[security] Close the SECURITY DEFINER PUBLIC-grant class (closes #25)

[Harrolee]

Closes #25.

Not another instance — the class. Postgres grants EXECUTE on every new function to PUBLIC by default, so the GRANT ... TO service_role sitting next to a SECURITY DEFINER function excluded nobody.

What was actually reachable

Verified on a from-scratch stack over PostgREST using only the anon key — the key that ships in the web bundle. Every one of these returned 200:

Function	Result as anon	Severity
due_coach_nudges(int)	Returned another member's user_id, display_name, coach name and discipline. No auth.uid() filter exists in it at all — it was written as a service_role dispatcher query.	High. Discloses that a named person is being coached, and on what.
consume_free_message(uuid,uuid)	Incremented messages_used three times over three unauthenticated calls, exhausting a member's free tier.	Medium. Unauthenticated write.
has_coach_access(uuid,uuid)	Returned true for an arbitrary member id — and the id needed to drive it leaks from due_coach_nudges.	Medium. Entitlement oracle.
check_subscription_access, get_trial_days_remaining, can_publish_coaches	Answered for an arbitrary email.	Low–medium. Enumeration oracle.
create_user_with_trial, get_or_create_user	Executed as anon and reached their INSERT.	Medium.

Functions whose bodies are auth.uid()-scoped (release_push_device and friends) were callable but no-opped — release_push_device returned 204 and changed nothing. Revoked anyway: "the body happens to check" is not an access control.

All nine now return 42501. get_coach_roster still works logged-out.

Approach

Revokes are computed from the catalog, not a hand-written list, so a function added by a later migration that forgets its own REVOKE is still covered on the next deploy. Grants are then re-applied deliberately.

security_definer_grant_audit() returns any SECURITY DEFINER function still reachable by PUBLIC/anon, minus a two-entry documented allowlist. rls-probe.mjs asserts it is empty, so the next one to forget fails the probes instead of shipping.

has_coach_access also short-circuits when auth.uid() is set and doesn't match p_user_id. Its entitlement logic is otherwise unchanged — the free-tier metering, trialing/grace_period statuses and creator-owns-their-coach branches are all preserved. (My first draft of this rewrite dropped all three; caught before it applied.)

The four inherited probe failures

main was at 44/4, all four failing with permission denied for table user_profiles on the coach detail query.

Root cause: four legacy phone-based policies on coach_profiles that subquery user_profiles. An RLS predicate is evaluated as the invoking role, so their existence forced every reader of coach_profiles — including anon — to hold SELECT on user_profiles.

The tempting fix, granting anon SELECT on user_profiles, would have published every member's email, phone, timezone and reference photo URL. Dropped the policies instead; they're redundant with the uid/email policies the multi-domain work added.

Verification

• rls-probe.mjs 44/4 → 77/0, with 29 new negative assertions: per-function 42501 checks, per-table anon denials, creator_profiles payout columns unreadable by anon, and cross-member entitlement probing blocked.
• Other suites unchanged and green: flow 46/0, viz-realtime 33/0, sms-image 55/0, account-deletion 64/0. 275 checks total.
• Migration is idempotent (re-applies clean) and the full chain cold-applies against supabase-shim.sql with ON_ERROR_STOP=1.
• tsc --noEmit clean, node --check clean on every function, terraform validate passes.

Note for the next agent

viz-realtime-probe.mjs is flaky — it failed 29/4 on the first run and passed 33/0 on a re-run with no changes in between. The failures are all "the message arrived over realtime — received 0", i.e. the websocket subscription hadn't established before the assertion. Worth a retry/wait rather than an hour of debugging.

docs/grant-matrix.md is the reviewable per-role-per-object table #25 asks for.

🤖 Generated with Claude Code