vibecarbon 0.1.0

package/carbon/volumes/db/jwt.sql

@@ -0,0 +1,57 @@
+-- JWT Functions for Supabase
+-- These functions are used by PostgREST and RLS policies
+
+-- Create extensions schema if not exists
+CREATE SCHEMA IF NOT EXISTS extensions;
+
+-- Function to get current user ID from JWT
+CREATE OR REPLACE FUNCTION auth.uid()
+RETURNS uuid
+LANGUAGE sql
+STABLE
+AS $$
+  SELECT NULLIF(
+    COALESCE(
+      current_setting('request.jwt.claim.sub', true),
+      current_setting('request.jwt.claims', true)::json->>'sub'
+    ),
+    ''
+  )::uuid
+$$;
+
+-- Function to get current user role from JWT
+CREATE OR REPLACE FUNCTION auth.role()
+RETURNS text
+LANGUAGE sql
+STABLE
+AS $$
+  SELECT COALESCE(
+    current_setting('request.jwt.claim.role', true),
+    current_setting('request.jwt.claims', true)::json->>'role'
+  )::text
+$$;
+
+-- Function to get current user email from JWT
+CREATE OR REPLACE FUNCTION auth.email()
+RETURNS text
+LANGUAGE sql
+STABLE
+AS $$
+  SELECT COALESCE(
+    current_setting('request.jwt.claim.email', true),
+    current_setting('request.jwt.claims', true)::json->>'email'
+  )::text
+$$;
+
+-- Note: auth.jwt() function is created by GoTrue during its migrations
+-- We don't create it here to avoid ownership conflicts
+
+-- Transfer ownership to supabase_auth_admin so GoTrue can manage these functions
+ALTER FUNCTION auth.uid() OWNER TO supabase_auth_admin;
+ALTER FUNCTION auth.role() OWNER TO supabase_auth_admin;
+ALTER FUNCTION auth.email() OWNER TO supabase_auth_admin;
+
+-- Grant execute permissions
+GRANT EXECUTE ON FUNCTION auth.uid() TO anon, authenticated, service_role;
+GRANT EXECUTE ON FUNCTION auth.role() TO anon, authenticated, service_role;
+GRANT EXECUTE ON FUNCTION auth.email() TO anon, authenticated, service_role;

package/carbon/volumes/db/metabase-init.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+set -e
+
+# Metabase Database Initialization
+# Creates the metabase database and user for analytics
+# Password is injected from POSTGRES_PASSWORD env var at runtime (never hardcoded)
+
+# Create metabase role if it doesn't exist (quoted heredoc — no variable expansion)
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<'EOSQL'
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'metabase') THEN
+        CREATE ROLE metabase WITH LOGIN;
+    END IF;
+END
+$$;
+EOSQL
+
+# Set password and create database (unquoted heredoc — POSTGRES_PASSWORD is expanded)
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<EOSQL
+ALTER ROLE metabase WITH PASSWORD '${POSTGRES_PASSWORD}';
+SELECT 'CREATE DATABASE metabase WITH OWNER metabase ENCODING ''UTF8'' TEMPLATE template0'
+WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'metabase')\gexec
+GRANT ALL PRIVILEGES ON DATABASE metabase TO metabase;
+GRANT CONNECT ON DATABASE postgres TO metabase;
+GRANT USAGE ON SCHEMA public TO metabase;
+GRANT SELECT ON ALL TABLES IN SCHEMA public TO metabase;
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO metabase;
+EOSQL

package/carbon/volumes/db/n8n-init.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+set -e
+
+# n8n Database Initialization
+# Creates dedicated n8n user and database for workflow automation
+# Password is injected from POSTGRES_PASSWORD env var at runtime (never hardcoded)
+
+# Create n8n role if it doesn't exist (quoted heredoc — no variable expansion)
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<'EOSQL'
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'n8n') THEN
+        CREATE ROLE n8n WITH LOGIN;
+    END IF;
+END
+$$;
+EOSQL
+
+# Set password and create database (unquoted heredoc — POSTGRES_PASSWORD is expanded)
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<EOSQL
+ALTER ROLE n8n WITH PASSWORD '${POSTGRES_PASSWORD}';
+SELECT 'CREATE DATABASE n8n WITH OWNER n8n ENCODING ''UTF8'' TEMPLATE template0'
+WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'n8n')\gexec
+GRANT ALL PRIVILEGES ON DATABASE n8n TO n8n;
+EOSQL

