threads
+  (source, subject_id, subject_label, sender_name, sender_email, locale,
+   ip_masked, user_agent, unread_for_admin, status, last_message_at, created_at)
+SELECT 'product_inquiry', i.id, COALESCE(i.product_title, 'Product enquiry'),
+       i.sender_name, i.sender_email, i.locale, i.ip_masked, i.user_agent,
+       NOT i.is_resolved, CASE WHEN i.is_resolved THEN 'closed' ELSE 'open' END,
+       i.created_at, i.created_at
+FROM public.product_inquiries i
+WHERE NOT EXISTS (SELECT 1 FROM public.message_threads t WHERE t.subject_id = i.id);
+
+INSERT INTO public.thread_messages (thread_id, direction, body, email_delivered, ip_masked, created_at)
+SELECT t.id, 'inbound', i.message, i.email_delivered, i.ip_masked, i.created_at
+FROM public.product_inquiries i
+JOIN public.message_threads t ON t.subject_id = i.id
+WHERE NOT EXISTS (SELECT 1 FROM public.thread_messages m WHERE m.thread_id = t.id);
+
+-- ---------------------------------------------------------------------------
+-- 5. The form-block data migration.
+--    Rewrites every stored form block: mints a form_key, moves recipient_email into
+--    form_endpoints, snapshots the field manifest, and DELETES recipient_email from
+--    the jsonb. Three shapes have to be handled, because a form nested inside a
+--    section has no blocks row of its own — it lives in the section's content:
+--      a) blocks.content where block_type = 'form'
+--      b) blocks.content where block_type = 'section' (column_blocks, slides)
+--      c) content_drafts.blocks / product_drafts.blocks (jsonb arrays of snapshots)
+-- ---------------------------------------------------------------------------
+CREATE OR REPLACE FUNCTION public.nb_migrate_form_columns(p_cols jsonb)
+RETURNS jsonb LANGUAGE plpgsql VOLATILE SET search_path = '' AS $fn$
+DECLARE v_col jsonb; v_blk jsonb; v_new_cols jsonb := '[]'::jsonb; v_new_col jsonb;
+BEGIN
+  FOR v_col IN SELECT * FROM jsonb_array_elements(p_cols) LOOP
+    v_new_col := '[]'::jsonb;
+    FOR v_blk IN SELECT * FROM jsonb_array_elements(coalesce(v_col, '[]'::jsonb)) LOOP
+      v_new_col := v_new_col || jsonb_build_array(
+        v_blk || jsonb_build_object('content', public.nb_migrate_form_content(v_blk->'content')));
+    END LOOP;
+    v_new_cols := v_new_cols || jsonb_build_array(v_new_col);
+  END LOOP;
+  RETURN v_new_cols;
+END;
+$fn$;
+
+CREATE OR REPLACE FUNCTION public.nb_migrate_form_content(p_content jsonb)
+RETURNS jsonb LANGUAGE plpgsql VOLATILE SET search_path = '' AS $fn$
+DECLARE
+  v_key uuid; v_email text; v_fields jsonb; v_slide jsonb; v_new_slides jsonb;
+BEGIN
+  IF p_content IS NULL OR jsonb_typeof(p_content) <> 'object' THEN
+    RETURN p_content;
+  END IF;
+
+  -- Leaf: this object IS a form block's content.
+  IF (p_content ? 'recipient_email') AND (p_content ? 'fields') THEN
+    v_key   := gen_random_uuid();
+    v_email := nullif(btrim(coalesce(p_content->>'recipient_email','')), '');
+    SELECT coalesce(jsonb_agg(jsonb_build_object(
+             'temp_id', f->>'temp_id', 'label', f->>'label', 'field_type', f->>'field_type')), '[]'::jsonb)
+      INTO v_fields
+      FROM jsonb_array_elements(coalesce(p_content->'fields', '[]'::jsonb)) f;
+    INSERT INTO public.form_endpoints (form_key, label, recipient_email, fields)
+    VALUES (v_key, 'Contact form', v_email, v_fields)
+    ON CONFLICT (form_key) DO NOTHING;
+    RETURN (p_content - 'recipient_email') || jsonb_build_object('form_key', v_key::text);
+  END IF;
+
+  -- Container: a section's slides, each with column_blocks.
