fix(security): revoke anon access to apikey oracle RPCs

[riderx]

Summary (AI generated)

• Added migration 20260224130000_restrict_rpc_api_key_oracles.sql to revoke anonymous execution on API key oracle RPCs.
• Removed anonymous-facing oracle RPC calls from the internal upload/delete handlers so the security hardening does not break private upload flows:
  • supabase/functions/_backend/private/upload_link.ts
  • supabase/functions/_backend/private/delete_failed_version.ts
• Kept SECURITY DEFINER behavior for authenticated contexts while removing anonymous access to:
  • public.get_user_id(apikey text)
  • public.get_user_id(apikey text, app_id text)
  • public.get_org_perm_for_apikey(apikey text, app_id text).

Motivation (AI generated)

• Prevent leaked sb_publishable_* keys from being used as validation oracles while preserving expected behavior for authenticated internal API-key requests.

Business Impact (AI generated)

• Reduces key-leak blast radius and prevents user/app/permission inference from unauthenticated RPC probes.
• Avoids regressions in private upload flows that rely on API-key middleware context.

Test Plan (AI generated)

• bun lint
• bun lint:backend
• Confirmed internal private upload/delete handlers no longer call rpc('get_user_id', { apikey, app_id }) via supabaseApikey client.
• Execute a PostgREST PoC with a valid publishable key and invalid/unknown key to validate get_user_id / get_org_perm_for_apikey now return permission errors for anon (requires local/remote Supabase runtime)
• Execute full regression path for /private/upload_link and /private/delete_failed_version against a seeded API key in integration environment

Generated with AI

[coderabbitai]

Warning

Rate limit exceeded

@riderx has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 27 minutes and 40 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between b410899 and e54ffc2.

📒 Files selected for processing (10)

• package.json
• src/pages/admin/dashboard/replication.vue
• supabase/functions/_backend/files/preview.ts
• supabase/functions/_backend/private/delete_failed_version.ts
• supabase/functions/_backend/private/upload_link.ts
• supabase/functions/_backend/public/build/index.ts
• supabase/functions/_backend/public/replication.ts
• supabase/functions/_backend/utils/version.ts
• supabase/migrations/20260224100000_fix_webhook_rls_org_scoping.sql
• tests/build-upload-head-routing.test.ts

📝 Walkthrough

Walkthrough

A SQL migration is added that revokes anonymous execution permissions on three RPC functions—public.get_user_id() with two signatures and public.get_org_perm_for_apikey()—preventing unauthenticated users from executing these API key validation functions.

Changes

Cohort / File(s)	Summary
Database Migration supabase/migrations/20260224130000_restrict_rpc_api_key_oracles.sql	Revokes ALL permissions on three API key validation RPCs from the anon role to restrict access to authenticated users only.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• fix: make is_allowed_capgkey support hashed API keys #1366: Modifies the implementation of the public.get_user_id() RPC functions that are being restricted in this security-focused migration.

Suggested labels

💰 Rewarded

Poem

🐰 A rabbit hops through databases deep,
Revoking secrets the anon can't keep,
Three functions locked with a careful hand,
Authentication is now the command!

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main security fix: revoking anonymous access to API key oracle RPCs, which matches the core change in the migration file.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description check	✅ Passed	PR description includes all required template sections: Summary, Test plan, and Checklist with comprehensive details about security changes, motivation, and verification steps.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch riderx/fix-sb-rpc-oracles

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b410899d18

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve get_user_id RPC for anon-backed key flows

Revoking anon execute on get_user_id(apikey, app_id) breaks existing API-key request paths that still call this RPC via supabaseApikey(...) (which uses SUPABASE_ANON_KEY in supabase/functions/_backend/utils/supabase.ts). Both supabase/functions/_backend/private/upload_link.ts:33 and supabase/functions/_backend/private/delete_failed_version.ts:33 call this function before continuing, so after this migration they receive a permission error and return user_not_found, blocking those upload/delete flows for valid keys.

Useful? React with 👍 / 👎.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud