mega-brain-ai 1.1.0

package/system/database/001_moneyclub_buyers.sql

@@ -0,0 +1,160 @@
+-- Migration: 001_moneyclub_buyers
+-- Description: MoneyClub buyers table for email validation during Mega Brain installation
+-- Date: 2026-02-18
+-- Product: Mega Brain - MoneyClub Edition
+--
+-- DATA FLOW:
+--   Google Sheets (source) → Sync (n8n/Apps Script) → Supabase (source of truth) → CLI validator
+--
+-- SPREADSHEET COLUMNS:
+--   Nome do Cliente | E-mail do Cliente | DDI | DDD | Número do Telefone | Telefone Completo
+--
+-- SYNC STRATEGY:
+--   The Google Sheet is the data entry point (updated by sales team).
+--   A sync mechanism (n8n workflow or Google Apps Script) upserts rows
+--   into this table using email as the unique key.
+--   The CLI installer calls validate_buyer_email() via Supabase anon RPC.
+
+-- ═══════════════════════════════════════════════════════════════
+-- TABLE: moneyclub_buyers
+-- ═══════════════════════════════════════════════════════════════
+
+CREATE TABLE IF NOT EXISTS moneyclub_buyers (
+  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
+
+  -- From Google Sheets
+  name TEXT,                          -- "Nome do Cliente"
+  email TEXT NOT NULL UNIQUE,         -- "E-mail do Cliente" (VALIDATOR KEY)
+  phone_ddi TEXT,                     -- "DDI do Cliente" (ex: +55)
+  phone_ddd TEXT,                     -- "DDD do Cliente" (ex: 11)
+  phone_number TEXT,                  -- "Número do Telefone do Cliente"
+  phone_full TEXT,                    -- "Telefone Completo do Cliente"
+
+  -- Installer tracking (managed by RPC function)
+  product TEXT NOT NULL DEFAULT 'moneyclub',
+  status TEXT NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'inactive', 'refunded')),
+  activated_at TIMESTAMPTZ,           -- First install timestamp
+  install_count INTEGER DEFAULT 0,    -- How many times installed
+  last_install_at TIMESTAMPTZ,        -- Last install timestamp
+
+  -- Metadata
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- Index for fast email lookup (used by RPC function)
+CREATE INDEX IF NOT EXISTS idx_moneyclub_buyers_email ON moneyclub_buyers(email);
+
+-- Index for status filtering
+CREATE INDEX IF NOT EXISTS idx_moneyclub_buyers_status ON moneyclub_buyers(status);
+
+-- ═══════════════════════════════════════════════════════════════
+-- ROW LEVEL SECURITY
+-- ═══════════════════════════════════════════════════════════════
+-- No direct access for anon role. All access goes through the RPC function.
+
+ALTER TABLE moneyclub_buyers ENABLE ROW LEVEL SECURITY;
+
+-- Service role can do everything (for sync scripts)
+CREATE POLICY "service_role_full_access" ON moneyclub_buyers
+  FOR ALL
+  TO service_role
+  USING (true)
+  WITH CHECK (true);
+
+-- ═══════════════════════════════════════════════════════════════
+-- RPC FUNCTION: validate_buyer_email
+-- ═══════════════════════════════════════════════════════════════
+-- Called by the CLI installer (npx mega-brain install)
+-- Uses SECURITY DEFINER so anon key can access the table safely
+-- Only returns: valid (bool), name (string), install_count (int)
+-- Never exposes: phone, email list, or other buyer data
+
+CREATE OR REPLACE FUNCTION validate_buyer_email(buyer_email TEXT)
+RETURNS JSON
+LANGUAGE plpgsql
+SECURITY DEFINER
+AS $$
+DECLARE
+  buyer RECORD;
+BEGIN
