kasy-cli 1.2.1

package/lib/scaffold/backends/supabase/edge-functions/send-push-notification/index.ts

@@ -0,0 +1,314 @@
+/**
+ * Supabase Edge Function: Send Push Notification via FCM
+ *
+ * Triggered by a Supabase Database Webhook when a row is inserted
+ * into the `notifications` table. Reads device FCM tokens for the
+ * target user and sends a push notification via Firebase Cloud Messaging
+ * HTTP v1 API.
+ *
+ * Secrets required (set via `supabase secrets set`):
+ *   - FIREBASE_PROJECT_ID: Your Firebase project ID (e.g. my-app-12345)
+ *   - FIREBASE_SERVICE_ACCOUNT_JSON: Full JSON of your Firebase service account key
+ *       (Firebase Console → Project Settings → Service Accounts → Generate new private key)
+ *
+ * Database Webhook setup (Supabase Dashboard → Database → Webhooks):
+ *   - Table: notifications
+ *   - Event: INSERT
+ *   - Method: POST
+ *   - URL: https://<PROJECT_REF>.supabase.co/functions/v1/send-push-notification
+ *   - HTTP Headers: Authorization: Bearer <SUPABASE_ANON_KEY>
+ *
+ * @see https://firebase.google.com/docs/cloud-messaging/send-message
+ */
+
+import { createClient } from "https://esm.sh/@supabase/supabase-js@2.47.10";
+
+interface NotificationRecord {
+  id: string;
+  user_id: string;
+  title: string;
+  body: string;
+  type?: string;
+  data?: Record<string, unknown>;
+  image_url?: string;
+}
+
+interface WebhookPayload {
+  type: "INSERT" | "UPDATE" | "DELETE";
+  table: string;
+  record: NotificationRecord;
+  schema: string;
+}
+
+// ── FCM auth: exchange service account JSON for OAuth2 access token ──────────
+
+async function getFcmAccessToken(serviceAccountJson: string): Promise<string> {
+  const sa = JSON.parse(serviceAccountJson);
+  const now = Math.floor(Date.now() / 1000);
+
+  const header = { alg: "RS256", typ: "JWT" };
+  const payload = {
+    iss: sa.client_email,
+    scope: "https://www.googleapis.com/auth/firebase.messaging",
+    aud: "https://oauth2.googleapis.com/token",
+    exp: now + 3600,
+    iat: now,
+  };
+
+  const encode = (obj: unknown) =>
+    btoa(JSON.stringify(obj))
+      .replace(/\+/g, "-")
+      .replace(/\//g, "_")
+      .replace(/=/g, "");
+
+  const signingInput = `${encode(header)}.${encode(payload)}`;
+
+  const pemContents = sa.private_key
+    .replace(/-----BEGIN PRIVATE KEY-----/g, "")
+    .replace(/-----END PRIVATE KEY-----/g, "")
+    .replace(/\s/g, "");
+
+  const binaryDer = Uint8Array.from(atob(pemContents), (c) => c.charCodeAt(0));
+  const cryptoKey = await crypto.subtle.importKey(
+    "pkcs8",
+    binaryDer,
+    { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+
+  const signatureBytes = await crypto.subtle.sign(
+    "RSASSA-PKCS1-v1_5",
+    cryptoKey,
+    new TextEncoder().encode(signingInput),
+  );
+
+  const signature = btoa(String.fromCharCode(...new Uint8Array(signatureBytes)))
+    .replace(/\+/g, "-")
+    .replace(/\//g, "_")
+    .replace(/=/g, "");
+
+  const jwt = `${signingInput}.${signature}`;
+
+  const tokenRes = await fetch("https://oauth2.googleapis.com/token", {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+      assertion: jwt,
+    }),
+  });
+
+  if (!tokenRes.ok) {
+    throw new Error(`OAuth2 token exchange failed: ${await tokenRes.text()}`);
+  }
+
+  const { access_token } = await tokenRes.json();
+  return access_token as string;
+}
+
+// ── FCM HTTP v1: send one message to one token ────────────────────────────────
+
+async function sendToToken(
+  projectId: string,
+  accessToken: string,
+  token: string,
+  title: string,
+  body: string,
+  data: Record<string, string>,
+  imageUrl?: string,
+): Promise<boolean> {
+  const res = await fetch(
+    `https://fcm.googleapis.com/v1/projects/${projectId}/messages:send`,
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${accessToken}`,
+      },
+      body: JSON.stringify({
+        message: {
+          token,
+          // imageUrl intentionally NOT set here — FCM "managed" delivery conflicts with
+          // UNNotificationServiceExtension on iOS. Platform-specific fields used instead.
