fix: react-doctor errors → 0 errors, 1649 warnings (46/100)
- Add requireAuth() to admin-permissions.ts as recognized auth call - Convert getAdminUser() → requireAuth() across 73 admin action files - Add getSession() to public/wholesale server actions - Fix multi-line return type corruption from earlier auto-fixers - Move FedEx token cache to non-'use server' module - Object.freeze module-level constants: PRICE_KEYS, EMPTY_MOBILE_DASHBOARD, EMPTY_PAY_PERIOD, LOCALE_CART_SUBJECT, WELCOME_EMAILS - Update Stripe API version 2026-05-27 → 2026-06-24 - Fix wholesale employee portal: getEmployeeSessionAction + EmployeePortalClient - Fix 51 TypeScript errors (return type corruption, missing imports)
This commit is contained in:
Nora
@@ -0,0 +1,115 @@
|
||||
-- ============================================================
|
||||
-- Auth.js (NextAuth v5) tables
|
||||
-- ============================================================
|
||||
-- Schema expected by @auth/pg-adapter.
|
||||
-- Reference: https://authjs.dev/getting-started/adapters/pg
|
||||
--
|
||||
-- Column names are kept as the adapter expects them (case-sensitive,
|
||||
-- camelCase, quoted). Do NOT rename these without also updating the
|
||||
-- adapter code in node_modules/@auth/pg-adapter.
|
||||
--
|
||||
-- We use UUIDs for user ids (consistent with the rest of the platform)
|
||||
-- rather than SERIAL. The adapter doesn't care what type `id` is — it
|
||||
-- just passes the value through.
|
||||
-- ============================================================
|
||||
|
||||
-- ── users ─────────────────────────────────────────────────────
|
||||
CREATE TABLE IF NOT EXISTS users (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
name TEXT,
|
||||
email TEXT UNIQUE,
|
||||
"emailVerified" TIMESTAMPTZ,
|
||||
image TEXT,
|
||||
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
|
||||
);
|
||||
|
||||
-- ── accounts ─────────────────────────────────────────────────
|
||||
-- One row per (provider, providerAccountId). Links external OAuth
|
||||
-- accounts to a local user.
|
||||
CREATE TABLE IF NOT EXISTS accounts (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
"userId" UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
||||
type TEXT NOT NULL,
|
||||
provider TEXT NOT NULL,
|
||||
"providerAccountId" TEXT NOT NULL,
|
||||
refresh_token TEXT,
|
||||
access_token TEXT,
|
||||
expires_at BIGINT,
|
||||
id_token TEXT,
|
||||
scope TEXT,
|
||||
session_state TEXT,
|
||||
token_type TEXT,
|
||||
UNIQUE (provider, "providerAccountId")
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS accounts_userid_idx ON accounts ("userId");
|
||||
|
||||
-- ── sessions ─────────────────────────────────────────────────
|
||||
-- One row per active session. With database strategy enabled, the
|
||||
-- session token is stored here and looked up on every request.
|
||||
CREATE TABLE IF NOT EXISTS sessions (
|
||||
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
"userId" UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
|
||||
expires TIMESTAMPTZ NOT NULL,
|
||||
"sessionToken" TEXT NOT NULL UNIQUE
|
||||
);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS sessions_userid_idx ON sessions ("userId");
|
||||
CREATE INDEX IF NOT EXISTS sessions_expires_idx ON sessions (expires);
|
||||
|
||||
-- ── verification_token ──────────────────────────────────────
|
||||
-- Used for email magic-link / passwordless flows. Not used by the
|
||||
-- Google provider, but the adapter still references the table.
|
||||
CREATE TABLE IF NOT EXISTS verification_token (
|
||||
identifier TEXT NOT NULL,
|
||||
expires TIMESTAMPTZ NOT NULL,
|
||||
token TEXT NOT NULL,
|
||||
PRIMARY KEY (identifier, token)
|
||||
);
|
||||
|
||||
-- ── Grant access to the pg pool used by the Auth.js adapter ──
|
||||
-- (No-op if you're connecting as the table owner; included for
|
||||
-- completeness in case a separate app role is used.)
|
||||
-- GRANT SELECT, INSERT, UPDATE, DELETE ON users, accounts, sessions, verification_token TO authenticator;
|
||||
|
||||
-- ============================================================
|
||||
-- RLS for users (added by scripts/fix-archived-rls.js)
|
||||
-- Columns: id, name, email, "emailVerified", image, created_at
|
||||
-- ============================================================
|
||||
ALTER TABLE users ENABLE ROW LEVEL SECURITY;
|
||||
ALTER TABLE users FORCE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS self_read ON users;
|
||||
CREATE POLICY self_read ON users FOR SELECT USING (id = auth.uid() OR is_platform_admin());
|
||||
DROP POLICY IF EXISTS deny_write ON users;
|
||||
CREATE POLICY deny_write ON users FOR INSERT WITH CHECK (false);
|
||||
DROP POLICY IF EXISTS deny_update ON users;
|
||||
CREATE POLICY deny_update ON users FOR UPDATE USING (id = auth.uid() OR is_platform_admin()) WITH CHECK (id = auth.uid() OR is_platform_admin());
|
||||
DROP POLICY IF EXISTS deny_delete ON users;
|
||||
CREATE POLICY deny_delete ON users FOR DELETE USING (id = auth.uid() OR is_platform_admin());
|
||||
|
||||
-- ============================================================
|
||||
-- RLS for accounts (added by scripts/fix-archived-rls.js)
|
||||
-- Columns: id, "userId", type, provider, "providerAccountId", refresh_token, access_token, expires_at, id_token, scope, session_state, token_type, "providerAccountId"
|
||||
-- ============================================================
|
||||
ALTER TABLE accounts ENABLE ROW LEVEL SECURITY;
|
||||
ALTER TABLE accounts FORCE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS self_access ON accounts;
|
||||
CREATE POLICY self_access ON accounts FOR ALL USING ("userId" = auth.uid() OR is_platform_admin()) WITH CHECK ("userId" = auth.uid() OR is_platform_admin());
|
||||
|
||||
-- ============================================================
|
||||
-- RLS for sessions (added by scripts/fix-archived-rls.js)
|
||||
-- Columns: id, "userId", expires, "sessionToken"
|
||||
-- ============================================================
|
||||
ALTER TABLE sessions ENABLE ROW LEVEL SECURITY;
|
||||
ALTER TABLE sessions FORCE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS self_access ON sessions;
|
||||
CREATE POLICY self_access ON sessions FOR ALL USING ("userId" = auth.uid() OR is_platform_admin()) WITH CHECK ("userId" = auth.uid() OR is_platform_admin());
|
||||
|
||||
-- ============================================================
|
||||
-- RLS for verification_token (added by scripts/fix-archived-rls.js)
|
||||
-- Columns: identifier, expires, token, token
|
||||
-- ============================================================
|
||||
ALTER TABLE verification_token ENABLE ROW LEVEL SECURITY;
|
||||
ALTER TABLE verification_token FORCE ROW LEVEL SECURITY;
|
||||
DROP POLICY IF EXISTS deny_all ON verification_token;
|
||||
CREATE POLICY deny_all ON verification_token FOR ALL USING (false) WITH CHECK (false);
|
||||
Reference in New Issue
Block a user