+  IF (p_content ? 'slides') AND jsonb_typeof(p_content->'slides') = 'array' THEN
+    v_new_slides := '[]'::jsonb;
+    FOR v_slide IN SELECT * FROM jsonb_array_elements(p_content->'slides') LOOP
+      v_new_slides := v_new_slides || jsonb_build_array(
+        v_slide || jsonb_build_object('column_blocks',
+          public.nb_migrate_form_columns(coalesce(v_slide->'column_blocks','[]'::jsonb))));
+    END LOOP;
+    p_content := p_content || jsonb_build_object('slides', v_new_slides);
+  END IF;
+
+  -- Container: a standard section's column_blocks.
+  IF (p_content ? 'column_blocks') AND jsonb_typeof(p_content->'column_blocks') = 'array' THEN
+    p_content := p_content || jsonb_build_object('column_blocks',
+      public.nb_migrate_form_columns(p_content->'column_blocks'));
+  END IF;
+
+  RETURN p_content;
+END;
+$fn$;
+
+-- The LIKE guard keeps this from rewriting (and bumping updated_at on) every block.
+UPDATE public.blocks
+   SET content = public.nb_migrate_form_content(content)
+ WHERE content::text LIKE '%recipient_email%';
+
+UPDATE public.content_drafts d
+   SET blocks = (SELECT coalesce(jsonb_agg(b || jsonb_build_object(
+                          'content', public.nb_migrate_form_content(b->'content'))), '[]'::jsonb)
+                 FROM jsonb_array_elements(d.blocks) b)
+ WHERE d.blocks::text LIKE '%recipient_email%';
+
+UPDATE public.product_drafts d
+   SET blocks = (SELECT coalesce(jsonb_agg(b || jsonb_build_object(
+                          'content', public.nb_migrate_form_content(b->'content'))), '[]'::jsonb)
+                 FROM jsonb_array_elements(d.blocks) b)
+ WHERE d.blocks::text LIKE '%recipient_email%';
+
+-- One-shot helpers. Dropping them keeps the public schema (and db:types) clean.
+DROP FUNCTION IF EXISTS public.nb_migrate_form_content(jsonb);
+DROP FUNCTION IF EXISTS public.nb_migrate_form_columns(jsonb);
+
+-- ---------------------------------------------------------------------------
+-- 6. Seeds. Thread-page copy is public-facing so it must be translatable; the
+--    components pass an English literal as the fallback, so an install that never
+--    runs this seed still renders correctly.
+-- ---------------------------------------------------------------------------
+INSERT INTO public.site_settings (key, value)
+VALUES ('forms_contact', '{"contactEmail": ""}'::jsonb)
+ON CONFLICT (key) DO NOTHING;
+
+INSERT INTO public.translations (key, translations, created_at, updated_at) VALUES
+  ('thread.heading', '{"en": "Your conversation", "fr": "Votre conversation"}', now(), now()),
+  ('thread.reply_label', '{"en": "Write a reply", "fr": "Écrire une réponse"}', now(), now()),
+  ('thread.send', '{"en": "Send reply", "fr": "Envoyer la réponse"}', now(), now()),
+  ('thread.sending', '{"en": "Sending...", "fr": "Envoi..."}', now(), now()),
+  ('thread.sent', '{"en": "Thanks - your reply has been sent.", "fr": "Merci - votre réponse a été envoyée."}', now(), now()),
+  ('thread.error', '{"en": "Sorry, your reply couldn''t be sent. Please try again in a moment.", "fr": "Désolé, votre réponse n''a pas pu être envoyée. Veuillez réessayer dans un instant."}', now(), now()),
+  ('thread.throttled', '{"en": "You''ve sent several replies already. Please wait a few minutes.", "fr": "Vous avez déjà envoyé plusieurs réponses. Veuillez patienter quelques minutes."}', now(), now()),
+  ('thread.closed', '{"en": "This conversation has been closed.", "fr": "Cette conversation est fermée."}', now(), now()),
+  ('thread.invalid', '{"en": "This link has expired or is no longer valid. If you still need help, please contact us again from our website.", "fr": "Ce lien a expiré ou n''est plus valide. Si vous avez encore besoin d''aide, contactez-nous de nouveau depuis notre site."}', now(), now()),
+  ('thread.you', '{"en": "You", "fr": "Vous"}', now(), now()),
+  ('forms.submission_stored', '{"en": "Thanks - your message has been received.", "fr": "Merci - votre message a bien été reçu."}', now(), now())
+ON CONFLICT (key) DO NOTHING;
+
+
+-- >>> FROM: 00000000000028_interaction_replies.sql <<<
+-- Staff replies on reviews and post comments, and the indexes cms_interactions never had.
