harden chat thread view#46
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
There was a problem hiding this comment.
Pull request overview
Hardens the public.chat_threads_with_participants view so it evaluates underlying table RLS as the calling role (rather than the view owner) and removes anonymous access via PostgREST.
Changes:
- Recreates
public.chat_threads_with_participantswithsecurity_invoker = on. - Revokes all privileges on the view from
anon(and re-scopesauthenticated/service_roletoSELECTonly).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
dnywh
force-pushed
the
dnywh/harden-chat-thread-view
branch
from
a64a3f2 to
4bcd331
Compare
dnywh
force-pushed
the
dnywh/harden-chat-thread-view
branch
from
4bcd331 to
ec216cc
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| alter view public.listings_public_data | ||
| set (security_invoker = on); | ||
|
|
||
| alter view public.listings_private_data | ||
| set (security_invoker = on); | ||
|
|
||
| revoke all on table public.listings_public_data | ||
| from anon, authenticated, service_role; | ||
|
|
||
| revoke all on table public.listings_private_data | ||
| from anon, authenticated, service_role; | ||
|
|
||
| grant select on table public.listings_public_data | ||
| to anon, authenticated, service_role; | ||
|
|
||
| grant select on table public.listings_private_data | ||
| to authenticated, service_role; |
There was a problem hiding this comment.
This migration also changes public.listings_public_data / public.listings_private_data (sets security_invoker=on and rewrites grants), but the PR description only calls out hardening chat_threads_with_participants. Please update the PR description (or add an in-file comment) to explicitly mention these additional view hardening changes so reviewers understand the full scope and can evaluate any access-impact on listing reads.
Summary
chat_threads_with_participantswithsecurity_invoker = onso underlying table RLS applies to the caller.anon.authenticatedandservice_roleprivileges on the view toSELECT.Why
The baseline migration originally created this view as security invoker, but a later migration recreated it without that property. Because the view is owned by
postgres, that made it behave as security definer and allowed anonymous REST requests to read rows from the view.This PR should merge before #45 so the coordinate migration can keep its timestamp ordering clean.
Validation
npm run supabase:resetchat_threads_with_participantshassecurity_invoker=onanonno longer hasSELECTon the view401 permission deniednpm run check