+          notification: { title, body },
+          data,
+          android: {
+            notification: {
+              sound: "default",
+              // channel_id omitted — Android uses default_notification_channel_id from AndroidManifest.
+              // Sending "default" would create a new low-priority channel instead of the app's channel.
+              ...(imageUrl ? { image: imageUrl } : {}),
+            },
+          },
+          apns: {
+            headers: {
+              "apns-push-type": "alert",
+              "apns-priority": "10",
+            },
+            payload: {
+              aps: {
+                sound: "default",
+                badge: 1,
+                // mutable-content: 1 tells iOS to invoke UNNotificationServiceExtension,
+                // which downloads and attaches the image before the banner is shown.
+                ...(imageUrl ? { "mutable-content": 1 } : {}),
+              },
+            },
+            ...(imageUrl ? { fcm_options: { image: imageUrl } } : {}),
+          },
+        },
+      }),
+    },
+  );
+
+  if (!res.ok) {
+    const err = await res.text();
+    console.warn(`[send-push] FCM error for token …${token.slice(-8)}: ${res.status} ${err}`);
+    // 404 / UNREGISTERED → stale token; 400 INVALID_ARGUMENT → malformed token — both should be cleaned up
+    if (res.status === 404 || err.includes("UNREGISTERED") || err.includes("INVALID_ARGUMENT")) {
+      return false;
+    }
+    return true;
+  }
+  const ok = await res.json();
+  console.log(`[send-push] FCM ok for token …${token.slice(-8)}: ${JSON.stringify(ok)}`);
+  return true;
+}
+
+// ── Main handler ──────────────────────────────────────────────────────────────
+
+// SUPABASE_ANON_KEY is auto-injected by Supabase into all edge functions.
+// The Supabase Dashboard webhook must be configured with:
+//   Authorization: Bearer <SUPABASE_ANON_KEY>
+// This prevents arbitrary external callers from triggering push notifications.
+const SUPABASE_ANON_KEY = Deno.env.get("SUPABASE_ANON_KEY") ?? "";
+
+function isAuthorized(req: Request): boolean {
+  if (!SUPABASE_ANON_KEY) return false;
+  const authHeader = req.headers.get("Authorization") ?? "";
+  const token = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : authHeader;
+  return token === SUPABASE_ANON_KEY;
+}
+
+Deno.serve(async (req: Request) => {
+  if (req.method === "OPTIONS") {
+    return new Response(null, {
+      status: 204,
+      headers: { "Access-Control-Allow-Origin": "*", "Access-Control-Allow-Methods": "POST, OPTIONS" },
+    });
+  }
+
+  if (!isAuthorized(req)) {
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  if (req.method !== "POST") {
+    return new Response(JSON.stringify({ error: "Method not allowed" }), {
+      status: 405,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  let payload: WebhookPayload;
+  try {
+    payload = await req.json();
+  } catch {
+    return new Response(JSON.stringify({ error: "Invalid JSON" }), {
+      status: 400,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  // Only handle INSERTs on the notifications table
+  if (payload.type !== "INSERT" || payload.table !== "notifications") {
+    return new Response(JSON.stringify({ ok: true, message: "ignored" }), {
+      status: 200,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  const notification = payload.record;
+  if (!notification?.user_id || !notification?.title || !notification?.body) {
+    return new Response(JSON.stringify({ error: "Missing required fields in notification record" }), {
+      status: 400,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  const projectId = Deno.env.get("FIREBASE_PROJECT_ID");
+  const serviceAccountJson = Deno.env.get("FIREBASE_SERVICE_ACCOUNT_JSON");
+
+  if (!projectId || !serviceAccountJson) {
+    console.log("[send-push] FCM not configured (FIREBASE_PROJECT_ID / FIREBASE_SERVICE_ACCOUNT_JSON missing) — push skipped");
+    return new Response(JSON.stringify({ ok: true, message: "push skipped: FCM not configured" }), {