package/carbon/volumes/db/realtime.sql

@@ -0,0 +1,33 @@
+-- Realtime Schema Setup
+-- This sets up the required schema for Supabase Realtime
+
+-- Create realtime schema
+CREATE SCHEMA IF NOT EXISTS _realtime;
+
+-- Grant permissions to postgres and supabase_admin (used by Realtime service)
+GRANT USAGE ON SCHEMA _realtime TO postgres, supabase_admin;
+GRANT ALL ON SCHEMA _realtime TO postgres, supabase_admin;
+
+-- Create publication for realtime
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_publication WHERE pubname = 'supabase_realtime') THEN
+        CREATE PUBLICATION supabase_realtime;
+    END IF;
+END
+$$;
+
+-- Function to enable realtime for a table
+CREATE OR REPLACE FUNCTION _realtime.enable_table(table_name text)
+RETURNS void
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = ''
+AS $$
+BEGIN
+    EXECUTE format('ALTER PUBLICATION supabase_realtime ADD TABLE %I', table_name);
+END;
+$$;
+
+-- Grant execute permission
+GRANT EXECUTE ON FUNCTION _realtime.enable_table(text) TO postgres, supabase_admin;

package/carbon/volumes/db/roles.sql

@@ -0,0 +1,93 @@
+-- Supabase Roles Setup
+-- Creates required roles and grants for Supabase services
+-- Passwords are set separately by set-passwords.sh (never hardcoded in SQL)
+
+-- Drop auth.jwt() if it exists - GoTrue will recreate it with correct return type (jsonb)
+DROP FUNCTION IF EXISTS auth.jwt();
+
+-- Create roles if they don't exist (fallback for non-Supabase postgres images)
+DO $$
+BEGIN
+    -- anon role (for anonymous access)
+    IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'anon') THEN
+        CREATE ROLE anon NOLOGIN NOINHERIT;
+    END IF;
+
+    -- authenticated role (for logged-in users)
+    IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'authenticated') THEN
+        CREATE ROLE authenticated NOLOGIN NOINHERIT;
+    END IF;
+
+    -- service_role (for server-side operations)
+    IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'service_role') THEN
+        CREATE ROLE service_role NOLOGIN NOINHERIT BYPASSRLS;
+    END IF;
+
+    -- authenticator role (PostgREST uses this)
+    IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'authenticator') THEN
+        CREATE ROLE authenticator NOINHERIT LOGIN;
+    END IF;
+
+    -- supabase_admin role
+    IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'supabase_admin') THEN
+        CREATE ROLE supabase_admin LOGIN;
+    END IF;
+
+    -- supabase_auth_admin role (for GoTrue)
+    IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'supabase_auth_admin') THEN
+        CREATE ROLE supabase_auth_admin NOINHERIT CREATEROLE LOGIN;
+    END IF;
+
+    -- supabase_storage_admin role (for Storage)
+    IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'supabase_storage_admin') THEN
+        CREATE ROLE supabase_storage_admin NOINHERIT CREATEROLE LOGIN;
+    END IF;
+END
+$$;
+
+-- Grant role memberships
+GRANT anon TO authenticator;
+GRANT authenticated TO authenticator;
+GRANT service_role TO authenticator;
+GRANT supabase_admin TO authenticator;
+
+-- Grant schema permissions (principle of least privilege)
+GRANT USAGE ON SCHEMA public TO anon, authenticated, service_role;
+
+-- anon role: must be granted access explicitly per table via RLS
+GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO anon;
+
+-- authenticated role: SELECT, INSERT, UPDATE, DELETE (controlled by RLS)
+GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO authenticated;
+GRANT USAGE ON ALL SEQUENCES IN SCHEMA public TO authenticated;
+
+-- service_role: ALL (bypasses RLS - use carefully)
+GRANT ALL ON ALL TABLES IN SCHEMA public TO service_role;
+GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO service_role;
+GRANT ALL ON ALL ROUTINES IN SCHEMA public TO service_role;
+
+-- Default privileges for future objects
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO authenticated;
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO service_role;
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE ON SEQUENCES TO authenticated;
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO service_role;
+
+-- Create auth schema for GoTrue (or fix ownership if it already exists)
+CREATE SCHEMA IF NOT EXISTS auth AUTHORIZATION supabase_auth_admin;
+ALTER SCHEMA auth OWNER TO supabase_auth_admin;
+GRANT ALL ON SCHEMA auth TO supabase_auth_admin;
+GRANT USAGE ON SCHEMA auth TO anon, authenticated, service_role;
+
+-- Create storage schema for Storage (or fix ownership if it already exists)
+CREATE SCHEMA IF NOT EXISTS storage AUTHORIZATION supabase_storage_admin;
+ALTER SCHEMA storage OWNER TO supabase_storage_admin;
+GRANT ALL ON SCHEMA storage TO supabase_storage_admin;
+GRANT USAGE ON SCHEMA storage TO anon, authenticated, service_role;
+
+-- Create extensions
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp" WITH SCHEMA extensions;
+CREATE EXTENSION IF NOT EXISTS pgcrypto WITH SCHEMA extensions;
+CREATE EXTENSION IF NOT EXISTS pgjwt WITH SCHEMA extensions;
+
+-- Ensure service_role has BYPASSRLS
+ALTER ROLE service_role WITH BYPASSRLS;

