create-prenta 1.5.2 → 1.5.3

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # create-actuate-cms
 
+## 1.5.3
+
+### Patch Changes
+
+- 63fb576: Tie API keys to the owner's lifecycle, enforce login lockout and per-email rate limits, ship HTML security headers from `withPrentaCMS` in the dev app, and harden search indexes, session storage, dashboard counts, RBAC defaults, keyset list cursors, and observability from the 22 August 2026 audit. Scaffolded projects pick up the same Prisma schema and 0015 migration.
+
 ## 1.5.2
 
 ### Patch Changes

package/assets/prisma/migrations/0015_audit_remediation_indexes/migration.sql

@@ -0,0 +1,79 @@
+-- Audit remediation (PERF-1/2/3/10, SEC-M1, QUAL-1).
+-- Prefer transactional CREATE INDEX (not CONCURRENTLY) so `prisma migrate`
+-- can run this in one transaction. For large production DBs, operators may
+-- apply the equivalent `CREATE INDEX CONCURRENTLY` statements out of band.
+
+DO $$
+BEGIN
+  -- PGlite and slim Postgres images have no contrib package; skip rather
+  -- than fail the whole migration. Real hosts with postgresql-contrib
+  -- still get pg_trgm + the GIN indexes below.
+  IF EXISTS (SELECT 1 FROM pg_available_extensions WHERE name = 'pg_trgm') THEN
+    CREATE EXTENSION IF NOT EXISTS pg_trgm;
+  ELSE
+    RAISE NOTICE 'pg_trgm skipped (extension not available)';
+  END IF;
+EXCEPTION
+  WHEN insufficient_privilege THEN
+    RAISE NOTICE 'pg_trgm skipped (insufficient privilege)';
+  WHEN undefined_file THEN
+    RAISE NOTICE 'pg_trgm skipped (extension files not present)';
+  WHEN feature_not_supported THEN
+    RAISE NOTICE 'pg_trgm skipped (not supported on this server)';
+  WHEN OTHERS THEN
+    RAISE NOTICE 'pg_trgm skipped (%)', SQLERRM;
+END
+$$;
+
+-- Document search + live list (no partial index on status — measured regression).
+DO $$
+BEGIN
+  CREATE INDEX IF NOT EXISTS ix_doc_plain_text_trgm
+    ON "prenta_documents" USING GIN ("plainText" gin_trgm_ops);
+  CREATE INDEX IF NOT EXISTS ix_doc_title_trgm
+    ON "prenta_documents" USING GIN ("title" gin_trgm_ops);
+EXCEPTION
+  WHEN undefined_object THEN
+    RAISE NOTICE 'pg_trgm GIN indexes skipped (operator class unavailable)';
+  WHEN OTHERS THEN
+    RAISE NOTICE 'pg_trgm GIN indexes skipped (%)', SQLERRM;
+END
+$$;
+CREATE INDEX IF NOT EXISTS ix_doc_coll_live_updated
+  ON "prenta_documents" ("collection", "updatedAt" DESC)
+  WHERE "deletedAt" IS NULL;
+
+-- Hash session JWTs at rest (skip rows that already look like SHA-256 hex).
+UPDATE "prenta_sessions"
+SET "token" = encode(sha256(convert_to("token", 'UTF8')), 'hex')
+WHERE "token" LIKE '%.%.%';
+
+-- FormSubmission: drop boolean indexes, add unread-badge + (formId, submittedAt).
+DROP INDEX IF EXISTS "prenta_form_submissions_unread_idx";
+DROP INDEX IF EXISTS "prenta_form_submissions_starred_idx";
+DROP INDEX IF EXISTS "prenta_form_submissions_archived_idx";
+DROP INDEX IF EXISTS "prenta_form_submissions_status_idx";
+DROP INDEX IF EXISTS "prenta_form_submissions_spamStatus_idx";
+CREATE INDEX IF NOT EXISTS ix_form_sub_unread_badge
+  ON "prenta_form_submissions" ("formId")
+  WHERE "unread" = true AND "archived" = false;
+CREATE INDEX IF NOT EXISTS "prenta_form_submissions_formId_submittedAt_idx"
+  ON "prenta_form_submissions" ("formId", "submittedAt" DESC);
+
+-- ContentLock / notifications / API keys
+DELETE FROM "prenta_content_locks" t
+WHERE t.ctid NOT IN (
+  SELECT min(ctid) FROM "prenta_content_locks" GROUP BY "documentId"
+);
+CREATE UNIQUE INDEX IF NOT EXISTS "prenta_content_locks_documentId_key"
+  ON "prenta_content_locks" ("documentId");
+CREATE INDEX IF NOT EXISTS "prenta_notifications_userId_idx"
+  ON "prenta_notifications" ("userId");
+CREATE INDEX IF NOT EXISTS "prenta_api_keys_userId_idx"
+  ON "prenta_api_keys" ("userId");
+
+-- Remove unused multi-site / backup / workflow stubs (QUAL-1).
+DROP TABLE IF EXISTS "prenta_backup_records";
+DROP TABLE IF EXISTS "prenta_workflow_states";
+DROP TABLE IF EXISTS "prenta_sites";
+ALTER TABLE "prenta_documents" DROP COLUMN IF EXISTS "siteId";

