test(mcp-server-supabase): list_tables system schema assertions in server.database.test.ts are vacuous

Open Beginner friendly
  • Is something wrong?
#553 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
82/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
postgresql, supabase, typescript
Domain
testing-qa

Research direction

Start in packages/mcp-server-supabase/src/server.database.test.ts around lines 1014–1028, where the three not.toEqual(expect.arrayContaining(...)) assertions on the list_tables result live. Check how list_tables builds the name field in database-operation-tools.ts. Replace the vacuous assertions with a check on result.tables that no name starts with pg_catalog., information_schema., or pg_toast., then run the server.database test file to confirm it passes and would fail if system tables were included.

Written by the indexing model from the issue text.

Description

Description

In packages/mcp-server-supabase/src/server.database.test.ts (lines 1014–1028), the test intended to verify that default list_tables calls do not leak system schemas (pg_catalog, information_schema, pg_toast) contains vacuous assertions that pass unconditionally.

Code Reference
// packages/mcp-server-supabase/src/server.database.test.ts
const result = await callTool({
  name: 'list_tables',
  arguments: {
    project_id: project.id,
  },
});

expect(result).not.toEqual(
  expect.arrayContaining([
    expect.objectContaining({ schema: 'pg_catalog' }),
  ])
);

expect(result).not.toEqual(
  expect.arrayContaining([
    expect.objectContaining({ schema: 'information_schema' }),
  ])
);

expect(result).not.toEqual(
  expect.arrayContaining([expect.objectContaining({ schema: 'pg_toast' })])
);
Why it passes vacuously
  1. Object vs. Array comparison: callTool returns an object of shape { tables: Array<{ name: string, ... }>, advisory?: ... }. Comparing an object against expect.arrayContaining(...) under .not.toEqual(...) always passes because an object is never an array.
  2. Missing schema property: In database-operation-tools.ts, list_tables flattens the schema into the name field (e.g. public.users or pg_catalog.pg_class). No table object in tables has a top-level schema key.

As a result, if list_tables were accidentally modified to include pg_catalog or other system tables in result.tables, this test would still pass green.

Reproduction
// Minimal demonstration of the assertion behavior
import { expect } from 'vitest';

const result = {
  tables: [
    { name: 'pg_catalog.pg_class', rls_enabled: false },
    { name: 'information_schema.tables', rls_enabled: false },
  ],
};

// Both pass vacuously despite system tables being present in result.tables:
expect(result).not.toEqual(
  expect.arrayContaining([expect.objectContaining({ schema: 'pg_catalog' })])
);
expect(result).not.toEqual(
  expect.arrayContaining([expect.objectContaining({ schema: 'information_schema' })])
);
Proposed Fix

Assert directly on result.tables matching against the table names:

const systemSchemas = ['pg_catalog.', 'information_schema.', 'pg_toast.'];
for (const prefix of systemSchemas) {
  expect(result.tables.some((t: { name: string }) => t.name.startsWith(prefix))).toBe(false);
}
Dominant language
TypeScript
Stars
3k
Forks
432
Avg merge
1d 7h
Merged PRs (30d)
52

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from supabase/mcp

All issues in supabase/mcp

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.