From fccea79255f745b68ff85cdf6d08f345d61a6f90 Mon Sep 17 00:00:00 2001 From: pavlov346346-source Date: Fri, 11 Sep 2026 07:45:08 +0300 Subject: [PATCH] Harden Supabase advisor findings --- .../SUPABASE-V17.7.4-ADVISOR-HARDENING.sql | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 ops/sql/SUPABASE-V17.7.4-ADVISOR-HARDENING.sql diff --git a/ops/sql/SUPABASE-V17.7.4-ADVISOR-HARDENING.sql b/ops/sql/SUPABASE-V17.7.4-ADVISOR-HARDENING.sql new file mode 100644 index 0000000..c058d21 --- /dev/null +++ b/ops/sql/SUPABASE-V17.7.4-ADVISOR-HARDENING.sql @@ -0,0 +1,23 @@ +begin; + +-- Keep the same RLS semantics while evaluating auth.uid() once per statement. +alter policy sun_chat_reads_read_v29 on public.sun_chat_reads + using ((user_id = (select auth.uid())) and public.sun_chat_can_access_thread_v29(thread_id)); + +-- Cover foreign keys used by chat joins/deletes. +create index if not exists sun_chat_messages_sender_user_id_idx on public.sun_chat_messages(sender_user_id); +create index if not exists sun_chat_participants_workspace_id_idx on public.sun_chat_participants(workspace_id); +create index if not exists sun_chat_reads_workspace_id_idx on public.sun_chat_reads(workspace_id); +create index if not exists sun_chat_threads_created_by_idx on public.sun_chat_threads(created_by); + +-- Remove exact duplicate indexes, retaining the clearer canonical names. +drop index if exists public.sun_v17_error_workspace_created_idx; +drop index if exists public.sun_v17_orders_due_idx; + +-- Server order automation is for signed-in workspace members only. +revoke execute on function public.sun_run_order_automation(uuid) from public; +revoke execute on function public.sun_run_order_automation(uuid) from anon; +grant execute on function public.sun_run_order_automation(uuid) to authenticated; +grant execute on function public.sun_run_order_automation(uuid) to service_role; + +commit;