spine-framework 0.3.92 → 0.3.93

package/.framework/migrations/019_triggers_unique_constraint.sql

@@ -0,0 +1,13 @@
+-- Migration 019: Add unique constraint on triggers(app_id, name)
+--
+-- The triggers table had no unique constraint, making idempotent upserts
+-- impossible (re-runs would create duplicate rows). This adds a partial unique
+-- index scoped to (app_id, name) so install-app can safely upsert seed triggers
+-- using onConflict: 'app_id,name'.
+--
+-- NULL app_id rows (global triggers) are excluded from the uniqueness check
+-- via the WHERE clause to avoid false conflicts between global triggers.
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_triggers_app_id_name
+  ON public.triggers(app_id, name)
+  WHERE app_id IS NOT NULL;

package/.framework/migrations/020_get_account_apps_role_filter.sql

@@ -0,0 +1,117 @@
+-- Migration 020: Add role-based filtering to get_account_apps()
+--
+-- Previously the RPC returned all apps for an account and the frontend
+-- filtered by role client-side.  This was fragile (race conditions around
+-- stale roles) and leaked app metadata to users who couldn't access them.
+--
+-- New signature adds two optional params:
+--   user_role_slugs  text[]   — the calling user's role slugs (e.g. ARRAY['support'])
+--   is_system_admin  boolean  — true bypasses all role checks
+--
+-- Filtering logic:
+--   1. system_admin always sees everything
+--   2. Apps with no required_roles AND no min_role are visible to everyone
+--   3. Apps with required_roles: user must have at least one matching role
+--   4. Apps with only min_role (legacy): treated as required_roles = ARRAY[min_role]
+--
+-- Existing callers that omit the new params get the old behaviour (no filtering).
+
+DROP FUNCTION IF EXISTS public.get_account_apps(uuid, boolean, boolean);
+DROP FUNCTION IF EXISTS public.get_account_apps(uuid, boolean, boolean, text[], boolean);
+
+CREATE OR REPLACE FUNCTION public.get_account_apps(
+  account_id        uuid,
+  include_system    boolean  DEFAULT true,
+  include_inactive  boolean  DEFAULT false,
+  user_role_slugs   text[]   DEFAULT NULL,
+  is_system_admin   boolean  DEFAULT false
+)
+RETURNS TABLE(
+  id                uuid,
+  slug              text,
+  name              text,
+  description       text,
+  icon              text,
+  color             text,
+  version           text,
+  app_type          text,
+  source            text,
+  owner_account_id  uuid,
+  is_active         boolean,
+  is_system         boolean,
+  min_role          text,
+  required_roles    jsonb,
+  config            jsonb,
+  nav_items         jsonb,
+  route_prefix      text,
+  renderer          text,
+  metadata          jsonb,
+  integration_deps  jsonb,
+  created_at        timestamptz
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+AS $$
+BEGIN
+  RETURN QUERY
+  SELECT
+    a.id,
+    a.slug,
+    a.name,
+    a.description,
+    a.icon,
+    a.color,
+    a.version,
+    a.app_type,
+    a.source,
+    a.owner_account_id,
+    a.is_active,
+    a.is_system,
+    a.min_role,
+    a.required_roles,
+    a.config,
+    a.nav_items,
+    a.route_prefix,
+    a.renderer,
+    a.metadata,
+    a.integration_deps,
+    a.created_at
+  FROM public.apps a
+  WHERE
+    -- Active filter
+    (include_inactive OR a.is_active = true)
+    -- Ownership / visibility filter
+    AND (
+      a.is_system = true
+      OR a.owner_account_id = get_account_apps.account_id
+      OR a.owner_account_id IS NULL
+    )
+    -- Role filter (only applied when user_role_slugs is provided)
+    AND (
+      user_role_slugs IS NULL                              -- no filter requested (backward compat)
+      OR is_system_admin                                   -- system_admin sees everything
+      OR (                                                 -- no role requirement on this app
+        (a.required_roles IS NULL OR a.required_roles = '[]'::jsonb)
+        AND a.min_role IS NULL
+      )
+      OR (                                                 -- user has a matching required_role
+        a.required_roles IS NOT NULL
+        AND a.required_roles != '[]'::jsonb
+        AND EXISTS (
+          SELECT 1
+          FROM jsonb_array_elements_text(a.required_roles) AS rr(role_slug)
+          WHERE rr.role_slug = ANY(user_role_slugs)
+        )
+      )
+      OR (                                                 -- legacy min_role fallback
+        (a.required_roles IS NULL OR a.required_roles = '[]'::jsonb)
+        AND a.min_role IS NOT NULL
+        AND a.min_role = ANY(user_role_slugs)
+      )
+    )
+  ORDER BY
+    a.is_system DESC,
+    a.app_type,
+    a.name;
+END;
+$$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spine-framework",
-  "version": "0.3.92",
+  "version": "0.3.93",
   "description": "Multi-tenant, modular application platform for modern SaaS systems",
   "type": "module",
   "bin": {
@@ -25,6 +25,8 @@
     ".framework/migrations/016_invites.sql",
     ".framework/migrations/017_fix_get_account_apps.sql",
     ".framework/migrations/018_apps_required_roles.sql",
+    ".framework/migrations/019_triggers_unique_constraint.sql",
+    ".framework/migrations/020_get_account_apps_role_filter.sql",
     ".framework/public/",
     ".framework/scripts/",
     ".framework/seeds/",