spine-framework 0.3.141 → 0.3.143
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
-- Spine v2: core schema privileges for Supabase auth roles
|
|
2
|
+
--
|
|
3
|
+
-- Without these grants, a fresh Supabase project denies "schema public"
|
|
4
|
+
-- to service_role (adminDb) and authenticated (userDb) requests, breaking
|
|
5
|
+
-- check-first-user, auth lookup, and all first-user registration flows.
|
|
6
|
+
|
|
7
|
+
-- Allow all auth roles to reference the public schema
|
|
8
|
+
GRANT USAGE ON SCHEMA public TO anon, authenticated, service_role;
|
|
9
|
+
|
|
10
|
+
-- Authenticated users can read all tables; row-level security enforces access
|
|
11
|
+
GRANT SELECT ON ALL TABLES IN SCHEMA public TO authenticated;
|
|
12
|
+
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO authenticated;
|
|
13
|
+
|
|
14
|
+
-- Service role bypasses RLS and needs full CRUD for admin operations
|
|
15
|
+
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO service_role;
|
|
16
|
+
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO service_role;
|
|
17
|
+
|
|
18
|
+
-- Default privileges for objects created after this migration
|
|
19
|
+
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO authenticated;
|
|
20
|
+
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO authenticated;
|
|
21
|
+
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO service_role;
|
|
22
|
+
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO service_role;
|
|
@@ -0,0 +1,100 @@
|
|
|
1
|
+
-- Update get_account_apps to support role-based filtering.
|
|
2
|
+
-- This signature matches the .rpc call in .framework/functions/apps.ts,
|
|
3
|
+
-- which passes user_role_slugs and is_system_admin.
|
|
4
|
+
|
|
5
|
+
DROP FUNCTION IF EXISTS public.get_account_apps(uuid, boolean, boolean);
|
|
6
|
+
DROP FUNCTION IF EXISTS public.get_account_apps(uuid, boolean, boolean, text[], boolean);
|
|
7
|
+
|
|
8
|
+
CREATE OR REPLACE FUNCTION public.get_account_apps(
|
|
9
|
+
account_id uuid,
|
|
10
|
+
include_system boolean DEFAULT true,
|
|
11
|
+
include_inactive boolean DEFAULT false,
|
|
12
|
+
user_role_slugs text[] DEFAULT NULL,
|
|
13
|
+
is_system_admin boolean DEFAULT false
|
|
14
|
+
)
|
|
15
|
+
RETURNS TABLE(
|
|
16
|
+
id uuid,
|
|
17
|
+
slug text,
|
|
18
|
+
name text,
|
|
19
|
+
description text,
|
|
20
|
+
icon text,
|
|
21
|
+
color text,
|
|
22
|
+
version text,
|
|
23
|
+
app_type text,
|
|
24
|
+
source text,
|
|
25
|
+
owner_account_id uuid,
|
|
26
|
+
is_active boolean,
|
|
27
|
+
is_system boolean,
|
|
28
|
+
min_role text,
|
|
29
|
+
required_roles jsonb,
|
|
30
|
+
config jsonb,
|
|
31
|
+
nav_items jsonb,
|
|
32
|
+
route_prefix text,
|
|
33
|
+
renderer text,
|
|
34
|
+
metadata jsonb,
|
|
35
|
+
integration_deps jsonb,
|
|
36
|
+
created_at timestamptz
|
|
37
|
+
)
|
|
38
|
+
LANGUAGE plpgsql
|
|
39
|
+
SECURITY DEFINER
