@fayz-ai/plugin-automations 0.15.3 → 0.15.4

package/dist/index.js

@@ -3089,9 +3089,41 @@ CREATE OR REPLACE VIEW public.v_automations_flow_steps WITH (security_invoker='t
 GRANT SELECT ON public.v_automations_flow_steps TO authenticated;
 GRANT SELECT ON public.v_automations_flow_steps TO service_role;
 `;
+var MIGRATION_002_THE_ENGINE_IS_SERVER_ONLY = `-- 002_the_engine_is_server_only.sql
+--
+-- 001 meant the cadence engine to be service_role only, and wrote
+-- \`REVOKE ALL ... FROM PUBLIC\`. That does not undo the pool's default
+-- privileges, which grant EXECUTE to \`authenticated\` on every new function in
+-- public \u2014 so on the live pool any logged-in user of any tenant could enrol a
+-- person into another tenant's flow, exit them, or advance every tenant's
+-- cadences at once, all SECURITY DEFINER with no caller check.
+--
+-- Callers are all server-side: \`event_runner_tick\` (pg_cron, as postgres)
+-- calls \`automations_flows_run_due\`, the event log calls the two handlers, and
+-- the handlers call enrol/exit. No screen, edge function or agent tool does.
+-- \`automations_flow_exit\` was granted to \`authenticated\` for a manual
+-- "take this person out" that was never built; it goes too, and comes back
+-- behind a tenant + permission check when a screen needs it.
+
+REVOKE ALL ON FUNCTION public.automations_flow_enroll(uuid, uuid, uuid, text, uuid) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.automations_flow_enroll(uuid, uuid, uuid, text, uuid) TO service_role;
+
+REVOKE ALL ON FUNCTION public.automations_flow_exit(uuid, uuid, text, uuid[]) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.automations_flow_exit(uuid, uuid, text, uuid[]) TO service_role;
+
+REVOKE ALL ON FUNCTION public.automations_flows_run_due(integer) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.automations_flows_run_due(integer) TO service_role;
+
+REVOKE ALL ON FUNCTION public.plg_automations_on_entry_event(jsonb) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.plg_automations_on_entry_event(jsonb) TO service_role;
+
+REVOKE ALL ON FUNCTION public.plg_automations_on_exit_event(jsonb) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.plg_automations_on_exit_event(jsonb) TO service_role;
+`;
 var MIGRATIONS = [
   { id: "000_baseline", sql: MIGRATION_000_BASELINE },
-  { id: "001_the_flow_has_steps", sql: MIGRATION_001_THE_FLOW_HAS_STEPS }
+  { id: "001_the_flow_has_steps", sql: MIGRATION_001_THE_FLOW_HAS_STEPS },
+  { id: "002_the_engine_is_server_only", sql: MIGRATION_002_THE_ENGINE_IS_SERVER_ONLY }
 ];
 
 // src/index.ts