Restrict API-key oracle RPCs from anon

[riderx]

Summary (AI generated)

• Removed anonymous RPC grants for public.get_org_perm_for_apikey and public.get_user_id in the base migration.
• Added a follow-up migration to revoke EXECUTE for anon on the same API-key introspection RPC signatures.

Motivation (AI generated)

• The public anon access enabled key-existence and permission/app-enumeration oracles, which increased the impact of leaked API keys.

Business Impact (AI generated)

• This hardens API key handling by eliminating unauthenticated enumeration paths while preserving authenticated and service-role behavior.

Test Plan (AI generated)

• Ran bun lint after the migration updates.
• Reviewed git diff and git diff origin/main... to verify only the intended grant and revoke changes.
• Run targeted Supabase migration/test flow for the RPC permission checks when available.

Screenshots

Not applicable (backend SQL migrations only).

Summary by CodeRabbit

• Security
  • Restricted unauthenticated access to sensitive API authentication and permission verification functions. Only authenticated users and service accounts can now execute these operations, improving overall system security by preventing unauthorized introspection of API keys and user permissions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 4ab763b and 2b59eab.

📒 Files selected for processing (2)

• supabase/migrations/20250530233128_base.sql
• supabase/migrations/20260226153000_restrict_apikey_oracle_rpcs.sql

💤 Files with no reviewable changes (1)

• supabase/migrations/20250530233128_base.sql

---

📝 Walkthrough

Walkthrough

This pull request revokes anonymous access to three API-key introspection functions across two database migration files, restricting execute privileges on public.get_org_perm_for_apikey() and two variants of public.get_user_id() from the anonymous role while maintaining access for authenticated and service_role users.

Changes

Cohort / File(s)	Summary
Database Privilege Migrations supabase/migrations/20250530233128_base.sql, supabase/migrations/20260226153000_restrict_apikey_oracle_rpcs.sql	Identical REVOKE statements removing EXECUTE privileges on the anon role for three function signatures: get_org_perm_for_apikey(apikey text, app_id text), get_user_id(apikey text), and get_user_id(apikey text, app_id text). Access remains available for authenticated and service_role users.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• fix(security): revoke anon access to apikey oracle RPCs #1670: Makes identical REVOKE changes on the same three RPC function signatures to restrict anonymous access.
• fix: make is_allowed_capgkey support hashed API keys #1366: Modifies public.get_user_id() RPC implementation to support hashed API keys, complementing this PR's access restriction.

Suggested labels

💰 Rewarded

Poem

🐰 Anonymous door locked tight today,
API keys now hidden away,
Only the trusted may peek and see,
Permissions guarded with certainty! 🔐

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Restrict API-key oracle RPCs from anon' accurately and concisely describes the main change: removing anonymous access to API-key introspection functions.
Description check	✅ Passed	The PR description covers summary, motivation, and business impact, though the test plan section has incomplete checkboxes and lacks detailed reproduction steps as specified in the template.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch riderx/fix-apikey-oracles

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 SQLFluff (4.0.4)

supabase/migrations/20260226153000_restrict_apikey_oracle_rpcs.sql

User Error: No dialect was specified. You must configure a dialect or specify one on the command line using --dialect after the command. Available dialects:
ansi, athena, bigquery, clickhouse, databricks, db2, doris, duckdb, exasol, flink, greenplum, hive, impala, mariadb, materialize, mysql, oracle, postgres, redshift, snowflake, soql, sparksql, sqlite, starrocks, teradata, trino, tsql, vertica

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2b59eab3dd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep historical migration files immutable

This commit modifies 20250530233128_base.sql, but /workspace/capgo/AGENTS.md explicitly requires you to “never edit previously committed migrations.” Rewriting an already-applied migration makes schema history non-immutable and can create drift/confusion between environments that already ran the original file and fresh environments that replay the edited file; this hardening should live only in a new migration.

Useful? React with 👍 / 👎.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud