hahachait
ff9da4d324
- Cookie-based auth via backend proxy (httpOnly JWTs) - Supabase Postgres persistence for sessions/messages/profiles + RLS - Fix cross-user session leak (token cache keyed by full token, not 50-char prefix) - Fix missing table grants (42501) via migration; auto-provision profiles on user creation - Chat validation, ownership checks, rate limiting, /api/chat/sessions route ordering - Frontend auth-state reset + credentials include - OpenRouter AI provider (OpenAI-compatible base URL, reasoning disabled) - Tests: chatValidation, appState
24 lines
1.0 KiB
SQL
24 lines
1.0 KiB
SQL
-- Grant table privileges to Supabase API roles.
|
|
--
|
|
-- The sessions/messages/profiles tables are owned by `postgres`, and the
|
|
-- default ACL for postgres-owned tables omits SELECT/INSERT/UPDATE for the
|
|
-- PostgREST API roles (anon/authenticated/service_role). This caused
|
|
-- PostgreSQL error 42501 ("permission denied for table ...") on every
|
|
-- database operation through the REST gateway.
|
|
--
|
|
-- RLS remains enabled and is the actual access control; these grants only
|
|
-- allow the roles to reach the tables through PostgREST. service_role also
|
|
-- carries BYPASSRLS, which is the backend's write path.
|
|
|
|
GRANT SELECT, INSERT, UPDATE, DELETE
|
|
ON public.profiles,
|
|
public.sessions,
|
|
public.messages
|
|
TO anon, authenticated, service_role;
|
|
|
|
-- Ensure future tables created in `public` receive the same grants, so the
|
|
-- "always-revoked" default (auto_expose_new_tables) does not silently break
|
|
-- new tables the same way.
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES
|
|
TO anon, authenticated, service_role; |