+--
+-- WHY THIS IS A DIFFERENT SHAPE FROM MIGRATION 27, AND WHY IT NEEDS NO TOKEN.
+-- \`cms_interactions.user_id\` is NOT NULL with a foreign key to \`profiles\`: every review
+-- and comment already comes from a signed-in account with a reachable address, and the
+-- content already renders publicly on /product/{slug} and /article/{slug}. A staff
+-- answer there is PUBLISHED CONTENT plus moderation, not a private conversation.
+-- Routing it through the tokenised thread page would hide a public reply behind a
+-- secret link. So: one inbox in the CMS, two storage models underneath.
+--
+-- THE ONE CONSTRAINT THAT DICTATES THE MODELLING.
+-- \`check_rating_only_for_review\` is an exhaustive OR over ('review','comment'):
+--     (type='review' AND rating IS NOT NULL AND rating BETWEEN 1 AND 5)
+--  OR (type='comment' AND rating IS NULL)
+-- A type='review' row with a NULL rating is rejected, so a reply to a review cannot be
+-- a 'review' row. Adding a 'reply' value to interaction_type would ALSO violate it —
+-- the OR covers no third value — and PostgreSQL forbids using an enum value in the
+-- transaction that added it, which is exactly one migration file.
+--
+-- THEREFORE a reply is a \`type='comment'\` row carrying the PARENT's target and a NULL
+-- rating: a combination the existing constraints already accept, unchanged. The bonus
+-- is decisive — \`update_product_ratings()\` aggregates only
+--   WHERE product_id = ? AND type='review' AND status='approved'
+-- so a reply can never move products.average_rating or products.total_reviews. The new
+-- CHECK below pins that invariant in the schema instead of trusting the action to
+-- remember it.
+--
+-- No new policies are needed. \`cms_interactions_insert_policy\` already admits an
+-- ADMIN/WRITER self-insert with status='approved'
+--   (auth.uid() = user_id AND (status='pending' OR role IN ('ADMIN','WRITER')))
+-- which is precisely a published staff reply.
+--
+-- Forward-only and idempotent.
+
+ALTER TABLE public.cms_interactions ADD COLUMN IF NOT EXISTS parent_id uuid;
+
+COMMENT ON COLUMN public.cms_interactions.parent_id IS 'Set on a staff reply: points at the review or comment being answered. Replies are always type=comment with a NULL rating, and carry the parent''s product_id/post_id so check_product_or_post still holds.';
+
+DO $rb$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint
+                 WHERE conname = 'cms_interactions_parent_id_fkey'
+                   AND conrelid = 'public.cms_interactions'::regclass) THEN
+    ALTER TABLE ONLY public.cms_interactions
+      ADD CONSTRAINT cms_interactions_parent_id_fkey FOREIGN KEY (parent_id)
+      REFERENCES public.cms_interactions(id) ON DELETE CASCADE;
+  END IF;
+END $rb$;
+
+-- One level only, never itself, no rating, always a comment. Keeps the reply
+-- invisible to the ratings trigger and to the existing storefront review query.
+DO $rb$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint
+                 WHERE conname = 'cms_interactions_reply_check'
+                   AND conrelid = 'public.cms_interactions'::regclass) THEN
+    ALTER TABLE public.cms_interactions
+      ADD CONSTRAINT cms_interactions_reply_check CHECK (
+        ((parent_id IS NULL) OR
+         ((parent_id <> id) AND (rating IS NULL) AND (type = 'comment'::public.interaction_type))));
+  END IF;
+END $rb$;
+
+-- Fetch every reply for a page of parents in one probe.
+CREATE INDEX IF NOT EXISTS cms_interactions_parent_idx
+    ON public.cms_interactions USING btree (parent_id, created_at)
+    WHERE (parent_id IS NOT NULL);
+
+-- cms_interactions has had ZERO secondary indexes since the baseline, while both
+-- public renderers filter on exactly these predicates on every product and article
+-- page. The inbox multiplies read volume on this table, so they go in now.
+CREATE INDEX IF NOT EXISTS cms_interactions_product_type_status_idx
+    ON public.cms_interactions USING btree (product_id, type, status, created_at DESC)
+    WHERE (product_id IS NOT NULL);
+
+CREATE INDEX IF NOT EXISTS cms_interactions_post_type_status_idx
+    ON public.cms_interactions USING btree (post_id, type, status, created_at DESC)
+    WHERE (post_id IS NOT NULL);
+
+-- Inbox listing: newest top-level items, replies excluded.
