smoodly 0.0.35 → 0.0.36

package/migrations/20260930040956_smoodly_v7.sql

@@ -0,0 +1,84 @@
+-- Smoodly core schema, version 7 (docs/superpowers/specs/2026-09-29-content-api-contract-design.md §5).
+-- Shipped in the smoodly package; `npx smoodly migrate` copies it into supabase/migrations/.
+-- Never edit a published file: the next change is the next file.
+-- The delta over version 6: smoodly_list_entries, which filters, orders and
+-- limits a collection over the snapshot the reader is shown, and the read
+-- policies of every content table admit a write key only (§8).
+
+-- The shown snapshot of one collection's entries in a locale, filtered,
+-- ordered and limited in one query (spec 2026-09-29 content API contract
+-- §5): the published snapshot, or the live merge in preview. Invoker
+-- rights, so RLS decides what a key sees; a preview read needs the
+-- service role or a write key, anything else reads published.
+create or replace function "smoodly_list_entries"(
+  p_collection text, p_locale text, p_draft boolean, p_where jsonb, p_order jsonb,
+  p_limit integer, p_parent uuid, p_has_parent boolean, p_ids uuid[]
+) returns table ("id" uuid, "fields" jsonb) language sql stable set search_path = public as $$
+  with mode as (
+    select p_draft and (current_user = 'service_role' or "smoodly_key_kind"() = 'write') as draft
+  ), shown as (
+    select e."id", e."sort", e."created_at", l."updated_at",
+      case when (select draft from mode) then e."fields" || l."fields" || jsonb_build_object('slug', l."slug")
+           else coalesce(v."fields", e."fields" || l."fields" || jsonb_build_object('slug', l."slug")) end as "fields"
+    from "entries" e
+    join "entry_locales" l on l."entry_id" = e."id" and l."locale" = p_locale
+    left join "entry_versions" v on v."id" = l."published_version_id"
+    where e."collection" = p_collection
+      and ((select draft from mode) or l."status" = 'published')
+      and (not p_has_parent or e."parent_id" is not distinct from p_parent)
+      and (p_ids is null or e."id" = any(p_ids))
+  )
+  select s."id", s."fields" from shown s
+  where not exists (
+    select 1 from jsonb_each(coalesce(p_where, '{}'::jsonb)) w
+    where not (case when w.value ? 'in'
+                    then (s."fields" ->> w.key) = any (select jsonb_array_elements_text(w.value -> 'in'))
+                    else s."fields" @> jsonb_build_object(w.key, w.value -> 'contains') end))
+  order by
+    case when p_order ->> 'by' = 'manual' then s."sort" end asc nulls last,
+    case when p_order ->> 'direction' = 'asc' then
+      case p_order ->> 'by' when 'createdAt' then to_jsonb(s."created_at") when 'updatedAt' then to_jsonb(s."updated_at")
+           when 'manual' then null else nullif(nullif(s."fields" -> (p_order ->> 'by'), 'null'::jsonb), '""'::jsonb) end end asc nulls last,
+    case when p_order ->> 'direction' = 'desc' then
+      case p_order ->> 'by' when 'createdAt' then to_jsonb(s."created_at") when 'updatedAt' then to_jsonb(s."updated_at")
+           when 'manual' then null else nullif(nullif(s."fields" -> (p_order ->> 'by'), 'null'::jsonb), '""'::jsonb) end end desc nulls last,
+    s."created_at" asc, s."id" asc
+  limit p_limit;
+$$;
+
+-- No public content reads (spec 2026-09-29 content API contract §8): the
+-- publishable key and a read key read nothing; a write key reads its own space.
+drop policy if exists "smoodly_read" on "pages";
+create policy "smoodly_read" on "pages" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "page_locales";
+create policy "smoodly_read" on "page_locales" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "page_versions";
+create policy "smoodly_read" on "page_versions" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "entries";
+create policy "smoodly_read" on "entries" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "entry_locales";
+create policy "smoodly_read" on "entry_locales" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "entry_versions";
+create policy "smoodly_read" on "entry_versions" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "paths";
+create policy "smoodly_read" on "paths" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+drop policy if exists "smoodly_read" on "assets";
+create policy "smoodly_read" on "assets" for select
+  using ("space_id" = (select "smoodly_current_space"()) and not (select "smoodly_space_key_revoked"()) and (select "smoodly_key_kind"()) = 'write');
+
+insert into "smoodly_meta" ("key", "value") values ('schema_version', '7')
+  on conflict ("key") do update set "value" = excluded."value";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "smoodly",
-  "version": "0.0.35",
+  "version": "0.0.36",
   "description": "Open-source, code-first CMS for Next.js on Supabase: define a component once, it becomes a typed, editable building block.",
   "license": "MIT",
   "repository": {