harden chat thread view

[dnywh]

Summary

• Recreates chat_threads_with_participants with security_invoker = on so underlying table RLS applies to the caller.
• Revokes all privileges on the view from anon.
• Narrows authenticated and service_role privileges on the view to SELECT.

Why

The baseline migration originally created this view as security invoker, but a later migration recreated it without that property. Because the view is owned by postgres, that made it behave as security definer and allowed anonymous REST requests to read rows from the view.

This PR should merge before #45 so the coordinate migration can keep its timestamp ordering clean.

Validation

• npm run supabase:reset
• Confirmed local chat_threads_with_participants has security_invoker=on
• Confirmed local anon no longer has SELECT on the view
• Confirmed local REST request with the anon key returns 401 permission denied
• npm run check

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
peels	Ready	Preview, Comment	Apr 19, 2026 9:02am

[supabase]

This pull request has been ignored for the connected project mfnaqdyunuafbwukbbyr due to reaching the limit of concurrent preview branches.
Go to Project Integrations Settings ↗︎ if you wish to update this limit.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[Copilot]

Pull request overview

Hardens the public.chat_threads_with_participants view so it evaluates underlying table RLS as the calling role (rather than the view owner) and removes anonymous access via PostgREST.

Changes:

• Recreates public.chat_threads_with_participants with security_invoker = on.
• Revokes all privileges on the view from anon (and re-scopes authenticated/service_role to SELECT only).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This migration also changes public.listings_public_data / public.listings_private_data (sets security_invoker=on and rewrites grants), but the PR description only calls out hardening chat_threads_with_participants. Please update the PR description (or add an in-file comment) to explicitly mention these additional view hardening changes so reviewers understand the full scope and can evaluate any access-impact on listing reads.