enforce org authorization on metrics RPCs

[riderx]

Summary (AI generated)

• Added supabase/migrations/20260226100000_fix_metrics_rpcs_org_authorization.sql to enforce organization membership checks on metrics RPC endpoints and prevent anonymous cross-tenant usage telemetry disclosure.
• Updated get_app_metrics, get_global_metrics, and get_total_metrics execution paths so requests now require valid read rights for the requested org and log denied attempts.

Test plan (AI generated)

• bun lint:backend
• Manual API validation: call each RPC with only anon key and verify unauthorized org IDs no longer return cross-tenant rows.

Screenshots (AI generated)

• Not applicable (backend-only database migration).

Checklist (AI generated)

• My code follows the code style of this project and passes bun run lint:backend && bun run lint.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• My change has adequate E2E test coverage.
• I have tested my code manually, and I have provided steps how to reproduce my tests.

Summary by CodeRabbit

• New Features
  • Added metrics endpoints to retrieve organization performance data by app and across the platform
  • Implemented secure access control with role-based authorization checks
  • Enabled performance optimization through intelligent data caching for faster queries

[coderabbitai]

Warning

Rate limit exceeded

@riderx has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 4 minutes and 29 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between cc2a1dd and a948f99.

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing (66)

• .gitsecret/paths/mapping.cfg
• internal/AuthKey_8P7Y3V99PJ.p8.secret
• internal/CICD.mobileprovision.secret
• internal/Certificates.p12.secret
• internal/Certificates_p12.p12.secret
• internal/capgo-394818-68ad1517d330.json.secret
• internal/cloudflare/.env.local.secret
• internal/cloudflare/.env.preprod.secret
• internal/cloudflare/.env.prod.secret
• internal/forgr-key.jks.base64.secret
• internal/forgr-key.jks.secret
• internal/how-to-deploy.md.secret
• internal/supabase/.env.local.secret
• messages/de.json
• messages/en.json
• messages/es.json
• messages/fr.json
• messages/hi.json
• messages/id.json
• messages/it.json
• messages/ja.json
• messages/ko.json
• messages/pl.json
• messages/pt-br.json
• messages/ru.json
• messages/tr.json
• messages/vi.json
• messages/zh-cn.json
• package.json
• read_replicate/update_readreplica_passwords.sh
• src/components/dashboard/DemoOnboardingGate.vue
• src/components/dashboard/DemoOnboardingModal.vue
• src/modules/auth.ts
• src/modules/i18n.ts
• src/pages/delete_account.vue
• src/pages/resend_email.vue
• src/pages/settings/organization/Security.vue
• src/services/versions.ts
• supabase/functions/_backend/private/role_bindings.ts
• supabase/functions/_backend/public/apikey/post.ts
• supabase/functions/_backend/public/build/request.ts
• supabase/functions/_backend/public/build/upload.ts
• supabase/functions/_backend/public/organization/members/delete.ts
• supabase/functions/_backend/utils/cloudflare.ts
• supabase/functions/_backend/utils/supabase.ts
• supabase/functions/_backend/utils/version.ts
• supabase/migrations/20250530233128_base.sql
• supabase/migrations/20260225120000_restrict_webhooks_select_for_admin_only.sql
• supabase/migrations/20260226090000_require_verified_email_for_delete_user.sql
• supabase/migrations/20260226100000_fix_metrics_rpcs_org_authorization.sql
• supabase/migrations/20260226153000_restrict_apikey_oracle_rpcs.sql
• supabase/migrations/20260227000000_fix_rescind_invitation_rpc_access.sql
• supabase/migrations/20260227000001_secure_record_build_time_rpc.sql
• supabase/migrations/20260227010000_restrict_upsert_version_meta_exec.sql
• supabase/migrations/20260227150000_fix_invite_user_to_org_security.sql
• supabase/migrations/20260228000000_role_bindings_rls_assignable.sql
• supabase/migrations/20260228000100_delete_member_cascade_bindings.sql
• supabase/migrations/20260228000200_prevent_last_super_admin_delete.sql
• supabase/migrations/20260228000300_fix_apikey_hashed_lookup.sql
• supabase/migrations/20260228172308_fix_prevent_last_super_admin_cascade.sql
• supabase/migrations/20260228172309_fix_rbac_test_compatibility.sql
• supabase/tests/28_test_new_migration_functions.sql
• supabase/tests/34_test_rbac_rls.sql
• supabase/tests/35_test_is_admin_rbac.sql
• tests/builder-payload.unit.test.ts
• tests/organization-api.test.ts

📝 Walkthrough

Walkthrough

Introduces six new public PostgreSQL functions for retrieving organizational metrics with built-in authorization controls and caching. Functions compute per-app metrics, global aggregated metrics, and total metrics across specified date ranges, validating access permissions and leveraging cache mechanisms to optimize queries.

Changes

Cohort / File(s)

Summary

Metrics RPC Functions supabase/migrations/20260226100000_fix_metrics_rpcs_org_authorization.sql

Adds six overloaded public functions: get_app_metrics (2 versions), get_global_metrics (2 versions), and get_total_metrics (2 versions). Implements authorization checks (service_role bypass, permission validation), org existence verification, cache management (app_metrics_cache, org_metrics_cache with TTL logic), and conditional cache seeding. Includes request denial logging with JSONB context for audit purposes.