+CREATE INDEX IF NOT EXISTS cms_interactions_inbox_idx
+    ON public.cms_interactions USING btree (created_at DESC)
+    WHERE (parent_id IS NULL);
+
+INSERT INTO public.translations (key, translations, created_at, updated_at) VALUES
+  ('interactions.staff_reply', '{"en": "Reply from the team", "fr": "Réponse de l''équipe"}', now(), now()),
+  ('interactions.staff_badge', '{"en": "Staff", "fr": "Équipe"}', now(), now())
+ON CONFLICT (key) DO NOTHING;
+
+
+-- >>> FROM: 00000000000029_form_endpoints_default_empty.sql <<<
+-- A contact form has no address of its own by default.
+--
+-- The starter content ships a contact page addressed to \`contact@example.com\`, and
+-- migration 27 faithfully carried that placeholder into \`form_endpoints\`. Faithful was
+-- the wrong call. \`example.com\` is reserved by RFC 2606 precisely so it can never be
+-- registered, so the address is not merely unhelpful — it is guaranteed undeliverable,
+-- while looking like a real setting to every layer downstream. The visitor is thanked,
+-- the relay accepts the message, and nobody is ever notified. Nothing errors, so an
+-- install can run that way indefinitely.
+--
+-- Since the messaging system arrived, a per-form address is not something an operator
+-- needs to think about at all. Submissions are stored as threads and answered in
+-- CMS → Messages; the notification address is a single site-wide setting, and a form
+-- only carries its own address when someone deliberately wants that form routed
+-- elsewhere (a careers form to HR, say).
+--
+-- So the default becomes NULL, meaning "use the site contact address", which resolves
+-- to the address set in CMS → Messages and finally to the first admin's own login. An
+-- install therefore reaches a real human out of the box without configuring anything.
+--
+-- The sandbox is unaffected: \`resolveFormRecipient\` overrides everything with
+-- SANDBOX_CONTACT_EMAIL when NEXT_PUBLIC_IS_SANDBOX is set, so the hosted demo keeps
+-- routing to the operator's own inbox without storing an address here.
+--
+-- Forward-only and idempotent.
+
+-- Reserved domains from RFC 2606 / RFC 6761. Matching on the domain rather than the
+-- exact seeded string also catches an operator who typed their own placeholder.
+UPDATE public.form_endpoints
+   SET recipient_email = NULL
+ WHERE recipient_email IS NOT NULL
+   AND (
+     lower(recipient_email) LIKE '%@example.com'
+     OR lower(recipient_email) LIKE '%@example.org'
+     OR lower(recipient_email) LIKE '%@example.net'
+     OR lower(recipient_email) LIKE '%@example.edu'
+     OR lower(recipient_email) LIKE '%.example'
+     OR lower(recipient_email) LIKE '%.invalid'
+     OR lower(recipient_email) LIKE '%.test'
+     OR lower(recipient_email) LIKE '%.localhost'
+     OR lower(recipient_email) LIKE '%.local'
+   );
+
+COMMENT ON COLUMN public.form_endpoints.recipient_email IS 'Per-form override. NULL means "use the site contact address" (CMS -> Messages, falling back to the first admin), which is the default and the usual case.';
+
+-- Same reasoning for the site-wide rows: a placeholder there is worse than an empty
+-- value, because an empty one falls through to the first admin and actually arrives.
+UPDATE public.site_settings
+   SET value = jsonb_set(value, '{contactEmail}', '""'::jsonb)
+ WHERE key IN ('forms_contact', 'store_contact')
+   AND value ? 'contactEmail'
+   AND lower(value->>'contactEmail') LIKE '%@example.%';
+
+
   -- Step D: Record the applied migrations in history (truncated in Step B) so
   -- \`npm run db:migrate:check\` reports up to date instead of listing every file as pending.
   INSERT INTO supabase_migrations.schema_migrations (version, name) VALUES
@@ -7397,7 +8056,11 @@ $body$;
     ('00000000000022', 'updating_article_accuracy'),
     ('00000000000023', 'updating_article_layout_not_host'),
     ('00000000000024', 'updating_article_newline_fix'),
-    ('00000000000025', 'rebrand_nextblock_dev')
+    ('00000000000025', 'rebrand_nextblock_dev'),
+    ('00000000000026', 'product_inquiries'),
+    ('00000000000027', 'message_threads'),
+    ('00000000000028', 'interaction_replies'),
+    ('00000000000029', 'form_endpoints_default_empty')
   ON CONFLICT (version) DO NOTHING;
 
   -- Step E: Anchor preserved profiles