package/assets/prisma/schema.prisma

@@ -122,7 +122,6 @@ model User {
   contentLocks            ContentLock[]
   notifications           InAppNotification[]
   contentTemplates        ContentTemplate[]
-  workflowAssigned        WorkflowState[]
   passwordResetTokens     PasswordResetToken[]
   documentComments        DocumentComment[]
   documentNotifications   DocumentNotification[]
@@ -179,6 +178,7 @@ model ApiKey {
 
   user User @relation(fields: [userId], references: [id], onDelete: Cascade)
 
+  @@index([userId])
   @@map("prenta_api_keys")
 }
 
@@ -236,7 +236,6 @@ model Document {
   contentHash          String?
   structuredData       Json?
   contentGraph         Json?
-  siteId               String?
   templateId           String?
   workflowStage        WorkflowStage  @default(DRAFT)
   reviewerId           String?
@@ -252,7 +251,6 @@ model Document {
   mediaUsages   MediaUsage[]
   contentLocks  ContentLock[]
   contentIssues ContentIssue[]
-  workflowState WorkflowState?
 
   @@unique([collection, slug])
   @@index([collection])
@@ -373,6 +371,7 @@ model ContentLock {
   document Document @relation(fields: [documentId], references: [id], onDelete: Cascade)
   user     User     @relation(fields: [userId], references: [id])
 
+  @@unique([documentId])
   @@map("prenta_content_locks")
 }
 
@@ -388,6 +387,7 @@ model InAppNotification {
 
   user User @relation(fields: [userId], references: [id], onDelete: Cascade)
 
+  @@index([userId])
   @@map("prenta_notifications")
 }
 
@@ -405,33 +405,6 @@ model ContentTemplate {
   @@map("prenta_content_templates")
 }
 
-model Site {
-  id              String   @id @default(cuid())
-  domain          String   @unique
-  name            String
-  configOverrides Json?
-  isDefault       Boolean  @default(false)
-  createdAt       DateTime @default(now())
-  updatedAt       DateTime @updatedAt
-
-  @@map("prenta_sites")
-}
-
-model WorkflowState {
-  id           String   @id @default(cuid())
-  documentId   String   @unique
-  currentStep  Int      @default(0)
-  assignedToId String?
-  status       String   @default("pending")
-  definition   Json
-  createdAt    DateTime @default(now())
-  updatedAt    DateTime @updatedAt
-
-  document   Document @relation(fields: [documentId], references: [id], onDelete: Cascade)
-  assignedTo User?    @relation(fields: [assignedToId], references: [id])
-
-  @@map("prenta_workflow_states")
-}
 
 model Redirect {
   id            String    @id @default(cuid())
@@ -670,13 +643,9 @@ model FormSubmission {
   deliveries FormDeliveryAttempt[]
 
   @@index([formId])
-  @@index([status])
-  @@index([unread])
-  @@index([starred])
-  @@index([archived])
-  @@index([spamStatus])
   @@index([submittedAt])
   @@index([senderEmail])
+  @@index([formId, submittedAt])
   @@map("prenta_form_submissions")
 }
 
@@ -760,18 +729,6 @@ model FormDeliveryAttempt {
   @@map("prenta_form_delivery_attempts")
 }
 
-model BackupRecord {
-  id         String   @id @default(cuid())
-  filename   String
-  storageKey String
-  sizeBytes  Int
-  type       String
-  metadata   Json?
-  createdAt  DateTime @default(now())
-
-  @@map("prenta_backup_records")
-}
-
 model WebhookEndpoint {
   id                       String    @id @default(cuid())
   url                      String

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-prenta",
-  "version": "1.5.2",
+  "version": "1.5.3",
   "description": "Scaffold a new Prenta CMS project",
   "repository": {
     "type": "git",