Move Payload tables to private schema

[hakalb]

Summary

Security improvement — moves all Payload CMS tables out of the Supabase public schema so they are no longer exposed via PostgREST. Schema name is now environment-driven via DATABASE_SCHEMA in Infisical.

⚠️ Remember to add DATABASE_SCHEMA=payload in Infisical under /apps/cms/ before deploying.

Closes COD-374

🤖 Generated with Claude Code

[bolt-new-by-stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 42f41e4

Command	Status	Duration	Result
nx e2e nx-payload-e2e -c skip-docker	✅ Succeeded	6m 45s	View ↗
nx affected -t integration-test -c ci	✅ Succeeded	<1s	View ↗
nx affected -t e2e -c ci --exclude nx-payload-e2e	✅ Succeeded	<1s	View ↗
nx affected -t lint,test,build -c ci	✅ Succeeded	4m 8s	View ↗
nx-cloud record -- nx format:check	✅ Succeeded	8s	View ↗

---

☁️ Nx Cloud last updated this comment at 2026-04-04 15:40:31 UTC

[Copilot]

Pull request overview

Security-focused change to support moving Payload CMS tables out of Supabase public schema by making the DB schema configurable via an environment variable.

Changes:

• Added DATABASE_SCHEMA to the CMS environment schema.
• Passed DATABASE_SCHEMA through to Payload’s Postgres adapter via schemaName.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
libs/app-cms/util/env-schema/src/lib/env.schema.ts	Introduces DATABASE_SCHEMA env var for selecting the schema for Payload tables.
apps/cms/src/payload.config.ts	Configures Payload’s Postgres adapter to use schemaName from DATABASE_SCHEMA.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codeware-actions]

✨ Your pull request projects are ready for preview

Project	App name	Preview
cms (_default)	cdwr-cms-pr-413	https://cdwr-cms-pr-413.fly.dev
cms (demo)	cdwr-cms-pr-413-demo	https://cdwr-cms-pr-413-demo.fly.dev

[sentry]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (df8191b) to head (42f41e4).

Additional details and impacted files

@@             Coverage Diff              @@
##             main      #413       +/-   ##
============================================
+ Coverage   72.77%   100.00%   +27.22%     
============================================
  Files          84         5       -79     
  Lines        3816        26     -3790     
  Branches      406         5      -401     
============================================
- Hits         2777        26     -2751     
+ Misses       1034         0     -1034     
+ Partials        5         0        -5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.