Repository navigation
test(rls): pgTAP coverage for section-scoped tables - #39
Merged
Merged
Conversation
Any student could run `update users set is_developer = true` on their own row and pass requireDeveloper() in edge functions, which read names and emails of any section with the service role key. The UPDATE policy pinned role and section_id only. - Revoke INSERT/UPDATE on users from anon and authenticated; grant UPDATE back on the five columns the client writes. Enrollment and CR changes use SECURITY DEFINER RPCs and are unaffected. - Add pgTAP tests in supabase/tests: privileged columns, cross-section isolation, general-poll anonymity. - CI: new db-tests job runs `supabase start` + `supabase test db`. - CD: deploy now needs db-tests; stop cancelling an in-progress db push. - Remove the SELECT 1 placeholder RLS test. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
20260606000000 recreated the four announcement_comments policies that 20260601000000 already created, without dropping them first. Prod applied it fine, but `supabase start` on an empty DB fails with 42710 (policy already exists). Both definitions are identical, so dropping first leaves the final state unchanged; prod won't re-run this migration. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The 20260909 policy selected from public.users inside a users policy, so every client UPDATE on users fails with 42P17 (infinite recursion), the same bug 20260524105400 fixed once before. pgTAP caught it on the first real run. The column grant now makes role/section_id unwritable, so the policy only pins the row to its owner. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Adds cross-section, per-role and row-intact checks for assignments, submissions, attendance (records, sessions, session logs), acknowledgments, announcement comments and reactions, counsellor notes, feedback reports and attachments. Ports tests/integration/attachments_rls into supabase/tests so CI runs it. Known policy gaps are written as pgTAP TODO tests: they assert the secure behaviour, are reported as expected failures, and start passing once the policy is fixed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
CI showed both pass: an UPDATE with a WHERE clause must also satisfy the SELECT policy on the new row, so moving a comment or reaction to another section's announcement fails. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #38 (fix/lock-users-columns-and-db-tests). Merge that first; this diff then shrinks to the test files.
Adds pgTAP tests in
supabase/tests/for the section-scoped tables that had none: assignments, submissions, attendance_records, attendance_sessions, student_session_attendance, acknowledgments, announcement_comments, announcement_reactions, counsellor_notes, feedback_reports. Each file checks cross-section reads and writes, what each role (student, CR, teacher viasection_teachers) can do under the latest policy, and that denied writes leave the target row intact.tests/integration/attachments_rls.test.sqlis ported tosupabase/tests/attachments_rls.test.sqlso CI runs it.There is no
attendance_class_logstable. The digital register tables (attendance_sessions,student_session_attendance) are covered instead.Policy gaps the tests found are written as pgTAP
todotests. Each one asserts the secure behaviour and fails as an expected TODO today, so the suite stays green. When a policy is fixed, its TODO starts passing and thetodo()line can be removed. No policies are changed here; the gaps are listed as RLS proposals for review.🤖 Generated with Claude Code