+  SELECT id, email, name, status, install_count
+  INTO buyer
+  FROM moneyclub_buyers
+  WHERE LOWER(email) = LOWER(buyer_email)
+  AND status = 'active';
+
+  IF buyer IS NULL THEN
+    RETURN json_build_object(
+      'valid', false,
+      'reason', 'email_not_found'
+    );
+  END IF;
+
+  -- Update install tracking
+  UPDATE moneyclub_buyers
+  SET install_count = install_count + 1,
+      last_install_at = NOW(),
+      activated_at = COALESCE(activated_at, NOW()),
+      updated_at = NOW()
+  WHERE id = buyer.id;
+
+  RETURN json_build_object(
+    'valid', true,
+    'name', buyer.name,
+    'install_count', buyer.install_count + 1
+  );
+END;
+$$;
+
+-- Grant execute to anon role (used by installer CLI via public anon key)
+GRANT EXECUTE ON FUNCTION validate_buyer_email TO anon;
+
+-- ═══════════════════════════════════════════════════════════════
+-- UPSERT FUNCTION: sync_buyer_from_sheet
+-- ═══════════════════════════════════════════════════════════════
+-- Called by the sync mechanism (n8n or Google Apps Script)
+-- Upserts a row using email as the unique key
+-- Preserves install tracking data on update
+
+CREATE OR REPLACE FUNCTION sync_buyer_from_sheet(
+  p_name TEXT,
+  p_email TEXT,
+  p_phone_ddi TEXT DEFAULT NULL,
+  p_phone_ddd TEXT DEFAULT NULL,
+  p_phone_number TEXT DEFAULT NULL,
+  p_phone_full TEXT DEFAULT NULL
+)
+RETURNS JSON
+LANGUAGE plpgsql
+SECURITY DEFINER
+AS $$
+DECLARE
+  result RECORD;
+BEGIN
+  INSERT INTO moneyclub_buyers (name, email, phone_ddi, phone_ddd, phone_number, phone_full)
+  VALUES (p_name, LOWER(TRIM(p_email)), p_phone_ddi, p_phone_ddd, p_phone_number, p_phone_full)
+  ON CONFLICT (email) DO UPDATE SET
+    name = EXCLUDED.name,
+    phone_ddi = COALESCE(EXCLUDED.phone_ddi, moneyclub_buyers.phone_ddi),
+    phone_ddd = COALESCE(EXCLUDED.phone_ddd, moneyclub_buyers.phone_ddd),
+    phone_number = COALESCE(EXCLUDED.phone_number, moneyclub_buyers.phone_number),
+    phone_full = COALESCE(EXCLUDED.phone_full, moneyclub_buyers.phone_full),
+    updated_at = NOW()
+  RETURNING id, email, name INTO result;
+
+  RETURN json_build_object(
+    'success', true,
+    'id', result.id,
+    'email', result.email,
+    'name', result.name
+  );
+END;
+$$;
+
+-- Only service_role can call sync (not anon)
+-- IMPORTANT: PostgreSQL grants EXECUTE to PUBLIC by default on functions.
+-- We must explicitly REVOKE from public/anon to prevent unauthorized inserts.
+REVOKE EXECUTE ON FUNCTION sync_buyer_from_sheet FROM PUBLIC;
+REVOKE EXECUTE ON FUNCTION sync_buyer_from_sheet FROM anon;
+GRANT EXECUTE ON FUNCTION sync_buyer_from_sheet TO service_role;

package/system/database/002_premium_token.sql

@@ -0,0 +1,97 @@
+-- Migration: 002_premium_token
+-- Description: Add premium_token delivery to email validation
+-- Date: 2026-02-20
+-- Product: Mega Brain - MoneyClub Edition
+--
+-- PURPOSE:
+--   Closes the "premium_token gap": validate_buyer_email() previously returned
+--   only {valid, name, install_count}. After this migration, validated buyers
+--   also receive a premium_token used to clone the mega-brain-premium private repo.
+--
+-- ARCHITECTURE:
+--   system_config table stores the shared read-only GitHub PAT.
+--   validate_buyer_email() reads it and returns it ONLY to validated buyers.
+--   The token never leaves the server unless the buyer is active and validated.
