Phase 128: Code validation, scaffold enrichment, and chat UX collapse

src/Sovrant.Runtime/Storage/PostgresSchema.sql → db/postgres/PostgresSchema.sql

@@ -1,5 +1,6 @@
--- Sovrant PostgreSQL schema (Supabase-compatible).
--- Mirrors V001–V042 SQLite migrations. Safe to run multiple times (idempotent).
+-- Sovrant standalone PostgreSQL schema.
+-- Mirrors V001–V043 SQLite migrations. Safe to run multiple times (idempotent).
+-- For Supabase deployments use supabase/migrations/ instead (includes GoTrue auth triggers).
 -- Timestamps are stored as TEXT (ISO 8601) for wire-compatibility with SQLite stores.
 -- BYTEA used for encrypted blobs (credentials table).
 -- V035/V037 (built-in knowledge seed data) are handled by the app at startup, not here.
@@ -11,16 +12,14 @@
 
 CREATE TABLE IF NOT EXISTS users (
     user_id       TEXT PRIMARY KEY,
-    username      TEXT NOT NULL,
     email         TEXT,
     role          TEXT NOT NULL DEFAULT 'user',
     team          TEXT,
     status        TEXT NOT NULL DEFAULT 'active',
     password_hash TEXT,
     created_at    TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
     updated_at    TEXT NOT NULL DEFAULT (to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')),
-    CONSTRAINT users_username_unique UNIQUE (username),
-    CONSTRAINT users_email_unique    UNIQUE (email)
+    CONSTRAINT users_email_unique UNIQUE (email)
 );
 
 CREATE TABLE IF NOT EXISTS workspaces (
@@ -759,9 +758,13 @@ CREATE INDEX IF NOT EXISTS ix_session_summaries_owner ON session_summaries(owner
 CREATE INDEX IF NOT EXISTS ix_learned_patterns_owner  ON learned_patterns(owner_user_id);
 CREATE INDEX IF NOT EXISTS ix_instincts_owner         ON instincts(owner_user_id);
 
+-- ── V043 Drop username column ─────────────────────────────────────────────────
+-- For instances initialized before V043. Fresh installs never had this column.
+-- V043's PK rewrite (usr_{hex} → email) applies to SQLite standalone only.
+
+ALTER TABLE public.users DROP COLUMN IF EXISTS username;
+
 -- ── Schema version tracking ───────────────────────────────────────────────────
--- Records the last successfully applied schema version so the admin UI
--- can show "Up to date" vs "Needs initialization".
 
 CREATE TABLE IF NOT EXISTS sovrant_schema_version (
     id          INTEGER PRIMARY KEY DEFAULT 1,
@@ -771,127 +774,5 @@ CREATE TABLE IF NOT EXISTS sovrant_schema_version (
 );
 
