fix(security): RLS for DocumentDraft and DocumentAttestation - #384
Open
QSchlegel wants to merge 1 commit into
Open
fix(security): RLS for DocumentDraft and DocumentAttestation#384QSchlegel wants to merge 1 commit into
QSchlegel wants to merge 1 commit into
Conversation
Every other table in this schema gets Row Level Security in the migration
that creates it — 20251215090000_enable_rls_disable_postgrest, its
follow-up 20260706100000_enable_rls_followup_tables, and the per-table
blocks in 20260805090000_add_document_signoff and
20260813000000_add_proxy_member. I added these two tables without it.
Verified against a throwaway Postgres with the `anon` and `authenticated`
roles present so both branches of the migration actually run:
with this migration every table reports relrowsecurity = true,
and four deny-all policies exist for the two
without it DocumentDraft and DocumentAttestation are the
ONLY two tables in the schema with RLS off
This deployment is Supabase-backed, where RLS off plus the PostgREST roles
is what stands between a table and the anon key. It matters more for these
two than for most: DocumentDraft is the one table in the document stack
that holds document BODIES rather than hashes, and DocumentAttestation
holds the signed notary chain.
Written as a follow-up rather than by editing those two migrations. Both
are merged but applied nowhere, so editing them would work today — and
would fail with a checksum error against any environment that had already
applied them, and this repo ships migrations through an action that does
not self-retry, so one failed deploy blocks every later migration too. The
follow-up is correct under either state.
No schema change: RLS is not modelled by Prisma, so prisma/schema.prisma
is untouched and there is no drift.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every other table in this schema gets Row Level Security in the migration that creates it —
20251215090000_enable_rls_disable_postgrest, its follow-up20260706100000_enable_rls_followup_tables, and the per-table blocks in20260805090000_add_document_signoffand20260813000000_add_proxy_member.I added these two tables without it.
Verified, both directions
Against a throwaway Postgres with the
anonandauthenticatedroles created first, so both branches of the migration actually execute:relrowsecurity = true, and four deny-all policies exist for the two tablesDocumentDraftandDocumentAttestationare the only two tables in the schema with RLS offWhy it matters here
This deployment is Supabase-backed, where RLS off plus the PostgREST roles is what stands between a table and the anon key. And it matters more for these two than for most:
DocumentDraftis the one table in the document stack that holds document bodies rather than hashes, andDocumentAttestationholds the signed notary chain.Why a follow-up rather than editing those migrations
Both are merged but applied nowhere, so editing them would work today. It would fail with a checksum error against any environment that had already applied them — and this repo ships migrations through an action that does not self-retry, so one failed deploy blocks every later migration too. The follow-up is correct under either state.
No schema change: RLS is not modelled by Prisma, so
prisma/schema.prismais untouched and there is no drift.🤖 Generated with Claude Code