package/carbon/volumes/db/set-passwords.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+set -e
+
+# Set passwords for Supabase service roles from POSTGRES_PASSWORD env var.
+# Mounted at /docker-entrypoint-initdb.d/zz-set-passwords.sh (top level)
+# so the standard postgres entrypoint runs it AFTER migrate.sh creates the roles.
+
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<EOSQL
+ALTER ROLE authenticator WITH PASSWORD '${POSTGRES_PASSWORD}';
+ALTER ROLE supabase_auth_admin WITH PASSWORD '${POSTGRES_PASSWORD}';
+ALTER ROLE supabase_storage_admin WITH PASSWORD '${POSTGRES_PASSWORD}';
+EOSQL

package/carbon/volumes/db/super-admin.dev.sql

@@ -0,0 +1,113 @@
+-- Create initial admin user in auth.users (Development Version)
+-- Uses credentials provided during `vibecarbon create`
+
+DO $$
+DECLARE
+  admin_email TEXT := '{{ADMIN_EMAIL}}';
+  admin_password_hash TEXT := '{{ADMIN_PASSWORD_HASH}}';
+  new_user_id UUID;
+BEGIN
+  -- Only create if admin email is provided and not empty
+  IF admin_email IS NOT NULL AND admin_email != '' THEN
+
+    -- Check if user already exists
+    IF NOT EXISTS (SELECT 1 FROM auth.users WHERE email = admin_email) THEN
+      -- Generate a new UUID for the user
+      new_user_id := gen_random_uuid();
+
+      -- Create admin user with bcrypt-hashed password
+      -- Note: GoTrue expects token columns to be empty strings, not NULL
+      INSERT INTO auth.users (
+        instance_id,
+        id,
+        aud,
+        role,
+        email,
+        encrypted_password,
+        email_confirmed_at,
+        confirmation_sent_at,
+        raw_app_meta_data,
+        raw_user_meta_data,
+        created_at,
+        updated_at,
+        confirmation_token,
+        recovery_token,
+        email_change_token_new,
+        email_change_token_current,
+        email_change,
+        phone,
+        phone_change,
+        phone_change_token,
+        reauthentication_token
+      ) VALUES (
+        '00000000-0000-0000-0000-000000000000',
+        new_user_id,
+        'authenticated',
+        'authenticated',
+        admin_email,
+        admin_password_hash,
+        NOW(),
+        NOW(),
+        jsonb_build_object(
+          'provider', 'email',
+          'providers', ARRAY['email'],
+          'role', 'super_admin'
+        ),
+        '{"onboarding_completed": true}'::jsonb,
+        NOW(),
+        NOW(),
+        '',
+        '',
+        '',
+        '',
+        '',
+        '',
+        '',
+        '',
+        ''
+      );
+
+      -- Create identity record for email provider
+      INSERT INTO auth.identities (
+        id,
+        user_id,
+        identity_data,
+        provider,
+        provider_id,
+        last_sign_in_at,
+        created_at,
+        updated_at
+      ) VALUES (
+        gen_random_uuid(),
+        new_user_id,
+        jsonb_build_object(
+          'sub', new_user_id::text,
+          'email', admin_email,
+          'email_verified', true
+        ),
+        'email',
+        new_user_id::text,
+        NOW(),
+        NOW(),
+        NOW()
+      );
+
+      RAISE NOTICE 'Created dev admin user: % with id: %', admin_email, new_user_id;
+    ELSE
+      -- Update existing user to have super_admin role if they don't already
+      UPDATE auth.users
+      SET raw_app_meta_data = raw_app_meta_data || '{"role": "super_admin"}'::jsonb,
+          updated_at = NOW()
+      WHERE email = admin_email
+        AND (raw_app_meta_data->>'role' IS NULL OR raw_app_meta_data->>'role' != 'super_admin');
+
+      IF FOUND THEN
+        RAISE NOTICE 'Updated existing user % to admin role', admin_email;
+      ELSE
+        RAISE NOTICE 'User % already exists with admin role', admin_email;
+      END IF;
+    END IF;
+  ELSE
+    RAISE NOTICE 'Skipping admin user creation - no admin email configured';
+  END IF;
+END $$;

