ENG-1951 Tighten table access control#1157
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Updates to Preview Branch (eng-1951-tighten-table-access-control) ↗︎
Tasks are run on every commit but only new migration files are pushed.
View logs for this Workflow Run ↗︎. |
PR size/scope checkThis PR is over our review-size guideline.
Please split this into smaller PRs unless there is a clear reason the changes need to land together. If keeping it as one PR, please add a brief justification covering:
|
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| WHEN target_type = 'Space' THEN public.in_space(target_id, 'editor') | ||
| WHEN target_type = 'Content' THEN public.content_in_space(target_id, 'editor') | ||
| WHEN target_type = 'Concept' THEN public.concept_in_space(target_id, 'editor') | ||
| WHEN target_type = 'Document' THEN public.document_in_space(target_id, 'editor') | ||
| WHEN target_type = 'PlatformAccount' THEN public.account_in_shared_space(target_id, 'editor') | ||
| ELSE false | ||
| END; | ||
| $$; |
There was a problem hiding this comment.
🚩 sync_info policy now requires editor access for SELECT due to generic_entity_access change
The sync_info_policy at packages/database/supabase/schemas/sync.sql:311 uses FOR ALL USING (public.generic_entity_access(sync_target, target_type)). Since generic_entity_access was changed from defaulting to 'reader' checks to explicitly passing 'editor' (packages/database/supabase/schemas/sync.sql:294-298), SELECT on sync_info now requires editor access. Every other table in this PR was given separate policies for SELECT (reader) vs write (editor), but sync_info was not refactored — its FOR ALL policy implicitly inherited the tighter requirement. This means readers can no longer view sync status. The old behavior (readers could INSERT/UPDATE/DELETE sync_info) was clearly wrong, but losing SELECT visibility for readers may be unintentional.
Was this helpful? React with 👍 or 👎 to provide feedback.
There was a problem hiding this comment.
I think it's natural for sync to require editor access.
2 participants
https://linear.app/discourse-graphs/issue/ENG-1951/tighten-table-access-control
https://www.loom.com/share/d1755b3bbc8a4197a293f431db373a84
Tightened access controls so group membership does not normally allow cross-space edits. Also added tests.