fix(db): make legacy Data API grants explicit by Programcode · Pull Request #70 · Programcode/DebateOwl

Programcode · 2026-09-25T07:02:58Z

Summary

Make Data API grants explicit for legacy public tables and the keepalive sequence before Supabase changes its default permissions.
Preserve production's role-specific access. Authenticated users keep their own ai_requests read for the daily usage count; global_prompts stays server-only.
Document explicit grants for future table-creation migrations.

Exact-head verification (`1b074b7`)

npm run verify: 1,034 unit tests and 226 desktop/mobile browser tests passed; six configured browser skips. Lint, typecheck, Edge tests, build, and service-worker smoke also passed.
./.superset/db-gate.sh: fresh migration replay, 305 pgTAP assertions, and 51 real-Auth desktop/mobile journeys passed; one configured skip. The local stack stopped afterward.
LIVE_PROVIDERS=1 ./.superset/db-gate.sh: all eight live OpenRouter, Jev, and Exa journeys passed locally. The local stack stopped afterward.
Separate PostgreSQL with no automatic role grants: authenticated ai_requests SELECT changed from false to true, anonymous ai_requests SELECT stayed false, and both client roles remained denied on global_prompts.
Production read-only comparison: all 138 intended table privileges and both sequence privileges already exist. supabase db push --dry-run --skip-vault listed exactly this one pending migration.
GitHub Actions jobs did not start because GitHub rejected them for a billing or spending-limit issue. The local commands above replace those unavailable jobs. Greptile reviewed this head with zero new findings; CodeRabbit was rate-limited.

Rollback

The production migration should not change existing ACLs. A pre-migration snapshot of public table and sequence ACLs is retained locally for comparison. If a privilege differs unexpectedly, use a scoped forward migration after checking that snapshot.

vercel · 2026-09-25T07:03:04Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
debate-navigator	Ready	Preview	Sep 25, 2026 7:49am UTC

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

coderabbitai · 2026-09-25T07:18:23Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Warning

Review limit reached

Next included review available in 18 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: 7d1e23ed-e8a5-4683-aec4-364cfdd989d8

📥 Commits

Reviewing files that changed from the base of the PR and between 7db0dc2 and 1b074b7.

📒 Files selected for processing (2)

supabase/migrations/20260923191320_explicit_legacy_table_grants.sql
supabase/tests/legacy_table_grants_test.sql

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: 88e05435-2188-49ca-a625-4a08bf76a029

📥 Commits

Reviewing files that changed from the base of the PR and between 74d11eb and 7db0dc2.

📒 Files selected for processing (3)

supabase/README.md
supabase/migrations/20260923191320_explicit_legacy_table_grants.sql
supabase/tests/legacy_table_grants_test.sql

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

The change documents explicit Data API grants for new public tables, adds grants for legacy tables and a sequence, and adds a pgTAP test for selected privileges.

Changes

Legacy table grants

Layer / File(s)	Summary
Grant migration and validation `supabase/README.md`, `supabase/migrations/20260923191320_explicit_legacy_table_grants.sql`, `supabase/tests/legacy_table_grants_test.sql`	The README says to grant only required roles and operations in the migration that sets up RLS. The migration grants specified table privileges to `service_role` and `authenticated`, grants SELECT on `global_prompts` to `anon` and `authenticated`, and grants sequence usage to `anon` and `service_role`. The pgTAP test checks selected table, column, and sequence privileges.

Estimated code review effort: 2 (Simple) | ~10 minutes

Architecture Summary

Architecture risk: 🔵 Low · up to 7db0d

The change affects 1 system.

Changed systems: supabase

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

observed — supabase (service) was modified; 3 changed files map to changed impact.

Before / after behavior

observed — Modified behavior in supabase/README.md: Adds guidance to grant only required Data API roles and operations when creating a public table, in the same migration as its RLS and policies; notes that fresh projects and resets cannot rely on automatic table or sequence grants.
observed — Modified behavior in supabase/migrations/20260923191320_explicit_legacy_table_grants.sql: Adds comments describing the grants and grants service_role SELECT, INSERT, UPDATE, and DELETE on the listed public tables.
observed — Modified behavior in supabase/migrations/20260923191320_explicit_legacy_table_grants.sql: Grants authenticated SELECT, INSERT, UPDATE, and DELETE on the listed cases, attacks, brainstorms, factoids, chats, messages, sources, source files, API keys, flowcharts, and source folders tables.
observed — Modified behavior in supabase/migrations/20260923191320_explicit_legacy_table_grants.sql: Grants authenticated SELECT on user roles, rate limits, subscriptions, user promos, and admin grants.

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}

Programcode · 2026-09-25T07:40:04Z

@coderabbitai review

coderabbitai · 2026-09-25T07:40:12Z

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Programcode · 2026-09-25T08:00:05Z

@coderabbitai review

coderabbitai · 2026-09-25T08:00:14Z

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

fix(db): make legacy Data API grants explicit

7db0dc2

Copilot AI lite review requested due to automatic review settings September 25, 2026 07:02

Copilot AI reviewed Sep 25, 2026

vercel Bot deployed to Preview September 25, 2026 07:03

View deployment

greptile-apps Bot reviewed Sep 25, 2026

View reviewed changes

Comment thread supabase/migrations/20260923191320_explicit_legacy_table_grants.sql Resolved

This comment has been minimized.

Sign in to view

fix(db): grant signed-in users usage reads

4899759

vercel Bot deployed to Preview September 25, 2026 07:24

View deployment

fix(db): preserve server-only global prompts

1b074b7

vercel Bot deployed to Preview September 25, 2026 07:49

View deployment

Programcode merged commit ff64d57 into main Sep 25, 2026
7 of 10 checks passed

Navigation Menu

Repository navigation

fix(db): make legacy Data API grants explicit - #70

fix(db): make legacy Data API grants explicit#70
Programcode merged 3 commits into
mainfrom
codex/supabase-explicit-grants

Programcode commented Sep 25, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Sep 25, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

This comment has been minimized.

coderabbitai Bot commented Sep 25, 2026 •

edited

Loading

Review limit reached

Walkthrough

Changes

Uh oh!

Programcode commented Sep 25, 2026

Uh oh!

coderabbitai Bot commented Sep 25, 2026 •

edited

Loading

Uh oh!

Programcode commented Sep 25, 2026

Uh oh!

coderabbitai Bot commented Sep 25, 2026 •

edited

Loading

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Programcode commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Exact-head verification (1b074b7)

Rollback

Uh oh!

vercel Bot commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment has been minimized.

coderabbitai Bot commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Architecture Summary

Uh oh!

Programcode commented Sep 25, 2026

Uh oh!

coderabbitai Bot commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Programcode commented Sep 25, 2026

Uh oh!

coderabbitai Bot commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Programcode commented Sep 25, 2026 •

edited

Loading

Exact-head verification (`1b074b7`)

vercel Bot commented Sep 25, 2026 •

edited

Loading

coderabbitai Bot commented Sep 25, 2026 •

edited

Loading

coderabbitai Bot commented Sep 25, 2026 •

edited

Loading

coderabbitai Bot commented Sep 25, 2026 •

edited

Loading