+      status: 200,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  const supabaseUrl = Deno.env.get("SUPABASE_URL")!;
+  const serviceRoleKey = Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!;
+  const supabase = createClient(supabaseUrl, serviceRoleKey);
+
+  // Fetch device tokens for the user
+  const { data: devices, error: devErr } = await supabase
+    .from("devices")
+    .select("id, token")
+    .eq("user_id", notification.user_id);
+
+  if (devErr || !devices?.length) {
+    console.log(`[send-push] no devices for user ${notification.user_id}`);
+    return new Response(JSON.stringify({ ok: true, message: "no devices" }), {
+      status: 200,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  let accessToken: string;
+  try {
+    accessToken = await getFcmAccessToken(serviceAccountJson);
+  } catch (e) {
+    console.error("[send-push] FCM auth error:", e);
+    return new Response(JSON.stringify({ error: "FCM authentication failed" }), {
+      status: 500,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  const extraData: Record<string, string> = {};
+  if (notification.type) extraData.type = notification.type;
+  if (notification.image_url) extraData.imageUrl = notification.image_url;
+  if (notification.data) {
+    for (const [k, v] of Object.entries(notification.data)) {
+      extraData[k] = String(v);
+    }
+  }
+
+  let sent = 0;
+  const staleTokenIds: string[] = [];
+
+  for (const device of devices) {
+    const ok = await sendToToken(projectId, accessToken, device.token, notification.title, notification.body, extraData, notification.image_url);
+    if (ok) {
+      sent++;
+    } else {
+      staleTokenIds.push(device.id);
+    }
+  }
+
+  // Clean up stale tokens
+  if (staleTokenIds.length > 0) {
+    await supabase.from("devices").delete().in("id", staleTokenIds);
+    console.log(`[send-push] removed ${staleTokenIds.length} stale device(s)`);
+  }
+
+  console.log(`[send-push] sent ${sent}/${devices.length} for user ${notification.user_id}`);
+  return new Response(JSON.stringify({ ok: true, sent, total: devices.length }), {
+    status: 200,
+    headers: { "Content-Type": "application/json" },
+  });
+});

package/lib/scaffold/backends/supabase/generator.js

@@ -0,0 +1,108 @@
+/**
+ * Supabase project generator.
+ *
+ * Wrapper fino sobre generateProject().
+ * A lógica de geração comum (cópia, pub get, slang, build_runner, flutterfire)
+ * vive em cli/lib/scaffold/generate.js.
+ *
+ * Hook específico (applyBackendSetup):
+ *   1. Aplica supabase/patch/ sobre o template Firebase copiado
+ *   2. Substitui pubspec.yaml pelo template Supabase (pubspec.yaml.tpl)
+ *   3. Remove artefatos Firebase exclusivos (ex: GoogleService-Info.plist paths)
+ *   4. Escreve overrides de environment (supabaseUrl, supabaseAnonKey)
+ *   5. Copia config.toml, migrations e edge-functions do backend Supabase
+ */
+
+const path = require('node:path');
+const fs = require('fs-extra');
+const { applyPatch, copyWithTokens } = require('../../engine');
+const { generateProject } = require('../../generate');
+const { writeEnvironnementsOverrides } = require('../../shared/generator-utils');
+const { removeBackendSpecificArtifacts } = require('../../shared/backend-config');
+
+const SUPABASE_PATCH_DIR = path.join(__dirname, 'patch');
+const SUPABASE_PUBSPEC = path.join(__dirname, 'pubspec.yaml.tpl');
+const SUPABASE_EDGE_FUNCTIONS_DIR = path.join(__dirname, 'edge-functions');
+const SUPABASE_MIGRATIONS_DIR = path.join(__dirname, 'migrations');
+
+async function generateSupabaseProject(targetDir, options) {
+  const { appName, bundleId, firebaseProjectId, supabaseUrl, supabaseAnonKey } = options;
+
+  if (!appName || !bundleId || !firebaseProjectId) {
+    throw new Error('generateSupabaseProject requires appName, bundleId, firebaseProjectId');
+  }
+  if (!supabaseUrl || !supabaseAnonKey) {
+    throw new Error('generateSupabaseProject requires supabaseUrl and supabaseAnonKey');
+  }
+
+  return generateProject(targetDir, 'supabase', options, {
+    applyBackendSetup: async (dir, tokens, pathReplacements, opts) => {
+      // 1. Patch Supabase (auth, storage, notifications, etc.)