+--
+-- SECURITY:
+--   - system_config has RLS enabled, no anon/public access
+--   - Only service_role can read/write system_config directly
+--   - The token is exposed only through the SECURITY DEFINER function
+--   - The GitHub PAT should have minimal scope: contents:read on mega-brain-premium only
+
+-- ═══════════════════════════════════════════════════════════════
+-- TABLE: system_config
+-- ═══════════════════════════════════════════════════════════════
+-- Key-value store for system-level configuration.
+-- Used by RPC functions to retrieve operational secrets.
+
+CREATE TABLE IF NOT EXISTS system_config (
+  key TEXT PRIMARY KEY,
+  value TEXT NOT NULL,
+  description TEXT,
+  created_at TIMESTAMPTZ DEFAULT NOW(),
+  updated_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- RLS: no public/anon access
+ALTER TABLE system_config ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "service_role_full_access" ON system_config
+  FOR ALL
+  TO service_role
+  USING (true)
+  WITH CHECK (true);
+
+-- ═══════════════════════════════════════════════════════════════
+-- UPDATED RPC FUNCTION: validate_buyer_email
+-- ═══════════════════════════════════════════════════════════════
+-- Now returns premium_token from system_config on successful validation.
+-- Token is only returned when the buyer is active and email matches.
+
+CREATE OR REPLACE FUNCTION validate_buyer_email(buyer_email TEXT)
+RETURNS JSON
+LANGUAGE plpgsql
+SECURITY DEFINER
+AS $$
+DECLARE
+  buyer RECORD;
+  token TEXT;
+BEGIN
+  -- Validate buyer
+  SELECT id, email, name, status, install_count
+  INTO buyer
+  FROM moneyclub_buyers
+  WHERE LOWER(email) = LOWER(buyer_email)
+  AND status = 'active';
+
+  IF buyer IS NULL THEN
+    RETURN json_build_object(
+      'valid', false,
+      'reason', 'email_not_found'
+    );
+  END IF;
+
+  -- Update install tracking
+  UPDATE moneyclub_buyers
+  SET install_count = install_count + 1,
+      last_install_at = NOW(),
+      activated_at = COALESCE(activated_at, NOW()),
+      updated_at = NOW()
+  WHERE id = buyer.id;
+
+  -- Fetch premium token from config
+  SELECT value INTO token
+  FROM system_config
+  WHERE key = 'premium_repo_token';
+
+  RETURN json_build_object(
+    'valid', true,
+    'name', buyer.name,
+    'install_count', buyer.install_count + 1,
+    'premium_token', token
+  );
+END;
+$$;
+
+-- Ensure anon can still call the function
+GRANT EXECUTE ON FUNCTION validate_buyer_email TO anon;

package/system/database/apply-migration.mjs

@@ -0,0 +1,129 @@
+#!/usr/bin/env node
+/**
+ * Apply SQL migration to Supabase via REST API (service_role key required)
+ *
+ * Usage:
+ *   SUPABASE_SERVICE_KEY=eyJ... node apply-migration.mjs 002_premium_token.sql
+ *   SUPABASE_SERVICE_KEY=eyJ... PREMIUM_REPO_TOKEN=ghp_xxx node apply-migration.mjs 002_premium_token.sql --seed-token
+ *
+ * The service_role key is in: Supabase Dashboard → Settings → API → service_role (secret)
+ */
+
+import { readFileSync } from 'fs';
+import { resolve, dirname } from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+const SUPABASE_URL = 'https://lgbzktgbhowxiwppycbi.supabase.co';
+const SERVICE_KEY = process.env.SUPABASE_SERVICE_KEY;
+const PREMIUM_TOKEN = process.env.PREMIUM_REPO_TOKEN;
+
+if (SERVICE_KEY === undefined || SERVICE_KEY === '') {
+  console.error('ERROR: SUPABASE_SERVICE_KEY env var required.');
+  console.error('Get it from: Supabase Dashboard → Settings → API → service_role (secret)');
+  process.exit(1);
+}
+
+const args = process.argv.slice(2);
+const migrationFile = args.find(a => a.endsWith('.sql'));
+const seedToken = args.includes('--seed-token');
+
+if (migrationFile === undefined) {
+  console.error('Usage: SUPABASE_SERVICE_KEY=... node apply-migration.mjs <file.sql> [--seed-token]');
+  process.exit(1);
+}
+
+async function runSQL(sql, label) {
+  // Use the pg REST endpoint with service_role for DDL
+  // Supabase doesn't have a raw SQL endpoint via REST, so we use the
+  // PostgREST RPC approach: create a temporary function wrapper
+  // Actually, the proper way is using the Supabase Management API or pg directly.
