Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: enable rls & update grants for auth tables #1617

Merged
merged 1 commit into from
Jun 12, 2024
Merged

fix: enable rls & update grants for auth tables #1617

merged 1 commit into from
Jun 12, 2024

Conversation

kangmingtay
Copy link
Member

What kind of change does this PR introduce?

  • Previously, users need to grant these permissions to create views with RLS for tables in the auth schema.

  • This also unblocks our efforts to revoke supabase_auth_admin membership from postgres to prevent cases where the auth.schema_migrations table is accidentally truncated by the user - causing migrations to be rerun unnecessarily.

  • Bug fix, feature, docs update, ...

What is the current behavior?

Please link any relevant issues here.

What is the new behavior?

Feel free to include screenshots if it includes visual changes.

Additional context

Add any other context or screenshots.

@kangmingtay kangmingtay requested a review from a team as a code owner June 12, 2024 06:15
@kangmingtay kangmingtay changed the title fix: enable rls & update grants for auth tables [GEN-8871] fix: enable rls & update grants for auth tables Jun 12, 2024
@coveralls
Copy link

coveralls commented Jun 12, 2024 •
edited
Loading

Pull Request Test Coverage Report for Build 9477659610

Details

  • 0 of 0 changed or added relevant lines in 0 files are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage remained the same at 57.589%
Totals Coverage Status
Change from base Build 9416552113: 0.0%
Covered Lines: 8507
Relevant Lines: 14772
💛 - Coveralls

J0
J0 approved these changes Jun 12, 2024
View reviewed changes
Copy link
Contributor

@J0 J0 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

For historical context, at point of commit:

  • We had substantial number of rogue modifications to table permissions via Prisma or improvidence
  • postgres had a grant all to Auth tables, but it couldn't in turn grant these privileges to API roles as it was not the table owner. At point of time when this commit was made, the grants for the internal API were done without with grant option

J0
J0 approved these changes Jun 12, 2024
View reviewed changes
Copy link
Contributor

@J0 J0 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

For historical context, at point of commit:

  • We had substantial number of rogue modifications to table permissions via Prisma or improvidence
  • postgres had a grant all to Auth tables, but it couldn't in turn grant these privileges to API roles as it was not the table owner. At point of time when this commit was made, the grants for the internal API were done without with grant option

@coveralls
Copy link

coveralls commented Jun 12, 2024 •
edited
Loading

Pull Request Test Coverage Report for Build 9487534139

Warning: This coverage report may be inaccurate.

This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

Details

  • 0 of 0 changed or added relevant lines in 0 files are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage remained the same at 57.657%
Totals Coverage Status
Change from base Build 9483902934: 0.0%
Covered Lines: 8626
Relevant Lines: 14961
💛 - Coveralls

@kangmingtay kangmingtay merged commit 28967aa into master Jun 12, 2024
2 checks passed
@kangmingtay kangmingtay deleted the km/fix-enable-rls branch June 12, 2024 18:14
@github-actions github-actions bot mentioned this pull request Jun 12, 2024
Merged
J0 pushed a commit that referenced this pull request Jun 14, 2024
@github-actions
chore(master): release 2.154.0 (#1610)
3cd00ee 
🤖 I have created a release *beep* *boop*
---


##
[2.154.0](v2.153.0...v2.154.0)
(2024-06-12)


### Features

* add max length check for email
([#1508](#1508))
([f9c13c0](f9c13c0))
* add support for Slack OAuth V2
([#1591](#1591))
([bb99251](bb99251))
* encrypt sensitive columns
([#1593](#1593))
([e4a4758](e4a4758))
* upgrade otel to v1.26
([#1585](#1585))
([cdd13ad](cdd13ad))
* use largest avatar from spotify instead
([#1210](#1210))
([4f9994b](4f9994b)),
closes [#1209](#1209)


### Bug Fixes

* define search path in auth functions
([#1616](#1616))
([357bda2](357bda2))
* enable rls & update grants for auth tables
([#1617](#1617))
([28967aa](28967aa))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
uxodb pushed a commit to uxodb/auth that referenced this pull request Nov 13, 2024
@kangmingtay
fix: enable rls & update grants for auth tables (supabase#1617)
5608eb4 
## What kind of change does this PR introduce?
* Previously, users need to grant [these
permissions](https://supabase.com/docs/guides/database/database-advisors?lint=0002_auth_users_exposed#security-invoker-view-with-rls-on-authusers)
to create views with RLS for tables in the auth schema.
* This also unblocks our efforts to revoke `supabase_auth_admin`
membership from `postgres` to prevent cases where the
`auth.schema_migrations` table is accidentally truncated by the user -
causing migrations to be rerun unnecessarily.

* Bug fix, feature, docs update, ...

## What is the current behavior?

Please link any relevant issues here.

## What is the new behavior?

Feel free to include screenshots if it includes visual changes.