+      const { filesApplied } = await applyPatch(SUPABASE_PATCH_DIR, dir, tokens, pathReplacements);
+
+      // 1b. README do backend (excluído do applyPatch) — copiar manualmente
+      const language = opts.language ?? 'pt';
+      const readmeLang = ['en', 'pt', 'es'].includes(language) ? language : 'en';
+      const candidates = [
+        path.join(SUPABASE_PATCH_DIR, `README.${readmeLang}.md`),
+        path.join(SUPABASE_PATCH_DIR, 'README.md'),
+      ];
+      for (const src of candidates) {
+        if (await fs.pathExists(src)) {
+          await fs.copy(src, path.join(dir, 'README.md'));
+          break;
+        }
+      }
+
+      // 2. Substituir pubspec.yaml pelos deps do Supabase
+      const pubspecContent = await fs.readFile(SUPABASE_PUBSPEC, 'utf8');
+      let pubspecReplaced = pubspecContent;
+      for (const [from, to] of Object.entries(tokens)) {
+        pubspecReplaced = pubspecReplaced.replaceAll(from, to);
+      }
+      await fs.outputFile(path.join(dir, 'pubspec.yaml'), pubspecReplaced, 'utf8');
+
+      // 3. Remover artefatos exclusivos do Firebase
+      await removeBackendSpecificArtifacts(dir, 'supabase', opts.modules ?? []);
+
+      // 4. Escrever overrides de environment com as credenciais Supabase
+      await writeEnvironnementsOverrides(dir, 'supabase', tokens, {
+        supabaseUrl: opts.supabaseUrl,
+        supabaseAnonKey: opts.supabaseAnonKey,
+      });
+
+      // 5. Copiar arquivos da infraestrutura Supabase
+      const supabaseDir = path.join(dir, 'supabase');
+      await fs.ensureDir(supabaseDir);
+
+      // Tokens extras para substituição nas migrations SQL
+      const supabaseTokens = {
+        ...tokens,
+        'supabaseplaceholder.supabase.co': (opts.supabaseUrl || '').replace(/^https?:\/\//, ''),
+        'sb_publishable_placeholder': opts.supabaseAnonKey || '',
+      };
+
+      const supabaseConfigPath = path.join(__dirname, 'config.toml');
+      if (await fs.pathExists(supabaseConfigPath)) {
+        await fs.copy(supabaseConfigPath, path.join(supabaseDir, 'config.toml'));
+      }
+      if (await fs.pathExists(SUPABASE_MIGRATIONS_DIR)) {
+        await copyWithTokens(SUPABASE_MIGRATIONS_DIR, path.join(supabaseDir, 'migrations'), supabaseTokens);
+      }
+      if (await fs.pathExists(SUPABASE_EDGE_FUNCTIONS_DIR)) {
+        await fs.copy(SUPABASE_EDGE_FUNCTIONS_DIR, path.join(supabaseDir, 'functions'));
+      }
+
+      return {
+        detail: `${filesApplied} patch files`,
+        extraAnswers: { supabaseUrl: opts.supabaseUrl, supabaseAnonKey: opts.supabaseAnonKey },
+        kitSetupExtra: { supabaseUrl: opts.supabaseUrl, supabaseAnonKey: opts.supabaseAnonKey },
+        returnExtra: { supabaseUrl: opts.supabaseUrl },
+      };
+    },
+
+    postBuild: null,
+  });
+}
+
+module.exports = { generateSupabaseProject, SUPABASE_PATCH_DIR };

package/lib/scaffold/backends/supabase/migrations/20240101000001_initial_schema.sql

@@ -0,0 +1,149 @@
+-- Kasy Supabase schema
+-- Tables: users, devices, subscriptions, feature_requests, feature_votes, user_infos, notifications
+
+-- Users (id matches auth.users.id, created by app on signup)