Sequence Diagram

sequenceDiagram
    participant Client
    participant Auth as Authorization
    participant DB as Database
    participant Cache as Metrics Cache
    participant Compute as Computation

    Client->>Auth: Request metrics (org_id, date range)
    alt Service Role
        Auth-->>DB: Allow (bypass)
    else Regular User
        Auth->>DB: Check permissions & org
        DB-->>Auth: Validate rights
        alt Unauthorized
            Auth-->>Client: Deny (log event)
        else Authorized
            Auth-->>DB: Proceed
        end
    end

    DB->>Cache: Check cache validity
    alt Cache Valid & Recent
        Cache-->>Client: Return cached metrics
    else Cache Stale or Missing
        DB->>Compute: Seed metrics
        Compute->>Cache: Store results
        Cache-->>Client: Return metrics
    end

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

• fix: secure get_total_metrics rpc #1671: Directly modifies get_total_metrics RPCs with overloaded versions and tightened access control semantics for metrics retrieval
• Cache org metrics and combine plan usage #1568: Introduces metrics caching logic and modifies get_total_metrics-related RPCs with org/app metrics cache integration
• Fix 2FA enforcement in RBAC checks #1512: Introduces RBAC and permission-checking functions that this PR relies upon for authorization enforcement in metrics RPCs

Suggested labels

💰 Rewarded

Poem

🐰 A rabbit hops through metrics bright,
With authorization checks held tight,
Caching bounds the queries fast,
Access controlled, permissions asked,
Metrics bloom in organized light!

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'enforce org authorization on metrics RPCs' accurately describes the main change: adding authorization checks to metrics RPC endpoints.
Description check	✅ Passed	The description covers the summary, test plan, and checklist sections from the template but most checklist items remain unchecked, indicating incomplete verification.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch riderx/fix-rpc-metrics-auth

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

supabase/migrations/20260226100000_fix_metrics_rpcs_org_authorization.sql (1)

1-3: Consider adding explicit GRANT statements to document access intent.

The migration creates public functions without explicit GRANT or REVOKE statements. While PostgreSQL defaults grant EXECUTE to PUBLIC for new functions and the authorization is enforced internally, explicit grants improve clarity and make the security model auditable.

📝 Example: Explicit grants at end of migration

-- Explicitly grant to authenticated and anon for RPC access
GRANT EXECUTE ON FUNCTION public.get_app_metrics(uuid) TO authenticated, anon;
GRANT EXECUTE ON FUNCTION public.get_app_metrics(uuid, date, date) TO authenticated, anon;
GRANT EXECUTE ON FUNCTION public.get_global_metrics(uuid) TO authenticated, anon;
GRANT EXECUTE ON FUNCTION public.get_global_metrics(uuid, date, date) TO authenticated, anon;
GRANT EXECUTE ON FUNCTION public.get_total_metrics(uuid) TO authenticated, anon;
GRANT EXECUTE ON FUNCTION public.get_total_metrics(uuid, date, date) TO authenticated, anon;

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@supabase/migrations/20260226100000_fix_metrics_rpcs_org_authorization.sql`
around lines 1 - 3, Add explicit GRANT/REVOKE statements for the created RPC
functions to document and lock down access intent: for each function created
(get_app_metrics(uuid), get_app_metrics(uuid, date, date),
get_global_metrics(uuid), get_global_metrics(uuid, date, date),
get_total_metrics(uuid), get_total_metrics(uuid, date, date)) add GRANT EXECUTE
ON FUNCTION ... TO authenticated, anon (or the appropriate roles) at the end of
the migration and consider REVOKE EXECUTE ON FUNCTION ... FROM PUBLIC if you
want to remove the default public execute privilege so the authorization model
is auditable and explicit.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@supabase/migrations/20260226100000_fix_metrics_rpcs_org_authorization.sql`:
- Around line 173-208: Remove the redundant authorization block that duplicates
get_app_metrics' checks: delete the v_is_service_role/v_user_id check and the IF
NOT v_is_service_role ... END IF; block (including the calls to
public.get_identity, public.check_min_rights, public.pg_log and the early
RETURN) so this function simply calls public.get_app_metrics and returns its
aggregated results; keep the initial v_is_service_role assignment only if used
elsewhere, otherwise remove its declaration too.

---

Nitpick comments:
In `@supabase/migrations/20260226100000_fix_metrics_rpcs_org_authorization.sql`:
- Around line 1-3: Add explicit GRANT/REVOKE statements for the created RPC
functions to document and lock down access intent: for each function created
(get_app_metrics(uuid), get_app_metrics(uuid, date, date),
get_global_metrics(uuid), get_global_metrics(uuid, date, date),
get_total_metrics(uuid), get_total_metrics(uuid, date, date)) add GRANT EXECUTE
ON FUNCTION ... TO authenticated, anon (or the appropriate roles) at the end of
the migration and consider REVOKE EXECUTE ON FUNCTION ... FROM PUBLIC if you
want to remove the default public execute privilege so the authorization model
is auditable and explicit.

---

ℹ️ Review info

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 4ab763b and cc2a1dd.

📒 Files selected for processing (1)

• supabase/migrations/20260226100000_fix_metrics_rpcs_org_authorization.sql

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud