Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

npm [email protected] auto-exposes new public tables again when [api].auto_expose_new_tables is unset (regression of v2.106.0)

オープン
  • 何か問題がありますか？
#7,286 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
3/5
見積もり時間
1〜2日
初心者へのやさしさ
56/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
postgresql, typescript
領域
cli, databases

調査の方向性

Read apps/cli/src/command-internal/db-bootstrap/db-setup.ts and packages/config/src/api.ts, then compare their defaults with apps/cli-go/internal/db/start/start.go and ApplyApiPrivileges. Trace the sequence revoke logic in both implementations as well. Done means an unset key matches the Go behavior, the config description reflects that default, and revoking sequence privileges removes the reported update grant.

索引モデルが issue の本文から書いたものです。

説明

🐛 Bug supabase/cli

v2.106.0 made an unset [api].auto_expose_new_tables resolve to false, "matching the new hosted-project default":
local start and reset revoke the default Data API privileges. At v2.121.0 the Go implementation still does this
(apps/cli-go/internal/db/start/start.go, ApplyApiPrivileges: "unset (default): revoke").

The CLI that npm [email protected] installs does the opposite. In
apps/cli/src/command-internal/db-bootstrap/db-setup.ts, applyApiPrivileges starts with

if (Option.getOrElse(autoExposeNewTables, () => true)) return;

so an unset key keeps the image's legacy grants. Its doc comment ("unset and true are both a no-op") and the config
schema (packages/config/src/api.ts: "When unset, new entities are auto-exposed, matching the cloud default.")
describe the default from before v2.106.0. Changelog 45329 says the hosted default flipped on 2026-05-30.

What we measured (npm [email protected], darwin-arm64, postgres 17.11.0.004): with the key unset, supabase db reset left anon and authenticated DELETE, INSERT, SELECT and UPDATE on all 91 public tables and views our
migrations create; with auto_expose_new_tables = false they had none.

Minimal repro, with a config.toml that leaves the key unset:

npm i -D [email protected]
npx supabase init
mkdir -p supabase/migrations
echo 'create table public.t (id int);' > supabase/migrations/0001_t.sql
npx supabase start
docker exec supabase_db_<project_id> psql -U postgres -Atc \
  "select has_table_privilege('anon', 'public.t', 'INSERT')"

Per the v2.106.0 notes this should print f. The code path above leaves the grant in place, as it did for every
table in our project, so 2.121 prints t.

Impact: a local database built by 2.121 is laxer than a hosted project created with the default since
2026-05-30, and than every project from 2026-10-30. Code that reads or writes a table without an explicit GRANT
works locally and fails with permission denied once deployed. A schema reviewed against the local grants also
passes review with tables open to the anon key that the author never granted.

Also, in both implementations: the revoke takes usage, select on sequences but leaves update. After it,
pg_default_acl for postgres in public still reads {postgres=rwU, anon=w, authenticated=w, service_role=w} for
sequences, so a new sequence still lets those roles call nextval and setval.

Ask:

  1. Make the npm CLI resolve an unset auto_expose_new_tables to false, as v2.106.0 and the Go path do, and update
    the schema description.
  2. Revoke all on sequences, not usage, select.
主要言語
TypeScript
スター
2.4k
フォーク
537
平均マージ
19時間 40分
マージ済み PR（30日）
403

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

supabase/cli のほかの issue

supabase/cli の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。