+  // For simplicity, we split the SQL into individual statements and use the
+  // service_role key with the PostgREST RPC endpoint.
+
+  // Alternative: use the Supabase SQL editor API
+  const response = await fetch(`${SUPABASE_URL}/rest/v1/rpc/`, {
+    method: 'POST',
+    headers: {
+      'apikey': SERVICE_KEY,
+      'Authorization': `Bearer ${SERVICE_KEY}`,
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify({ query: sql }),
+  });
+
+  if (response.ok === false) {
+    const text = await response.text();
+    throw new Error(`${label}: ${response.status} — ${text}`);
+  }
+
+  return response.json();
+}
+
+async function main() {
+  console.log('╔══════════════════════════════════════════════════════════════╗');
+  console.log('║  Mega Brain — Migration Runner                              ║');
+  console.log('╚══════════════════════════════════════════════════════════════╝');
+  console.log('');
+
+  const sqlPath = resolve(__dirname, migrationFile);
+  const sql = readFileSync(sqlPath, 'utf-8');
+  console.log(`  Migration: ${migrationFile}`);
+  console.log(`  SQL size: ${sql.length} bytes`);
+  console.log('');
+
+  // The Supabase REST API doesn't support raw DDL via PostgREST.
+  // The proper way to apply migrations is:
+  //   1. Supabase Dashboard → SQL Editor → paste and run
+  //   2. supabase db push (Supabase CLI)
+  //   3. Direct psql connection
+  //
+  // This script will attempt the Management API first, then fall back to instructions.
+
+  console.log('  NOTE: Supabase REST API does not support raw DDL via PostgREST.');
+  console.log('');
+  console.log('  To apply this migration, use ONE of these methods:');
+  console.log('');
+  console.log('  [1] Supabase Dashboard → SQL Editor:');
+  console.log(`      Open: https://supabase.com/dashboard/project/lgbzktgbhowxiwppycbi/sql`);
+  console.log(`      Paste the contents of: ${migrationFile}`);
+  console.log('      Click "Run"');
+  console.log('');
+  console.log('  [2] Supabase CLI:');
+  console.log('      npx supabase login');
+  console.log('      npx supabase link --project-ref lgbzktgbhowxiwppycbi');
+  console.log(`      npx supabase db push`);
+  console.log('');
+  console.log('  [3] Direct psql (if you have the connection string):');
+  console.log(`      psql "postgresql://..." -f ${migrationFile}`);
+  console.log('');
+
+  if (seedToken) {
+    if (PREMIUM_TOKEN === undefined || PREMIUM_TOKEN === '') {
+      console.error('  ERROR: --seed-token requires PREMIUM_REPO_TOKEN env var.');
+      console.error('  Create a fine-grained PAT at: https://github.com/settings/personal-access-tokens/new');
+      console.error('  Scope: mega-brain-premium repo, contents:read only');
+      process.exit(1);
+    }
+
+    console.log('  After applying the migration, run this INSERT in the SQL Editor:');
+    console.log('');
+    console.log(`  INSERT INTO system_config (key, value, description)`);
+    console.log(`  VALUES (`);
+    console.log(`    'premium_repo_token',`);
+    console.log(`    '${PREMIUM_TOKEN}',`);
+    console.log(`    'GitHub fine-grained PAT for mega-brain-premium (contents:read)'`);
+    console.log(`  )`);
+    console.log(`  ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, updated_at = NOW();`);
+    console.log('');
+  }
+
+  console.log('  Done. Migration file ready at:');
+  console.log(`  ${sqlPath}`);
+}
+
+main().catch(err => {
+  console.error('Fatal:', err.message);
+  process.exit(1);
+});