+CREATE TABLE IF NOT EXISTS public.users (
+  id UUID PRIMARY KEY REFERENCES auth.users(id) ON DELETE CASCADE,
+  creation_date TIMESTAMPTZ DEFAULT now(),
+  last_update_date TIMESTAMPTZ DEFAULT now(),
+  name TEXT,
+  email TEXT,
+  avatar_url TEXT,
+  onboarded BOOLEAN DEFAULT false,
+  locale TEXT
+);
+
+-- Devices (push notifications)
+CREATE TABLE IF NOT EXISTS public.devices (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id UUID NOT NULL REFERENCES public.users(id) ON DELETE CASCADE,
+  installation_id TEXT NOT NULL,
+  token TEXT NOT NULL,
+  "operatingSystem" TEXT NOT NULL CHECK ("operatingSystem" IN ('ios', 'android')),
+  creation_date TIMESTAMPTZ DEFAULT now(),
+  last_update_date TIMESTAMPTZ DEFAULT now(),
+  extra_data JSONB DEFAULT '{}',
+  UNIQUE(user_id, installation_id)
+);
+
+-- Subscriptions (RevenueCat webhook updates)
+CREATE TABLE IF NOT EXISTS public.subscriptions (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id UUID NOT NULL REFERENCES public.users(id) ON DELETE CASCADE UNIQUE,
+  status TEXT NOT NULL CHECK (status IN ('ACTIVE', 'PAUSED', 'EXPIRED', 'LIFETIME', 'CANCELLED')),
+  creation_date TIMESTAMPTZ DEFAULT now(),
+  last_update_date TIMESTAMPTZ DEFAULT now(),
+  period_end_date TIMESTAMPTZ,
+  sku_id TEXT NOT NULL,
+  offer_id TEXT NOT NULL,
+  store TEXT
+);
+
+-- Feature requests (vote/request module)
+CREATE TABLE IF NOT EXISTS public.feature_requests (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  creation_date TIMESTAMPTZ DEFAULT now(),
+  last_update_date TIMESTAMPTZ DEFAULT now(),
+  title JSONB NOT NULL DEFAULT '{}',
+  description JSONB NOT NULL DEFAULT '{}',
+  votes INTEGER NOT NULL DEFAULT 0,
+  active BOOLEAN NOT NULL DEFAULT true
+);
+
+-- Feature votes
+CREATE TABLE IF NOT EXISTS public.feature_votes (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  creation_date TIMESTAMPTZ DEFAULT now(),
+  user_uid UUID NOT NULL REFERENCES public.users(id) ON DELETE CASCADE,
+  feature_id UUID NOT NULL REFERENCES public.feature_requests(id) ON DELETE CASCADE,
+  UNIQUE(user_uid, feature_id)
+);
+
+-- User infos (onboarding)
+CREATE TABLE IF NOT EXISTS public.user_infos (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id UUID NOT NULL REFERENCES public.users(id) ON DELETE CASCADE,
+  info_key TEXT NOT NULL,
+  info_value TEXT NOT NULL,
+  UNIQUE(user_id, info_key)
+);
+
+-- Notifications
+CREATE TABLE IF NOT EXISTS public.notifications (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id UUID REFERENCES public.users(id) ON DELETE CASCADE,
+  title TEXT NOT NULL,
+  body TEXT NOT NULL,
+  creation_date TIMESTAMPTZ DEFAULT now(),
+  read_date TIMESTAMPTZ,
+  type TEXT DEFAULT 'OTHER',
+  data JSONB DEFAULT '{}',
+  notify_user BOOLEAN DEFAULT true
+);
+
+-- Indexes
+CREATE INDEX IF NOT EXISTS idx_devices_user_id ON public.devices(user_id);
+CREATE INDEX IF NOT EXISTS idx_subscriptions_user_id ON public.subscriptions(user_id);
+CREATE INDEX IF NOT EXISTS idx_feature_votes_user ON public.feature_votes(user_uid);
+CREATE INDEX IF NOT EXISTS idx_feature_votes_feature ON public.feature_votes(feature_id);