package/carbon/volumes/db/super-admin.generated.sql

@@ -0,0 +1,113 @@
+-- Create initial admin user in auth.users (Development Version)
+-- Uses credentials provided during `vibecarbon create`
+
+DO $$
+DECLARE
+  admin_email TEXT := 'admin@example.com';
+  admin_password_hash TEXT := '$2b$10$OWzZo/eSlFAb2S9oX4Ps5.prj7LzVfAWo7N1cFrL3N8Z3HLUZtvOm';
+  new_user_id UUID;
+BEGIN
+  -- Only create if admin email is provided and not empty
+  IF admin_email IS NOT NULL AND admin_email != '' THEN
+
+    -- Check if user already exists
+    IF NOT EXISTS (SELECT 1 FROM auth.users WHERE email = admin_email) THEN
+      -- Generate a new UUID for the user
+      new_user_id := gen_random_uuid();
+
+      -- Create admin user with bcrypt-hashed password
+      -- Note: GoTrue expects token columns to be empty strings, not NULL
+      INSERT INTO auth.users (
+        instance_id,
+        id,
+        aud,
+        role,
+        email,
+        encrypted_password,
+        email_confirmed_at,
+        confirmation_sent_at,
+        raw_app_meta_data,
+        raw_user_meta_data,
+        created_at,
+        updated_at,
+        confirmation_token,
+        recovery_token,
+        email_change_token_new,
+        email_change_token_current,
+        email_change,
+        phone,
+        phone_change,
+        phone_change_token,
+        reauthentication_token
+      ) VALUES (
+        '00000000-0000-0000-0000-000000000000',
+        new_user_id,
+        'authenticated',
+        'authenticated',
+        admin_email,
+        admin_password_hash,
+        NOW(),
+        NOW(),
+        jsonb_build_object(
+          'provider', 'email',
+          'providers', ARRAY['email'],
+          'role', 'super_admin'
+        ),
+        '{}'::jsonb,
+        NOW(),
+        NOW(),
+        '',
+        '',
+        '',
+        '',
+        '',
+        '',
+        '',
+        '',
+        ''
+      );
+
+      -- Create identity record for email provider
+      INSERT INTO auth.identities (
+        id,
+        user_id,
+        identity_data,
+        provider,
+        provider_id,
+        last_sign_in_at,
+        created_at,
+        updated_at
+      ) VALUES (
+        gen_random_uuid(),
+        new_user_id,
+        jsonb_build_object(
+          'sub', new_user_id::text,
+          'email', admin_email,
+          'email_verified', true
+        ),
+        'email',
+        new_user_id::text,
+        NOW(),
+        NOW(),
+        NOW()
+      );
+
+      RAISE NOTICE 'Created dev admin user: % with id: %', admin_email, new_user_id;
+    ELSE
+      -- Update existing user to have super_admin role if they don't already
+      UPDATE auth.users
+      SET raw_app_meta_data = raw_app_meta_data || '{"role": "super_admin"}'::jsonb,
+          updated_at = NOW()
+      WHERE email = admin_email
+        AND (raw_app_meta_data->>'role' IS NULL OR raw_app_meta_data->>'role' != 'super_admin');
+
+      IF FOUND THEN
+        RAISE NOTICE 'Updated existing user % to admin role', admin_email;
+      ELSE
+        RAISE NOTICE 'User % already exists with admin role', admin_email;
+      END IF;
+    END IF;
+  ELSE
+    RAISE NOTICE 'Skipping admin user creation - no admin email configured';
+  END IF;
+END $$;

