Repository navigation
fix(db): re-lock SECURITY DEFINER functions lost in the dev2 move - #341
Merged
Merged
Conversation
…n the dev2 move All 53 SECURITY DEFINER functions in public were executable by the anon key again (the dev2 restore dropped the #247 ACLs). Because the #247 bodies treat a NULL auth.uid() as the trusted server, anon walked through every check, e.g. upsert_user_public_key could replace any user's public key. Re-asserts the #247 grant matrix (bodies unchanged), pins users.account_type and operator_user_id (anonymous -> verified self-upgrade unlocked free phone minutes), locks blog_posts_bak_20261014, scopes the 'system' insert policies to service_role, and stops new functions defaulting to PUBLIC/anon execute. Applied by hand on dev2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ThreatCrush Security Scan17 finding(s) MEDIUM: 13 | LOW: 4
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The dev2 restore dropped the ACLs from #247, so all 53 SECURITY DEFINER functions in
publicwere executable by the public anon key again. The #247 bodies treatauth.uid() IS NULLas "trusted server caller", so anon passed every check.Worst cases (anon key, no sign-in):
upsert_user_public_key(target, key): replace any user's public key (silent E2EE MITM).fn_get_user_message_content,get_user_call_sessions,fn_get_user_active_deliveries,get_user_call_history,get_user_active_calls,get_conversations_with_archive_*,get_user_archived_conversations: other users' messages envelopes, calls, deliveries, conversation lists.sync_user_with_auth,fix_*,update_canonical_auth_user_ids,nuclear_delete_user_data,delete_encrypted_data_only,log_sms_event,get_sms_stats, cleanup functions: internal.Change (migration
20261026210000, already applied by hand on dev2)service_roleonly; 20 user-callable ones (all scoped toauth.uid()) ->authenticated+service_role, never anon.fn_cleanup_expired_messagesmoved to service_role (app only calls it with the service role).users.account_typeandusers.operator_user_idadded toenforce_users_immutable_columns: ananonymousaccount could PATCH itself toverifiedand get the free daily phone minutes.blog_posts_bak_20261014: RLS on, anon/authenticated grants revoked.key_access_log/sms_notifications"System can insert" policies (auth.uid() IS NULL) nowTO service_role(they matched anon).For Preshy (messaging)
Nothing in the message/key/call code paths changed. If you add a new RPC that the browser calls, grant it explicitly:
GRANT EXECUTE ON FUNCTION ... TO authenticated;(anon no longer gets new functions by default). SECURITY DEFINER functions should checkauth.uid()and must not treat NULL as trusted unless anon is revoked.Verified live
get_sms_stats,upsert_user_public_key,get_user_public_key->42501 permission denied.upsert_user_public_keyfor another user ->Access denied; own key OK;get_user_conversations_enhanced,update_user_activity,fn_get_user_active_deliveries,fn_mark_read,get_user_active_calls,get_user_call_history,find_user_by_unique_identifier,is_conversation_participantall 200/204;get_user_call_sessions,fn_get_user_message_content-> 42501; PATCHaccount_type-> rejected, PATCHbioOK. Real trafficupdate_user_activity204s after apply. Test users deleted.🤖 Generated with Claude Code