+CREATE INDEX IF NOT EXISTS idx_user_infos_user_id ON public.user_infos(user_id);
+CREATE INDEX IF NOT EXISTS idx_notifications_user_id ON public.notifications(user_id);
+
+-- RLS: enable for all tables
+ALTER TABLE public.users ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.devices ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.subscriptions ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.feature_requests ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.feature_votes ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.user_infos ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.notifications ENABLE ROW LEVEL SECURITY;
+
+-- Users: own data only
+CREATE POLICY "Users can read own" ON public.users FOR SELECT USING (auth.uid() = id);
+CREATE POLICY "Users can update own" ON public.users FOR UPDATE USING (auth.uid() = id);
+CREATE POLICY "Users can insert own" ON public.users FOR INSERT WITH CHECK (auth.uid() = id);
+
+-- Devices: own data only
+CREATE POLICY "Devices own" ON public.devices FOR ALL USING (auth.uid() = user_id);
+
+-- Subscriptions: own data only
+CREATE POLICY "Subscriptions own" ON public.subscriptions FOR ALL USING (auth.uid() = user_id);
+
+-- Feature requests: anyone can read; authenticated users can submit (active=false, votes=0)
+CREATE POLICY "Feature requests read" ON public.feature_requests FOR SELECT USING (true);
+CREATE POLICY "Feature requests insert" ON public.feature_requests FOR INSERT
+  WITH CHECK (
+    auth.uid() IS NOT NULL
+    AND active = false
+    AND votes = 0
+  );
+
+-- Feature votes: own votes
+CREATE POLICY "Feature votes own" ON public.feature_votes FOR ALL USING (auth.uid() = user_uid);
+
+-- User infos: own data
+CREATE POLICY "User infos own" ON public.user_infos FOR ALL USING (auth.uid() = user_id);
+
+-- Notifications: own data
+CREATE POLICY "Notifications own" ON public.notifications FOR ALL USING (auth.uid() = user_id);
+
+-- Auto-create user profile in public.users when a new auth user signs up.
+-- This mirrors Firebase's onUserCreate Cloud Function behavior.
+CREATE OR REPLACE FUNCTION public.handle_new_user()
+RETURNS TRIGGER AS $$
+BEGIN
+  INSERT INTO public.users (id, email, name)
+  VALUES (
+    NEW.id,
+    NEW.email,
+    COALESCE(NEW.raw_user_meta_data->>'full_name', NEW.raw_user_meta_data->>'name', NULL)
+  )
+  ON CONFLICT (id) DO NOTHING;
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER;
+
+DROP TRIGGER IF EXISTS on_auth_user_created ON auth.users;
+CREATE TRIGGER on_auth_user_created
+  AFTER INSERT ON auth.users
+  FOR EACH ROW EXECUTE PROCEDURE public.handle_new_user();

package/lib/scaffold/backends/supabase/migrations/20240101000002_storage_bucket.sql

@@ -0,0 +1,40 @@
+-- Storage bucket `storage` (app uploads). public=true for getPublicUrl(); not related to public.* tables.
+
+-- Create bucket
+INSERT INTO storage.buckets (id, name, public)
+SELECT 'storage', 'storage', true
+WHERE NOT EXISTS (SELECT 1 FROM storage.buckets WHERE id = 'storage');
+
+-- RLS policies for storage.objects
+-- Allow authenticated users to upload to their own folder: users/{user_id}/...