## Additional context

Add any other context or screenshots.
uxodb pushed a commit to uxodb/auth that referenced this pull request Nov 13, 2024
@github-actions
chore(master): release 2.154.0 (supabase#1610)
65fdd02 
🤖 I have created a release *beep* *boop*
---


##
[2.154.0](supabase/auth@v2.153.0...v2.154.0)
(2024-06-12)


### Features

* add max length check for email
([supabase#1508](supabase#1508))
([f9c13c0](supabase@f9c13c0))
* add support for Slack OAuth V2
([supabase#1591](supabase#1591))
([bb99251](supabase@bb99251))
* encrypt sensitive columns
([supabase#1593](supabase#1593))
([e4a4758](supabase@e4a4758))
* upgrade otel to v1.26
([supabase#1585](supabase#1585))
([cdd13ad](supabase@cdd13ad))
* use largest avatar from spotify instead
([supabase#1210](supabase#1210))
([4f9994b](supabase@4f9994b)),
closes [supabase#1209](supabase#1209)


### Bug Fixes

* define search path in auth functions
([supabase#1616](supabase#1616))
([357bda2](supabase@357bda2))
* enable rls & update grants for auth tables
([supabase#1617](supabase#1617))
([28967aa](supabase@28967aa))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
LashaJini pushed a commit to LashaJini/auth that referenced this pull request Nov 13, 2024
@kangmingtay @LashaJini
fix: enable rls & update grants for auth tables (supabase#1617)
01080b9 
## What kind of change does this PR introduce?
* Previously, users need to grant [these
permissions](https://supabase.com/docs/guides/database/database-advisors?lint=0002_auth_users_exposed#security-invoker-view-with-rls-on-authusers)
to create views with RLS for tables in the auth schema.
* This also unblocks our efforts to revoke `supabase_auth_admin`
membership from `postgres` to prevent cases where the
`auth.schema_migrations` table is accidentally truncated by the user -
causing migrations to be rerun unnecessarily.

* Bug fix, feature, docs update, ...

## What is the current behavior?

Please link any relevant issues here.

## What is the new behavior?

Feel free to include screenshots if it includes visual changes.

## Additional context

Add any other context or screenshots.
LashaJini pushed a commit to LashaJini/auth that referenced this pull request Nov 13, 2024
@github-actions @LashaJini
chore(master): release 2.154.0 (supabase#1610)
9dbbed6 
🤖 I have created a release *beep* *boop*
---


##
[2.154.0](supabase/auth@v2.153.0...v2.154.0)
(2024-06-12)


### Features

* add max length check for email
([supabase#1508](supabase#1508))
([f9c13c0](supabase@f9c13c0))
* add support for Slack OAuth V2
([supabase#1591](supabase#1591))
([bb99251](supabase@bb99251))
* encrypt sensitive columns
([supabase#1593](supabase#1593))
([e4a4758](supabase@e4a4758))
* upgrade otel to v1.26
([supabase#1585](supabase#1585))
([cdd13ad](supabase@cdd13ad))
* use largest avatar from spotify instead
([supabase#1210](supabase#1210))
([4f9994b](supabase@4f9994b)),
closes [supabase#1209](supabase#1209)


### Bug Fixes

* define search path in auth functions
([supabase#1616](supabase#1616))
([357bda2](supabase@357bda2))
* enable rls & update grants for auth tables
([supabase#1617](supabase#1617))
([28967aa](supabase@28967aa))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
LashaJini pushed a commit to LashaJini/auth that referenced this pull request Nov 15, 2024
@kangmingtay @LashaJini
fix: enable rls & update grants for auth tables (supabase#1617)
fe4e757 
## What kind of change does this PR introduce?
* Previously, users need to grant [these
permissions](https://supabase.com/docs/guides/database/database-advisors?lint=0002_auth_users_exposed#security-invoker-view-with-rls-on-authusers)
to create views with RLS for tables in the auth schema.
* This also unblocks our efforts to revoke `supabase_auth_admin`
membership from `postgres` to prevent cases where the
`auth.schema_migrations` table is accidentally truncated by the user -
causing migrations to be rerun unnecessarily.

* Bug fix, feature, docs update, ...

## What is the current behavior?

Please link any relevant issues here.

## What is the new behavior?

Feel free to include screenshots if it includes visual changes.

## Additional context

Add any other context or screenshots.
LashaJini pushed a commit to LashaJini/auth that referenced this pull request Nov 15, 2024
@github-actions @LashaJini
chore(master): release 2.154.0 (supabase#1610)
bb3cff5 
🤖 I have created a release *beep* *boop*
---


##
[2.154.0](supabase/auth@v2.153.0...v2.154.0)
(2024-06-12)


### Features

* add max length check for email
([supabase#1508](supabase#1508))
([f9c13c0](supabase@f9c13c0))
* add support for Slack OAuth V2
([supabase#1591](supabase#1591))
([bb99251](supabase@bb99251))
* encrypt sensitive columns
([supabase#1593](supabase#1593))
([e4a4758](supabase@e4a4758))
* upgrade otel to v1.26
([supabase#1585](supabase#1585))
([cdd13ad](supabase@cdd13ad))
* use largest avatar from spotify instead
([supabase#1210](supabase#1210))
([4f9994b](supabase@4f9994b)),
closes [supabase#1209](supabase#1209)


### Bug Fixes

* define search path in auth functions
([supabase#1616](supabase#1616))
([357bda2](supabase@357bda2))
* enable rls & update grants for auth tables
([supabase#1617](supabase#1617))
([28967aa](supabase@28967aa))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@J0 J0 J0 approved these changes

@hf hf hf approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@kangmingtay @coveralls @hf @J0