feat(storage): MinIO object storage, Neon Auth, Supabase removal
Deploy to route.crispygoat.com / deploy (push) Failing after 7s
Deploy to route.crispygoat.com / deploy (push) Failing after 7s
- Add MinIO/S3-compatible storage client (src/lib/storage.ts) with uploadObject, deleteObject, presigned URL helpers, and BUCKETS constant - Wire product images, brand logos, and water log photos to MinIO via the new storage client - Migrate forgot-password to Neon Auth (remove Supabase /auth/v1/recover call) - Migrate send-scheduled cron to direct Postgres + Resend (remove Supabase Edge Function proxy) - Add logoUrl to email types (OrderReceipt, Welcome, PasswordReset) and pass brand_settings.logo_url from all call sites - Update email templates to use dynamic logoUrl instead of hardcoded Supabase bucket URLs - Remove hardcoded Supabase URLs from TuxedoVideoHero, TuxedoAboutPage, TimeTrackingFieldClient; use brand_settings props + local public/ fallback - Download brand logos (3) and tuxedo-hero.mp4 (36MB) from Supabase bucket to public/ for local development - Add MinIO env vars to .env.example (endpoint, access key, secret, buckets) - Fix TimeTrackingFieldClient to destructure logoUrl and brandAccent props - Fix admin/users.ts logoUrl type (null → undefined for optional string) - Remove stale sb- cookie from wholesale-auth - Migrate tuxedo/about page to remove supabase import and use pool query for wholesale_settings lookup
This commit is contained in:
openclaw
@@ -0,0 +1,160 @@
|
||||
-- 109_enable_rls_critical.sql (v2)
|
||||
-- Supabase flagged 3 tables with RLS disabled. This replaces earlier policies
|
||||
-- that may have been created by Supabase's built-in RLS assistant.
|
||||
--
|
||||
-- Confirmed existing (legacy) policies dropped:
|
||||
-- "Platform admins manage admin_users" — no active=true check
|
||||
-- "admin_users self read" — only self (user_id=auth.uid()), skips brand scope
|
||||
--
|
||||
-- Replacement policies:
|
||||
-- admin_users_platform_admin_all — platform_admin with active=true only
|
||||
-- admin_users_brand_scoped — brand scoped ALL (brand_admin/staff)
|
||||
-- harvest_lots_platform_admin_all— platform_admin with active=true only
|
||||
-- harvest_lots_brand_scoped — brand scoped ALL
|
||||
-- harvest_lot_events_platform_admin_all — platform_admin with active=true only
|
||||
-- harvest_lot_events_brand_scoped — events scoped via lot → harvest_lots
|
||||
|
||||
BEGIN;
|
||||
|
||||
-- ── admin_users ────────────────────────────────────────────────────────────────
|
||||
|
||||
ALTER TABLE public.admin_users ENABLE ROW LEVEL SECURITY;
|
||||
|
||||
-- Drop legacy policies installed by Supabase assistant
|
||||
DROP POLICY IF EXISTS "Platform admins manage admin_users" ON public.admin_users;
|
||||
DROP POLICY IF EXISTS "admin_users self read" ON public.admin_users;
|
||||
DROP POLICY IF EXISTS "admin_users_platform_admin_all" ON public.admin_users;
|
||||
DROP POLICY IF EXISTS "admin_users_brand_scoped" ON public.admin_users;
|
||||
|
||||
-- Platform admins: full access (active=true required)
|
||||
CREATE POLICY "admin_users_platform_admin_all" ON public.admin_users
|
||||
FOR ALL TO authenticated
|
||||
USING (
|
||||
EXISTS (
|
||||
SELECT 1 FROM public.admin_users au
|
||||
WHERE au.user_id = auth.uid()
|
||||
AND au.role = 'platform_admin'
|
||||
AND au.active = true
|
||||
)
|
||||
)
|
||||
WITH CHECK (
|
||||
EXISTS (
|
||||
SELECT 1 FROM public.admin_users au
|
||||
WHERE au.user_id = auth.uid()
|
||||
AND au.role = 'platform_admin'
|
||||
