spine-framework 0.3.92 → 0.3.94

package/.framework/migrations/019_triggers_unique_constraint.sql

@@ -0,0 +1,13 @@
+-- Migration 019: Add unique constraint on triggers(app_id, name)
+--
+-- The triggers table had no unique constraint, making idempotent upserts
+-- impossible (re-runs would create duplicate rows). This adds a partial unique
+-- index scoped to (app_id, name) so install-app can safely upsert seed triggers
+-- using onConflict: 'app_id,name'.
+--
+-- NULL app_id rows (global triggers) are excluded from the uniqueness check
+-- via the WHERE clause to avoid false conflicts between global triggers.
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_triggers_app_id_name
+  ON public.triggers(app_id, name)
+  WHERE app_id IS NOT NULL;

package/.framework/migrations/020_get_account_apps_role_filter.sql

@@ -0,0 +1,117 @@
+-- Migration 020: Add role-based filtering to get_account_apps()
+--
+-- Previously the RPC returned all apps for an account and the frontend
+-- filtered by role client-side.  This was fragile (race conditions around
+-- stale roles) and leaked app metadata to users who couldn't access them.
+--
+-- New signature adds two optional params:
+--   user_role_slugs  text[]   — the calling user's role slugs (e.g. ARRAY['support'])
+--   is_system_admin  boolean  — true bypasses all role checks
+--
+-- Filtering logic:
+--   1. system_admin always sees everything
+--   2. Apps with no required_roles AND no min_role are visible to everyone
+--   3. Apps with required_roles: user must have at least one matching role
+--   4. Apps with only min_role (legacy): treated as required_roles = ARRAY[min_role]
+--
+-- Existing callers that omit the new params get the old behaviour (no filtering).
+
+DROP FUNCTION IF EXISTS public.get_account_apps(uuid, boolean, boolean);
+DROP FUNCTION IF EXISTS public.get_account_apps(uuid, boolean, boolean, text[], boolean);
+
+CREATE OR REPLACE FUNCTION public.get_account_apps(
+  account_id        uuid,
+  include_system    boolean  DEFAULT true,
+  include_inactive  boolean  DEFAULT false,
+  user_role_slugs   text[]   DEFAULT NULL,
+  is_system_admin   boolean  DEFAULT false
+)
+RETURNS TABLE(
+  id                uuid,
+  slug              text,
+  name              text,
+  description       text,
+  icon              text,
+  color             text,
+  version           text,
+  app_type          text,
+  source            text,
+  owner_account_id  uuid,
+  is_active         boolean,
+  is_system         boolean,
+  min_role          text,
+  required_roles    jsonb,
+  config            jsonb,
+  nav_items         jsonb,
+  route_prefix      text,
+  renderer          text,
+  metadata          jsonb,
+  integration_deps  jsonb,
+  created_at        timestamptz
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+AS $$
+BEGIN
+  RETURN QUERY
+  SELECT
+    a.id,
+    a.slug,
+    a.name,
+    a.description,
+    a.icon,
+    a.color,
+    a.version,
+    a.app_type,
+    a.source,
+    a.owner_account_id,
+    a.is_active,
+    a.is_system,
+    a.min_role,
+    a.required_roles,
+    a.config,
+    a.nav_items,
+    a.route_prefix,
+    a.renderer,
+    a.metadata,
+    a.integration_deps,
+    a.created_at
+  FROM public.apps a
+  WHERE
+    -- Active filter
+    (include_inactive OR a.is_active = true)
+    -- Ownership / visibility filter
+    AND (
+      a.is_system = true
+      OR a.owner_account_id = get_account_apps.account_id
+      OR a.owner_account_id IS NULL
+    )
+    -- Role filter (only applied when user_role_slugs is provided)
+    AND (
+      user_role_slugs IS NULL                              -- no filter requested (backward compat)
+      OR is_system_admin                                   -- system_admin sees everything
+      OR (                                                 -- no role requirement on this app
+        (a.required_roles IS NULL OR a.required_roles = '[]'::jsonb)
+        AND a.min_role IS NULL
+      )
+      OR (                                                 -- user has a matching required_role
+        a.required_roles IS NOT NULL
+        AND a.required_roles != '[]'::jsonb
+        AND EXISTS (
+          SELECT 1
+          FROM jsonb_array_elements_text(a.required_roles) AS rr(role_slug)
+          WHERE rr.role_slug = ANY(user_role_slugs)
+        )
+      )
+      OR (                                                 -- legacy min_role fallback
+        (a.required_roles IS NULL OR a.required_roles = '[]'::jsonb)
+        AND a.min_role IS NOT NULL
+        AND a.min_role = ANY(user_role_slugs)
+      )
+    )
+  ORDER BY
+    a.is_system DESC,
+    a.app_type,
+    a.name;
+END;
+$$;

package/.framework/src/contexts/AppContext.tsx

@@ -84,11 +84,15 @@ export function AppsRegistryProvider({ children }: AppsRegistryProviderProps) {
   const [loading, setLoading] = useState(true)
   const [error, setError] = useState<string | null>(null)
   const abortRef = useRef<AbortController | null>(null)
+  // Track which user the current `apps` + `loading` state belongs to.
+  // When user changes, we know to treat state as stale until the new fetch lands.
+  const loadedForUserRef = useRef<string | null>(null)
 
   const fetchApps = useCallback(async (signal?: AbortSignal) => {
     if (!user) {
       setApps([])
       setLoading(false)
+      loadedForUserRef.current = null
       return
     }
 
@@ -108,6 +112,7 @@ export function AppsRegistryProvider({ children }: AppsRegistryProviderProps) {
       // Backend already filters by role — no client-side role check needed
       const allApps: AppRecord[] = data.data || data || []
       setApps(allApps)
+      loadedForUserRef.current = user.id
     } catch (err) {
       if (err instanceof DOMException && err.name === 'AbortError') return
       setError(err instanceof Error ? err.message : 'Failed to load apps')
@@ -131,6 +136,10 @@ export function AppsRegistryProvider({ children }: AppsRegistryProviderProps) {
     return () => controller.abort()
   }, [user?.id, user?.account_id, rolesKey, fetchApps])
 
+  // Derive effective loading: if user changed but we haven't fetched for them
+  // yet (effect hasn't fired), treat as loading to prevent 404 flash.
+  const effectiveLoading = loading || (!!user && loadedForUserRef.current !== user.id)
+
   const routableApps = apps.filter(
     app => app.route_prefix != null && app.renderer !== 'none'
   )
@@ -143,7 +152,7 @@ export function AppsRegistryProvider({ children }: AppsRegistryProviderProps) {
   }, [fetchApps])
 
   return (
-    <AppsRegistryContext.Provider value={{ apps, routableApps, loading, error, refetch }}>
+    <AppsRegistryContext.Provider value={{ apps, routableApps, loading: effectiveLoading, error, refetch }}>
       {children}
     </AppsRegistryContext.Provider>
   )

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spine-framework",
-  "version": "0.3.92",
+  "version": "0.3.94",
   "description": "Multi-tenant, modular application platform for modern SaaS systems",
   "type": "module",
   "bin": {
@@ -25,6 +25,8 @@
     ".framework/migrations/016_invites.sql",
     ".framework/migrations/017_fix_get_account_apps.sql",
     ".framework/migrations/018_apps_required_roles.sql",
+    ".framework/migrations/019_triggers_unique_constraint.sql",
+    ".framework/migrations/020_get_account_apps_role_filter.sql",
     ".framework/public/",
     ".framework/scripts/",
     ".framework/seeds/",