fix: restrict the realtime schema#1993
Open
leandrocp wants to merge 22 commits into
Open
Conversation
Apply schema restrictions when supautils grants are available to avoid unintentional and unexpected changes to realtime schema that's supposed to be protected. Closes REAL-778 Closes REAL-773
This comment has been minimized.
This comment has been minimized.
leandrocp
commented
Jun 30, 2026
| begin | ||
| if not exists (select from pg_roles where rolname = 'supabase_realtime_admin') then | ||
| create user supabase_realtime_admin noinherit createrole login replication password 'postgres'; | ||
| create role supabase_realtime_admin with noinherit nologin noreplication; |
Contributor
Author
There was a problem hiding this comment.
Same as migrations.
leandrocp
commented
Jun 30, 2026
| else: (_ -> {:ignore, nil}) | ||
| end) do | ||
| value | ||
| case Cachex.fetch(__MODULE__, cache_key(name), fn _key -> |
Contributor
Author
There was a problem hiding this comment.
This change is unrelated but I found it while testing and it was small enough to include in this PR. See the tests.
leandrocp
commented
Jun 30, 2026
| execute("REVOKE ALL ON realtime.schema_migrations FROM postgres, dashboard_user, anon, authenticated, service_role") | ||
|
|
||
| execute( | ||
| "REVOKE INSERT, UPDATE, DELETE, TRUNCATE, REFERENCES, TRIGGER ON realtime.schema_migrations FROM supabase_realtime_admin" |
Contributor
Author
There was a problem hiding this comment.
SELECT is still required but it's safe.
Member
There was a problem hiding this comment.
why supabase_realtime_admin here matters?
Contributor
Author
There was a problem hiding this comment.
Checked again and it doesn't. I thought it was impacting tests but nope so I added supabase_realtime_adminto the REVOKE ALL ON realtime.schema_migrations because only supabase_admin is supposed to use that table.
leandrocp
commented
Jun 30, 2026
Contributor
Author
There was a problem hiding this comment.
These are the most important assertions. Need to double check if those changes are not too restrictive.
# Conflicts: # .github/workflows/integration_tests.yml # .github/workflows/tests.yml # test/test_helper.exs
Contributor
CRAP Score Report |
|
Coverage is 91.572% — fix/restrict-schema into main. No base build found for |
edgurgel
approved these changes
Jul 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
db_userand removesdb_user_realtime. The restriction is controlled by migrations only.use_supabase_realtime_adminRef REAL-25, REAL-527, REAL-630, REAL-631, REAL-773, REAL-778, SEC-562