 INSERT INTO sovrant_schema_version (id, version)
-VALUES (1, 42)
+VALUES (1, 43)
 ON CONFLICT (id) DO UPDATE SET version = EXCLUDED.version, applied_at = EXCLUDED.applied_at;
-
--- ════════════════════════════════════════════════════════════════════════════════
--- SUPABASE AUTH EXTENSION
--- Run this section ONLY on Supabase-hosted deployments, AFTER the schema above.
--- Standalone PostgreSQL deployments skip this entire section.
---
--- Why: Supabase Auth stores identities in auth.users (UUID PK, managed by GoTrue).
--- The app uses public.users (TEXT PK) as the FK anchor for all domain tables.
--- These triggers keep public.users in sync automatically so every FK constraint
--- continues to work without any application code changes.
---
--- user_id = auth.users.id::TEXT — UUID string, compatible with TEXT PK on all
--- existing FK columns (workspaces, workspace_members, api_tokens, user_roles,
--- project_members, password_reset_tokens).
--- ════════════════════════════════════════════════════════════════════════════════
-
--- ── Mirror trigger: auth.users INSERT → public.users INSERT ──────────────────
-
-CREATE OR REPLACE FUNCTION public.handle_auth_user_created()
-RETURNS TRIGGER LANGUAGE plpgsql SECURITY DEFINER SET search_path = public AS $$
-DECLARE
-    _role TEXT;
-BEGIN
-    -- Read sovrant_role from app_metadata (service-role only, user cannot self-set).
-    -- Whitelist: only 'admin' is elevated; anything else (missing, null, unknown) → 'user'.
-    _role := CASE
-        WHEN NEW.raw_app_meta_data->>'sovrant_role' = 'admin' THEN 'admin'
-        ELSE 'user'
-    END;
-
-    INSERT INTO public.users (user_id, username, email, role, status, created_at, updated_at)
-    VALUES (
-        NEW.id::TEXT,
-        COALESCE(NEW.raw_user_meta_data->>'username', split_part(NEW.email, '@', 1)),
-        NEW.email,
-        _role,
-        'active',
-        to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'),
-        to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')
-    )
-    ON CONFLICT (user_id) DO NOTHING;
-    RETURN NEW;
-END;
-$$;
-
-CREATE OR REPLACE TRIGGER on_auth_user_created
-    AFTER INSERT ON auth.users
-    FOR EACH ROW EXECUTE FUNCTION public.handle_auth_user_created();
-
--- ── Mirror trigger: auth.users email/role UPDATE → public.users UPDATE ───────
--- Fires on email changes AND raw_app_meta_data changes so that setting
--- sovrant_role in app_metadata immediately syncs to public.users.role.
-
-CREATE OR REPLACE FUNCTION public.handle_auth_user_updated()
-RETURNS TRIGGER LANGUAGE plpgsql SECURITY DEFINER SET search_path = public AS $$
-DECLARE
-    _role TEXT;
-BEGIN
-    IF NEW.raw_app_meta_data IS DISTINCT FROM OLD.raw_app_meta_data THEN
-        _role := CASE
-            WHEN NEW.raw_app_meta_data->>'sovrant_role' = 'admin' THEN 'admin'
-            ELSE 'user'
-        END;
-        UPDATE public.users
-        SET    email      = NEW.email,
-               role       = _role,
-               updated_at = to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')
-        WHERE  user_id = NEW.id::TEXT;
-    ELSE
-        UPDATE public.users
-        SET    email      = NEW.email,
-               updated_at = to_char(NOW() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"')
-        WHERE  user_id = NEW.id::TEXT;
-    END IF;
-    RETURN NEW;
-END;
-$$;
-
-CREATE OR REPLACE TRIGGER on_auth_user_updated
-    AFTER UPDATE OF email, raw_app_meta_data ON auth.users
-    FOR EACH ROW EXECUTE FUNCTION public.handle_auth_user_updated();
-
--- ── Notes for Supabase deployments ───────────────────────────────────────────
--- • public.users.password_hash is always NULL for Supabase-authenticated users.
---   GoTrue owns password management; the column is inert and kept for schema
---   parity with SQLite / standalone Postgres deployments.
--- • password_reset_tokens is also inert — Supabase handles password resets.
---   The table is retained so the schema remains identical across all modes.
--- • svt_* api_tokens still work for CLI / headless API access in Supabase mode.
---   Only interactive UI sessions use JWTs; machine tokens use the token table.
--- • First admin: create the user in the Supabase dashboard (Auth → Users).
---   The mirror trigger fires automatically (role defaults to 'user'). Elevate to
---   admin by setting sovrant_role in app_metadata (service-role only):
---     UPDATE auth.users
---     SET    raw_app_meta_data = jsonb_set(
---                COALESCE(raw_app_meta_data, '{}'), '{sovrant_role}', '"admin"')
---     WHERE  email = 'you@example.com';
---   The on_auth_user_updated trigger fires and syncs role = 'admin' to
---   public.users automatically. Never UPDATE public.users.role directly.
-
--- ── Row-Level Security (recommended for Supabase deployments) ────────────────
--- Uncomment to enforce the owner_user_id privacy model at the database layer
--- rather than relying solely on application-layer query filters. Required if
--- any Supabase Edge Functions, dashboard queries, or service-role clients need
--- to respect per-user memory privacy without going through the Sovrant API.
-
--- ALTER TABLE workspace_memory  ENABLE ROW LEVEL SECURITY;
--- ALTER TABLE session_summaries ENABLE ROW LEVEL SECURITY;
--- ALTER TABLE learned_patterns  ENABLE ROW LEVEL SECURITY;
--- ALTER TABLE instincts         ENABLE ROW LEVEL SECURITY;
-
--- CREATE POLICY workspace_memory_owner ON workspace_memory
---     USING (is_private = 0 OR owner_user_id = auth.uid()::text);
-
--- CREATE POLICY session_summaries_owner ON session_summaries
---     USING (owner_user_id = '' OR owner_user_id = auth.uid()::text);
-
--- CREATE POLICY learned_patterns_owner ON learned_patterns
---     USING (owner_user_id = '' OR owner_user_id = auth.uid()::text);
-
--- CREATE POLICY instincts_owner ON instincts
---     USING (owner_user_id = '' OR owner_user_id = auth.uid()::text);

db/supabase/config.toml

@@ -0,0 +1,40 @@
+# Supabase CLI project configuration.
+# Run migrations from this directory: cd db/supabase && supabase db push
+# Or link to a remote project:        supabase link --project-ref <ref>
+
+[api]
+enabled = true
+port = 54321
+schemas = ["public", "storage", "graphql_public"]
+extra_search_path = ["public", "extensions"]
+max_rows = 1000
+
+[db]
+port = 54322
+shadow_port = 54320
+major_version = 15
+
+[studio]
+enabled = true
+port = 54323
+
+[inbucket]
+enabled = true
+port = 54324
+
+[storage]
+enabled = true
+
+[auth]
+enabled = true
+# Sovrant uses public.users as the domain anchor.
+# The GoTrue auth.users mirror triggers are in the initial migration.
+site_url = "http://localhost:5100"
+additional_redirect_urls = ["http://localhost:5100"]
+jwt_expiry = 3600
+enable_signup = true
+
+[auth.email]
+enable_signup = true
+double_confirm_changes = true
+enable_confirmations = false