Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

npm [email protected] auto-exposes new public tables again when [api].auto_expose_new_tables is unset (regression of v2.106.0)

未关闭
  • 哪里不对？
#7,286 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
3/5
预计耗时
1-2 天
新手友好度
56/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
postgresql, typescript
领域
cli, databases

调研方向

Read apps/cli/src/command-internal/db-bootstrap/db-setup.ts and packages/config/src/api.ts, then compare their defaults with apps/cli-go/internal/db/start/start.go and ApplyApiPrivileges. Trace the sequence revoke logic in both implementations as well. Done means an unset key matches the Go behavior, the config description reflects that default, and revoking sequence privileges removes the reported update grant.

由索引模型根据 Issue 内容生成。

描述

🐛 Bug supabase/cli

v2.106.0 made an unset [api].auto_expose_new_tables resolve to false, "matching the new hosted-project default":
local start and reset revoke the default Data API privileges. At v2.121.0 the Go implementation still does this
(apps/cli-go/internal/db/start/start.go, ApplyApiPrivileges: "unset (default): revoke").

The CLI that npm [email protected] installs does the opposite. In
apps/cli/src/command-internal/db-bootstrap/db-setup.ts, applyApiPrivileges starts with

if (Option.getOrElse(autoExposeNewTables, () => true)) return;

so an unset key keeps the image's legacy grants. Its doc comment ("unset and true are both a no-op") and the config
schema (packages/config/src/api.ts: "When unset, new entities are auto-exposed, matching the cloud default.")
describe the default from before v2.106.0. Changelog 45329 says the hosted default flipped on 2026-05-30.

What we measured (npm [email protected], darwin-arm64, postgres 17.11.0.004): with the key unset, supabase db reset left anon and authenticated DELETE, INSERT, SELECT and UPDATE on all 91 public tables and views our
migrations create; with auto_expose_new_tables = false they had none.

Minimal repro, with a config.toml that leaves the key unset:

npm i -D [email protected]
npx supabase init
mkdir -p supabase/migrations
echo 'create table public.t (id int);' > supabase/migrations/0001_t.sql
npx supabase start
docker exec supabase_db_<project_id> psql -U postgres -Atc \
  "select has_table_privilege('anon', 'public.t', 'INSERT')"

Per the v2.106.0 notes this should print f. The code path above leaves the grant in place, as it did for every
table in our project, so 2.121 prints t.

Impact: a local database built by 2.121 is laxer than a hosted project created with the default since
2026-05-30, and than every project from 2026-10-30. Code that reads or writes a table without an explicit GRANT
works locally and fails with permission denied once deployed. A schema reviewed against the local grants also
passes review with tables open to the anon key that the author never granted.

Also, in both implementations: the revoke takes usage, select on sequences but leaves update. After it,
pg_default_acl for postgres in public still reads {postgres=rwU, anon=w, authenticated=w, service_role=w} for
sequences, so a new sequence still lets those roles call nextval and setval.

Ask:

  1. Make the npm CLI resolve an unset auto_expose_new_tables to false, as v2.106.0 and the Go path do, and update
    the schema description.
  2. Revoke all on sequences, not usage, select.
主要语言
TypeScript
星标
2.4k
派生
537
平均合并
19 小时 40 分钟
30 天内合并 PR
403

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

supabase/cli 的其他 Issue

查看 supabase/cli 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。