Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

npm [email protected] auto-exposes new public tables again when [api].auto_expose_new_tables is unset (regression of v2.106.0)

Aperta
  • Qualcosa non va?
#7,286 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@krushit1307 ci sta già lavorando.

Dal 23/10/2026.

  • #7313 di @krushit1307 — chiusa senza merge

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
56/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
postgresql, typescript
Ambito
cli, databases

Direzione di ricerca

Read apps/cli/src/command-internal/db-bootstrap/db-setup.ts and packages/config/src/api.ts, then compare their defaults with apps/cli-go/internal/db/start/start.go and ApplyApiPrivileges. Trace the sequence revoke logic in both implementations as well. Done means an unset key matches the Go behavior, the config description reflects that default, and revoking sequence privileges removes the reported update grant.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

🐛 Bug supabase/cli

v2.106.0 made an unset [api].auto_expose_new_tables resolve to false, "matching the new hosted-project default":
local start and reset revoke the default Data API privileges. At v2.121.0 the Go implementation still does this
(apps/cli-go/internal/db/start/start.go, ApplyApiPrivileges: "unset (default): revoke").

The CLI that npm [email protected] installs does the opposite. In
apps/cli/src/command-internal/db-bootstrap/db-setup.ts, applyApiPrivileges starts with

if (Option.getOrElse(autoExposeNewTables, () => true)) return;

so an unset key keeps the image's legacy grants. Its doc comment ("unset and true are both a no-op") and the config
schema (packages/config/src/api.ts: "When unset, new entities are auto-exposed, matching the cloud default.")
describe the default from before v2.106.0. Changelog 45329 says the hosted default flipped on 2026-05-30.

What we measured (npm [email protected], darwin-arm64, postgres 17.11.0.004): with the key unset, supabase db reset left anon and authenticated DELETE, INSERT, SELECT and UPDATE on all 91 public tables and views our
migrations create; with auto_expose_new_tables = false they had none.

Minimal repro, with a config.toml that leaves the key unset:

npm i -D [email protected]
npx supabase init
mkdir -p supabase/migrations
echo 'create table public.t (id int);' > supabase/migrations/0001_t.sql
npx supabase start
docker exec supabase_db_<project_id> psql -U postgres -Atc \
  "select has_table_privilege('anon', 'public.t', 'INSERT')"

Per the v2.106.0 notes this should print f. The code path above leaves the grant in place, as it did for every
table in our project, so 2.121 prints t.

Impact: a local database built by 2.121 is laxer than a hosted project created with the default since
2026-05-30, and than every project from 2026-10-30. Code that reads or writes a table without an explicit GRANT
works locally and fails with permission denied once deployed. A schema reviewed against the local grants also
passes review with tables open to the anon key that the author never granted.

Also, in both implementations: the revoke takes usage, select on sequences but leaves update. After it,
pg_default_acl for postgres in public still reads {postgres=rwU, anon=w, authenticated=w, service_role=w} for
sequences, so a new sequence still lets those roles call nextval and setval.

Ask:

  1. Make the npm CLI resolve an unset auto_expose_new_tables to false, as v2.106.0 and the Go path do, and update
    the schema description.
  2. Revoke all on sequences, not usage, select.
Lingua principale
TypeScript
Stelle
2.4k
Fork
537
Merge medio
19h 43m
PR unite (30g)
406

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di supabase/cli

Tutte le issue di supabase/cli

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.