feat(branding): add global dynamic theme system and fix 2fa mail

shop/supabase/migrations/20260709231000_secure_user_roles.sql

@@ -1,30 +1,63 @@
 -- Migration: Secure User Roles from Self-Escalation
--- Purpose: Prevent users from updating their own roles to 'admin' using RLS / Triggers.
+-- Purpose: Prevent users from updating their own roles to 'admin' using RLS / Triggers, while granting full access to service_role.
+
+-- Create helper function to check admin role bypassing RLS (SECURITY DEFINER)
+CREATE OR REPLACE FUNCTION public.is_admin(user_id UUID)
+RETURNS BOOLEAN AS $$
+BEGIN
+    RETURN EXISTS (
+        SELECT 1 FROM public.users
+        WHERE id = user_id AND role = 'admin'
+    );
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER;
 
--- Ensure RLS is enabled on users
 ALTER TABLE public.users ENABLE ROW LEVEL SECURITY;
 
+-- Grant privileges to PostgREST roles
+GRANT ALL ON TABLE public.users TO service_role;
+GRANT ALL ON TABLE public.users TO authenticated;
+GRANT SELECT ON TABLE public.users TO anon;
+GRANT ALL ON TABLE public.users TO postgres;
+
+-- Service role policy
+DROP POLICY IF EXISTS "service_role_all_users" ON public.users;
+CREATE POLICY "service_role_all_users" ON public.users
+    FOR ALL
+    TO service_role
+    USING (true)
+    WITH CHECK (true);
+
 -- Policy to allow users to view their own records
+DROP POLICY IF EXISTS select_own_user ON public.users;
 CREATE POLICY select_own_user ON public.users
     FOR SELECT
     TO authenticated
     USING (auth.uid() = id);
 
 -- Policy to allow admins to view all users
+DROP POLICY IF EXISTS select_all_users_for_admin ON public.users;
 CREATE POLICY select_all_users_for_admin ON public.users
     FOR SELECT
     TO authenticated
-    USING (
-        (SELECT role FROM public.users WHERE id = auth.uid()) = 'admin'
-    );
+    USING (public.is_admin(auth.uid()));
+
+-- Policy to allow admins to update users
+DROP POLICY IF EXISTS update_users_for_admin ON public.users;
+CREATE POLICY update_users_for_admin ON public.users
+    FOR UPDATE
+    TO authenticated
+    USING (public.is_admin(auth.uid()))
+    WITH CHECK (public.is_admin(auth.uid()));
 
 -- Trigger to prevent any role updates to 'admin' from unauthorized users
 CREATE OR REPLACE FUNCTION check_user_role_escalation()
 RETURNS TRIGGER AS $$
 BEGIN
-    -- Only allow changes to the role column if executed by the service_role
+    -- Allow changes to the role column if executed by administrative DB roles or service_role JWT
     IF (TG_OP = 'UPDATE' AND OLD.role IS DISTINCT FROM NEW.role) OR (TG_OP = 'INSERT') THEN
-        IF current_setting('role', true) <> 'service_role' THEN
+        IF current_setting('request.jwt.claim.role', true) <> 'service_role' 
+           AND current_setting('role', true) NOT IN ('service_role', 'supabase_admin', 'postgres') THEN
             -- Partners cannot upgrade themselves or others to admin
             IF NEW.role = 'admin' THEN
                 RAISE EXCEPTION 'Unberechtigtes Rollen-Upgrade verweigert.';