Scoped tokens: supabase link needs API Key Secrets even though db push only needs the DB password
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 45/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- typescript
- 领域
- authentication, cli
调研方向
The failing call is GET /v1/projects/<ref>/api-keys, made during supabase link after the project lookup succeeds; start by finding where link requests API keys and whether a 403 there aborts the command. Reproduce with a project-scoped token that lacks API Key Secrets, then run the link command with --debug to confirm the failing request. Done means link completes without the secret keys, or a 403 names the missing permission in missing_permissions as the docs describe.
由索引模型根据 Issue 内容生成。
描述
Affected area
Auth
Supabase CLI version
2.108.0
Operating system
Ubuntu 24.04 (GitHub Actions ubuntu-latest); also reproduced on Windows 11
Installation method
None
Command
SUPABASE_ACCESS_TOKEN=<project-scoped PAT> supabase link --project-ref <ref> --debug
Actual output
Using access token from env var...
Supabase CLI 2.120.0
HTTP GET: https://api.supabase.com/v1/projects/<ref>
HTTP GET: https://api.supabase.com/v1/projects/<ref>/api-keys
Authorization failed for the access token and project ref pair: {"message":"Your account does not have the necessary privileges to access this endpoint. For more details, refer to our documentation https://supabase.com/docs/guides/platform/access-control"}
Expected behavior
supabase link (followed by supabase db push) works with a project-scoped token that has Migrations read-write and project/database read, without needing API Key Secrets. db push uses the database password and never needs the secret service_role key, so link shouldn't fetch secret keys, or should skip them when the token lacks API Key Secrets. If a permission is missing, the 403 should name it in missing_permissions, as the docs say.
Steps to reproduce
- Create a scoped personal access token (resource access: one project) with: Migrations read-write; Project Settings, Database, Database Config, Connection Pooling, API Keys read. Created by the organization Owner.
- Run: SUPABASE_ACCESS_TOKEN= supabase link --project-ref --debug
- It fails on GET /v1/projects//api-keys with "Your account does not have the necessary privileges to access this endpoint".
- Add API Key Secrets: read to a new token → link succeeds.
Workaround: supabase db push --db-url (no link, no token).
Crash report ID
No response
Docker and service versions
Additional context
No response
- 主要语言
- TypeScript
- 星标
- 2.4k
- 派生
- 533
- 平均合并
- 22 小时 20 分钟
- 30 天内合并 PR
- 370
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
supabase/cli 的其他 Issue
-
🐛 Bug supabase/cli
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 1 天内回复
-
db schema declarative sync: no way to fail (non-zero exit) when the generated migration is destructive可能重新可做 关联的 PR 已关闭且未合并。 未关闭✨ Feature supabase/cli
难度 2/5 1-3 小时 新手友好度 84/100
维护者通常 1 天内回复
-
stack: the HTTP gateway closes idle keep-alive connections after 5 s, so a client whose event loop is blocked gets ECONNRESET (`fetch failed`) on its next request可能已有人在做 @7ttp 于 12 天前认领。 未关闭🐛 Bug supabase/cli
难度 2/5 1-3 小时 新手友好度 84/100
维护者通常 1 天内回复
-
📘 Docs supabase/cli
难度 1/5 1 小时以内 新手友好度 88/100
维护者通常 1 天内回复
-
🐛 Bug supabase/cli
难度 2/5 1-3 小时 新手友好度 88/100
维护者通常 1 天内回复
相似的 Issue
-
area:ui effort:S enhancement priority:P2
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 74/100
QuantumNous/new-api#7839 ·
维护者通常 1 天内回复
-
good first issue maintenance
难度 2/5 1-3 小时 新手友好度 62/100
dark-princezz/stellar-hooks#1010 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
interledger/rhyza#352 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 70/100
维护者通常 1 天内回复