|
|
40
|
+
AS $$
|
|
41
|
+
BEGIN
|
|
42
|
+
RETURN QUERY
|
|
43
|
+
SELECT
|
|
44
|
+
a.id,
|
|
45
|
+
a.slug,
|
|
46
|
+
a.name,
|
|
47
|
+
a.description,
|
|
48
|
+
a.icon,
|
|
49
|
+
a.color,
|
|
50
|
+
a.version,
|
|
51
|
+
a.app_type,
|
|
52
|
+
a.source,
|
|
53
|
+
a.owner_account_id,
|
|
54
|
+
a.is_active,
|
|
55
|
+
a.is_system,
|
|
56
|
+
a.min_role,
|
|
57
|
+
a.required_roles,
|
|
58
|
+
a.config,
|
|
59
|
+
a.nav_items,
|
|
60
|
+
a.route_prefix,
|
|
61
|
+
a.renderer,
|
|
62
|
+
a.metadata,
|
|
63
|
+
a.integration_deps,
|
|
64
|
+
a.created_at
|
|
65
|
+
FROM public.apps a
|
|
66
|
+
WHERE
|
|
67
|
+
(include_inactive OR a.is_active = true)
|
|
68
|
+
AND (
|
|
69
|
+
a.is_system = true
|
|
70
|
+
OR a.owner_account_id = get_account_apps.account_id
|
|
71
|
+
OR a.owner_account_id IS NULL
|
|
72
|
+
)
|
|
73
|
+
AND (
|
|
74
|
+
user_role_slugs IS NULL
|
|
75
|
+
OR is_system_admin
|
|
76
|
+
OR (
|
|
77
|
+
(a.required_roles IS NULL OR a.required_roles = '[]'::jsonb)
|
|
78
|
+
AND a.min_role IS NULL
|
|
79
|
+
)
|
|
80
|
+
OR (
|
|
81
|
+
a.required_roles IS NOT NULL
|
|
82
|
+
AND a.required_roles != '[]'::jsonb
|
|
83
|
+
AND EXISTS (
|
|
84
|
+
SELECT 1
|
|
85
|
+
FROM jsonb_array_elements_text(a.required_roles) AS rr(role_slug)
|
|
86
|
+
WHERE rr.role_slug = ANY(user_role_slugs)
|
|
87
|
+
)
|
|
88
|
+
)
|
|
89
|
+
OR (
|
|
90
|
+
(a.required_roles IS NULL OR a.required_roles = '[]'::jsonb)
|
|
91
|
+
AND a.min_role IS NOT NULL
|
|
92
|
+
AND a.min_role = ANY(user_role_slugs)
|
|
93
|
+
)
|
|
94
|
+
)
|
|
95
|
+
ORDER BY
|
|
96
|
+
a.is_system DESC,
|
|
97
|
+
a.app_type,
|
|
98
|
+
a.name;
|
|
99
|
+
END;
|
|
100
|
+
$$;
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "spine-framework",
|
|
3
|
-
"version": "0.3.
|
|
3
|
+
"version": "0.3.143",
|
|
4
4
|
"description": "Multi-tenant, modular application platform for modern SaaS systems",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|
|
@@ -16,17 +16,7 @@
|
|
|
16
16
|
".framework/cli/",
|
|
17
17
|
".framework/docs/",
|
|
18
18
|
".framework/functions/",
|
|
19
|
-
".framework/migrations
|
|
20
|
-
".framework/migrations/002_core_rls_and_functions.sql",
|
|
21
|
-
".framework/migrations/003_core_system_data.sql",
|
|
22
|
-
".framework/migrations/004_core_rpc_and_broker.sql",
|
|
23
|
-
".framework/migrations/005_core_observability.sql",
|
|
24
|
-
".framework/migrations/006_security_hardening_rls.sql",
|
|
25
|
-
".framework/migrations/007_kb_article_list.sql",
|
|
26
|
-
".framework/migrations/008_items_target.sql",
|
|
27
|
-
".framework/migrations/009_roles_slug_unique.sql",
|
|
28
|
-
".framework/migrations/010_auth_user_trigger.sql",
|
|
29
|
-
".framework/migrations/011_spine_system_account.sql",
|
|
19
|
+
".framework/migrations/*.sql",
|
|
30
20
|
".framework/public/",
|
|
31
21
|
".framework/scripts/",
|
|
32
22
|
".framework/seeds/",
|