package/carbon/volumes/db/super-admin.sql

@@ -0,0 +1,114 @@
+-- Create initial admin user in auth.users
+-- This runs after Supabase GoTrue is initialized
+-- Password hash is generated during project creation (plain password is never stored)
+
+DO $$
+DECLARE
+  admin_email TEXT := '{{ADMIN_EMAIL}}';
+  admin_password_hash TEXT := '{{ADMIN_PASSWORD_HASH}}';
+  new_user_id UUID;
+BEGIN
+  -- Only create if admin email is provided and not empty
+  IF admin_email IS NOT NULL AND admin_email != '' THEN
+
+    -- Check if user already exists
+    IF NOT EXISTS (SELECT 1 FROM auth.users WHERE email = admin_email) THEN
+      -- Generate a new UUID for the user
+      new_user_id := gen_random_uuid();
+
+      -- Create admin user with bcrypt-hashed password
+      -- Note: GoTrue expects token columns to be empty strings, not NULL
+      INSERT INTO auth.users (
+        instance_id,
+        id,
+        aud,
+        role,
+        email,
+        encrypted_password,
+        email_confirmed_at,
+        confirmation_sent_at,
+        raw_app_meta_data,
+        raw_user_meta_data,
+        created_at,
+        updated_at,
+        confirmation_token,
+        recovery_token,
+        email_change_token_new,
+        email_change_token_current,
+        email_change,
+        phone,
+        phone_change,
+        phone_change_token,
+        reauthentication_token
+      ) VALUES (
+        '00000000-0000-0000-0000-000000000000',
+        new_user_id,
+        'authenticated',
+        'authenticated',
+        admin_email,
+        admin_password_hash,
+        NOW(),
+        NOW(),
+        jsonb_build_object(
+          'provider', 'email',
+          'providers', ARRAY['email'],
+          'role', 'super_admin'
+        ),
+        '{"onboarding_completed": true}'::jsonb,
+        NOW(),
+        NOW(),
+        '',
+        '',
+        '',
+        '',
+        '',
+        '',
+        '',
+        '',
+        ''
+      );
+
+      -- Create identity record for email provider
+      INSERT INTO auth.identities (
+        id,
+        user_id,
+        identity_data,
+        provider,
+        provider_id,
+        last_sign_in_at,
+        created_at,
+        updated_at
+      ) VALUES (
+        gen_random_uuid(),
+        new_user_id,
+        jsonb_build_object(
+          'sub', new_user_id::text,
+          'email', admin_email,
+          'email_verified', true
+        ),
+        'email',
+        new_user_id::text,
+        NOW(),
+        NOW(),
+        NOW()
+      );
+
+      RAISE NOTICE 'Created admin user: % with id: %', admin_email, new_user_id;
+    ELSE
+      -- Update existing user to have super_admin role if they don't already
+      UPDATE auth.users
+      SET raw_app_meta_data = raw_app_meta_data || '{"role": "super_admin"}'::jsonb,
+          updated_at = NOW()
+      WHERE email = admin_email
+        AND (raw_app_meta_data->>'role' IS NULL OR raw_app_meta_data->>'role' != 'super_admin');
+
+      IF FOUND THEN
+        RAISE NOTICE 'Updated existing user % to admin role', admin_email;
+      ELSE
+        RAISE NOTICE 'User % already exists with admin role', admin_email;
+      END IF;
+    END IF;
+  ELSE
+    RAISE NOTICE 'Skipping admin user creation - no admin email configured';
+  END IF;
+END $$;