+DROP POLICY IF EXISTS "Users can upload own files" ON storage.objects;
+CREATE POLICY "Users can upload own files"
+ON storage.objects FOR INSERT
+TO authenticated
+WITH CHECK (
+  bucket_id = 'storage'
+  AND (storage.foldername(name))[1] = 'users'
+  AND (storage.foldername(name))[2] = auth.uid()::text
+);
+
+-- Allow users to update their own files (avatar upsert)
+DROP POLICY IF EXISTS "Users can update own files" ON storage.objects;
+CREATE POLICY "Users can update own files"
+ON storage.objects FOR UPDATE
+TO authenticated
+USING (
+  bucket_id = 'storage'
+  AND (storage.foldername(name))[1] = 'users'
+  AND (storage.foldername(name))[2] = auth.uid()::text
+);
+
+-- Allow users to delete their own files
+DROP POLICY IF EXISTS "Users can delete own files" ON storage.objects;
+CREATE POLICY "Users can delete own files"
+ON storage.objects FOR DELETE
+TO authenticated
+USING (
+  bucket_id = 'storage'
+  AND (storage.foldername(name))[1] = 'users'
+  AND (storage.foldername(name))[2] = auth.uid()::text
+);

package/lib/scaffold/backends/supabase/migrations/20240101000005_vote_triggers.sql

@@ -0,0 +1,34 @@
+-- Increment/decrement vote counter in feature_requests when votes are added/removed.
+-- Mirrors Firebase's incrementVoteCounter / decrementVoteCounter Cloud Functions.
+
+CREATE OR REPLACE FUNCTION public.increment_feature_votes()
+RETURNS TRIGGER AS $$
+BEGIN
+  UPDATE public.feature_requests
+  SET votes = votes + 1,
+      last_update_date = now()
+  WHERE id = NEW.feature_id;
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER;
+
+DROP TRIGGER IF EXISTS on_feature_vote_added ON public.feature_votes;
+CREATE TRIGGER on_feature_vote_added
+  AFTER INSERT ON public.feature_votes
+  FOR EACH ROW EXECUTE PROCEDURE public.increment_feature_votes();
+
+CREATE OR REPLACE FUNCTION public.decrement_feature_votes()
+RETURNS TRIGGER AS $$
+BEGIN
+  UPDATE public.feature_requests
+  SET votes = GREATEST(0, votes - 1),
+      last_update_date = now()
+  WHERE id = OLD.feature_id;
+  RETURN OLD;
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER;
+
+DROP TRIGGER IF EXISTS on_feature_vote_removed ON public.feature_votes;
+CREATE TRIGGER on_feature_vote_removed
+  AFTER DELETE ON public.feature_votes
+  FOR EACH ROW EXECUTE PROCEDURE public.decrement_feature_votes();

package/lib/scaffold/backends/supabase/migrations/20240101000006_notification_webhook.sql

@@ -0,0 +1,36 @@
+-- Automatically call send-push-notification edge function when a notification is inserted.
+-- Uses pg_net to make an async HTTP POST (fire-and-forget) to the edge function URL.
+-- Equivalent to the Supabase Database Webhook configured manually in the Dashboard.
+--
+-- Tokens replaced by the CLI generator at project creation time:
+--   supabaseplaceholder.supabase.co → your project URL host
+--   sb_publishable_placeholder      → your project anon key
+
+CREATE EXTENSION IF NOT EXISTS pg_net;
+
+CREATE OR REPLACE FUNCTION public.trigger_send_push_notification()
+RETURNS TRIGGER AS $$
+BEGIN
+  IF NEW.notify_user IS DISTINCT FROM false THEN
+    PERFORM net.http_post(
+      url     := 'https://supabaseplaceholder.supabase.co/functions/v1/send-push-notification',
+      headers := jsonb_build_object(
+        'Content-Type',  'application/json',
+        'Authorization', 'Bearer sb_publishable_placeholder'
+      ),
+      body    := jsonb_build_object(
+        'type',   'INSERT',
+        'table',  TG_TABLE_NAME,
+        'schema', TG_TABLE_SCHEMA,
+        'record', row_to_json(NEW)::jsonb
+      )
+    );
+  END IF;
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER;
+
+DROP TRIGGER IF EXISTS on_notification_inserted ON public.notifications;
+CREATE TRIGGER on_notification_inserted
+  AFTER INSERT ON public.notifications
+  FOR EACH ROW EXECUTE PROCEDURE public.trigger_send_push_notification();