AND au.active = true
|
||||
)
|
||||
);
|
||||
|
||||
-- Brand admins / staff: access only rows matching their brand
|
||||
CREATE POLICY "admin_users_brand_scoped" ON public.admin_users
|
||||
FOR ALL TO authenticated
|
||||
USING (
|
||||
brand_id = (
|
||||
SELECT brand_id FROM public.admin_users
|
||||
WHERE user_id = auth.uid() AND active = true
|
||||
LIMIT 1
|
||||
)
|
||||
)
|
||||
WITH CHECK (
|
||||
brand_id = (
|
||||
SELECT brand_id FROM public.admin_users
|
||||
WHERE user_id = auth.uid() AND active = true
|
||||
LIMIT 1
|
||||
)
|
||||
);
|
||||
|
||||
-- ── harvest_lots ───────────────────────────────────────────────────────────────
|
||||
|
||||
ALTER TABLE public.harvest_lots ENABLE ROW LEVEL SECURITY;
|
||||
|
||||
DROP POLICY IF EXISTS "harvest_lots_platform_admin_all" ON public.harvest_lots;
|
||||
DROP POLICY IF EXISTS "harvest_lots_brand_scoped" ON public.harvest_lots;
|
||||
|
||||
CREATE POLICY "harvest_lots_platform_admin_all" ON public.harvest_lots
|
||||
FOR ALL TO authenticated
|
||||
USING (
|
||||
EXISTS (
|
||||
SELECT 1 FROM public.admin_users au
|
||||
WHERE au.user_id = auth.uid()
|
||||
AND au.role = 'platform_admin'
|
||||
AND au.active = true
|
||||
)
|
||||
)
|
||||
WITH CHECK (
|
||||
EXISTS (
|
||||
SELECT 1 FROM public.admin_users au
|
||||
WHERE au.user_id = auth.uid()
|
||||
AND au.role = 'platform_admin'
|
||||
AND au.active = true
|
||||
)
|
||||
);
|
||||
|
||||
CREATE POLICY "harvest_lots_brand_scoped" ON public.harvest_lots
|
||||
FOR ALL TO authenticated
|
||||
USING (
|
||||
brand_id = (
|
||||
SELECT brand_id FROM public.admin_users
|
||||
WHERE user_id = auth.uid() AND active = true
|
||||
LIMIT 1
|
||||
)
|
||||
)
|
||||
WITH CHECK (
|
||||
brand_id = (
|
||||
SELECT brand_id FROM public.admin_users
|
||||
WHERE user_id = auth.uid() AND active = true
|
||||
LIMIT 1
|
||||
)
|
||||
);
|
||||
|
||||
-- ── harvest_lot_events ────────────────────────────────────────────────────────
|
||||
|
||||
ALTER TABLE public.harvest_lot_events ENABLE ROW LEVEL SECURITY;
|
||||
|
||||
DROP POLICY IF EXISTS "harvest_lot_events_platform_admin_all" ON public.harvest_lot_events;
|
||||
DROP POLICY IF EXISTS "harvest_lot_events_brand_scoped" ON public.harvest_lot_events;
|
||||
|
||||
CREATE POLICY "harvest_lot_events_platform_admin_all" ON public.harvest_lot_events
|
||||
FOR ALL TO authenticated
|
||||
USING (
|
||||
EXISTS (
|
||||
SELECT 1 FROM public.admin_users au
|
||||
WHERE au.user_id = auth.uid()
|
||||
AND au.role = 'platform_admin'
|
||||
AND au.active = true
|
||||
)
|
||||
)
|
||||
WITH CHECK (
|
||||
EXISTS (
|
||||
SELECT 1 FROM public.admin_users au
|
||||
WHERE au.user_id = auth.uid()
|
||||
AND au.role = 'platform_admin'
|
||||
AND au.active = true
|
||||
)
|
||||
);
|
||||
|
||||
-- Events are scoped to the lot via lot_id, so we check the lot's brand_id
|
||||
CREATE POLICY "harvest_lot_events_brand_scoped" ON public.harvest_lot_events
|
||||
FOR ALL TO authenticated
|
||||
USING (
|
||||
lot_id IN (
|
||||
SELECT hl.id FROM public.harvest_lots hl
|
||||
WHERE hl.brand_id = (
|
||||
SELECT brand_id FROM public.admin_users
|
||||
WHERE user_id = auth.uid() AND active = true
|
||||
LIMIT 1
|
||||
)
|
||||
)
|
||||
)
|
||||
WITH CHECK (
|
||||
lot_id IN (
|
||||
SELECT hl.id FROM public.harvest_lots hl
|
||||
WHERE hl.brand_id = (
|
||||
SELECT brand_id FROM public.admin_users
|
||||
WHERE user_id = auth.uid() AND active = true
|
||||
LIMIT 1
|
||||
)
|
||||
)
|
||||
);
|
||||
|
||||
COMMIT;
|
||||
Reference in New Issue
Block a user