npm [email protected] auto-exposes new public tables again when [api].auto_expose_new_tables is unset (regression of v2.106.0)
Los mantenedores suelen responder en 1 día
Nadie ha tomado este issue todavía.
Evaluación
- Dificultad
- 3/5
- Tiempo estimado
- 1-2 días
- Aptitud para principiantes
- 56/100
- Tipo de issue
- Error
- Claridad
- Bien especificado
- Estado de actividad
- Activo
- Stack tecnológico
- postgresql, typescript
Línea de trabajo
Read apps/cli/src/command-internal/db-bootstrap/db-setup.ts and packages/config/src/api.ts, then compare their defaults with apps/cli-go/internal/db/start/start.go and ApplyApiPrivileges. Trace the sequence revoke logic in both implementations as well. Done means an unset key matches the Go behavior, the config description reflects that default, and revoking sequence privileges removes the reported update grant.
Escrito por el modelo de indexación a partir del texto del issue.
Descripción
v2.106.0 made an unset [api].auto_expose_new_tables resolve to false, "matching the new hosted-project default":
local start and reset revoke the default Data API privileges. At v2.121.0 the Go implementation still does this
(apps/cli-go/internal/db/start/start.go, ApplyApiPrivileges: "unset (default): revoke").
The CLI that npm [email protected] installs does the opposite. In
apps/cli/src/command-internal/db-bootstrap/db-setup.ts, applyApiPrivileges starts with
if (Option.getOrElse(autoExposeNewTables, () => true)) return;
so an unset key keeps the image's legacy grants. Its doc comment ("unset and true are both a no-op") and the config
schema (packages/config/src/api.ts: "When unset, new entities are auto-exposed, matching the cloud default.")
describe the default from before v2.106.0. Changelog 45329 says the hosted default flipped on 2026-05-30.
What we measured (npm [email protected], darwin-arm64, postgres 17.11.0.004): with the key unset, supabase db reset left anon and authenticated DELETE, INSERT, SELECT and UPDATE on all 91 public tables and views our
migrations create; with auto_expose_new_tables = false they had none.
Minimal repro, with a config.toml that leaves the key unset:
npm i -D [email protected]
npx supabase init
mkdir -p supabase/migrations
echo 'create table public.t (id int);' > supabase/migrations/0001_t.sql
npx supabase start
docker exec supabase_db_<project_id> psql -U postgres -Atc \
"select has_table_privilege('anon', 'public.t', 'INSERT')"
Per the v2.106.0 notes this should print f. The code path above leaves the grant in place, as it did for every
table in our project, so 2.121 prints t.
Impact: a local database built by 2.121 is laxer than a hosted project created with the default since
2026-05-30, and than every project from 2026-10-30. Code that reads or writes a table without an explicit GRANT
works locally and fails with permission denied once deployed. A schema reviewed against the local grants also
passes review with tables open to the anon key that the author never granted.
Also, in both implementations: the revoke takes usage, select on sequences but leaves update. After it,
pg_default_acl for postgres in public still reads {postgres=rwU, anon=w, authenticated=w, service_role=w} for
sequences, so a new sequence still lets those roles call nextval and setval.
Ask:
- Make the npm CLI resolve an unset
auto_expose_new_tablestofalse, as v2.106.0 and the Go path do, and update
the schema description. - Revoke
allon sequences, notusage, select.
- Lenguaje dominante
- TypeScript
- Estrellas
- 2.4k
- Forks
- 537
- Merge medio
- 19 h 40 min
- PR fusionados (30 d)
- 403
Preparar el entorno
- Sin Dockerfile ni archivo de Docker Compose
- Tiene una plantilla de pull request
- Leer la guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de supabase/cli
-
stack: the gateway sets no X-Forwarded-For or X-Real-IP, so Edge Functions cannot see the client IPAbierto🐛 Bug supabase/cli
Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100
Los mantenedores suelen responder en 1 día
-
config push: changing auth.oauth_server.authorization_url_path fails with 400 (enabled and path must be sent together)Posiblemente ocupada @itz-puneet la tomó hace 5 días. Abierto🐛 Bug supabase/cli
Dificultad 2/5 1-3 horas Aptitud para principiantes 76/100
supabase/cli#7087 · 2 comentarios ·
Los mantenedores suelen responder en 1 día
-
db schema declarative sync: no way to fail (non-zero exit) when the generated migration is destructiveQuizá libre de nuevo Un pull request para esta issue se cerró sin fusionarse. Abierto✨ Feature supabase/cli
Dificultad 2/5 1-3 horas Aptitud para principiantes 84/100
Los mantenedores suelen responder en 1 día
-
📘 Docs supabase/cli
Dificultad 1/5 Menos de una hora Aptitud para principiantes 88/100
supabase/cli#6974 · 1 comentario ·
Los mantenedores suelen responder en 1 día
-
Migration error caret is missing or misplaced when the statement contains multibyte charactersAbierto🐛 Bug supabase/cli
Dificultad 2/5 1-3 horas Aptitud para principiantes 88/100
Los mantenedores suelen responder en 1 día
Todos los issues de supabase/cli
Issues similares
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 66/100
db-ux-design-system/core-web#8613 ·
Los mantenedores suelen responder en 1 día
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 82/100
Los mantenedores suelen responder en 1 día
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 62/100
foxglove/mcap#1907 · 1 comentario ·
Los mantenedores suelen responder en 1 día
-
bug internal-plugin pr-welcome upstream
Dificultad 2/5 1-3 horas Aptitud para principiantes 78/100
dsh-tauri-desk/deepseek-harness-desktop#1225 · 1 comentario ·
-
enhancement
Dificultad 2/5 1-3 horas Aptitud para principiantes 68/100
unjs/unhead#1027 · 1 reacción ·
Los mantenedores suelen responder en 1 día