root/Jyotisha
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix: restore service role profile upserts

Browse Source
This commit is contained in:
Jesse_Chen
2026-07-18 21:32:42 +08:00
parent 99bbbf8e2e
commit 556d63065d
3 changed files with 222 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/supabase/migrations/20260718050000_profiles_service_role_upsert_grants.sql
+53
View File
@@ -0,0 +1,53 @@
begin;
grant select, insert, update on table public.profiles to service_role;
grant select (
id,
email,
credits,
created_at,
updated_at,
name,
birth_date,
birth_time,
country_code,
province_code,
city_code,
district_code,
latitude,
longitude,
timezone_offset
) on public.profiles to service_role;
grant insert (
id,
email,
name,
birth_date,
birth_time,
country_code,
province_code,
city_code,
district_code,
latitude,
longitude,
timezone_offset,
updated_at
) on public.profiles to service_role;
grant update (
name,
birth_date,
birth_time,
country_code,
province_code,
city_code,
district_code,
latitude,
longitude,
timezone_offset,
updated_at
) on public.profiles to service_role;
commit;
frontend/supabase/migrations/20260718060000_profiles_service_role_least_privilege.sql
+160
View File
@@ -0,0 +1,160 @@
begin;
revoke all privileges on table public.profiles from service_role;
revoke select (
id,
email,
credits,
created_at,
updated_at,
name,
birth_date,
birth_time,
country_code,
province_code,
city_code,
district_code,
onboarding_payload,
onboarding_version,
onboarding_generated_at,
latitude,
longitude,
timezone_offset,
reported_birth_time,
active_birth_time,
birth_time_source,
birth_time_period,
birth_time_clue,
uncertainty_before_minutes,
uncertainty_after_minutes,
birth_time_status,
rectification_confidence,
rectification_case_id
) on table public.profiles from service_role;
revoke insert (
id,
email,
credits,
created_at,
updated_at,
name,
birth_date,
birth_time,
country_code,
province_code,
city_code,
district_code,
onboarding_payload,
onboarding_version,
onboarding_generated_at,
latitude,
longitude,
timezone_offset,
reported_birth_time,
active_birth_time,
birth_time_source,
birth_time_period,
birth_time_clue,
uncertainty_before_minutes,
uncertainty_after_minutes,
birth_time_status,
rectification_confidence,
rectification_case_id
) on table public.profiles from service_role;
revoke update (
id,
email,
credits,
created_at,
updated_at,
name,
birth_date,
birth_time,
country_code,
province_code,
city_code,
district_code,
onboarding_payload,
onboarding_version,
onboarding_generated_at,
latitude,
longitude,
timezone_offset,
reported_birth_time,
active_birth_time,
birth_time_source,
birth_time_period,
birth_time_clue,
uncertainty_before_minutes,
uncertainty_after_minutes,
birth_time_status,
rectification_confidence,
rectification_case_id
) on table public.profiles from service_role;
grant select (
id,
name,
birth_date,
birth_time,
country_code,
province_code,
city_code,
latitude,
longitude,
timezone_offset,
active_birth_time,
birth_time_status,
onboarding_payload,
onboarding_version,
onboarding_generated_at,
rectification_case_id
) on table public.profiles to service_role;
grant insert (
id,
email,
name,
birth_date,
birth_time,
country_code,
province_code,
city_code,
district_code,
latitude,
longitude,
timezone_offset,
updated_at
) on table public.profiles to service_role;
grant update (
name,
birth_date,
birth_time,
country_code,
province_code,
city_code,
district_code,
latitude,
longitude,
timezone_offset,
updated_at,
onboarding_payload,
onboarding_version,
onboarding_generated_at,
reported_birth_time,
active_birth_time,
birth_time_source,
birth_time_period,
birth_time_clue,
uncertainty_before_minutes,
uncertainty_after_minutes,
birth_time_status,
rectification_confidence,
rectification_case_id
) on table public.profiles to service_role;
commit;
frontend/supabase/migrations/20260718070000_profiles_service_role_upsert_id.sql
+9
View File
@@ -0,0 +1,9 @@
begin;
-- PostgREST upsert on an existing profile updates the conflict key column
-- even when the submitted id is unchanged. Keep this grant scoped to id so
-- the service role can perform current /api/account upserts without restoring
-- table-wide profile update privileges.
grant update (id) on table public.profiles to service_role;
commit;