@plutocms/supabase 0.11.1 → 0.11.2

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [0.11.2](https://github.com/plutocms/supabase/compare/v0.11.1...v0.11.2) (2026-10-22)
+
+
+### Bug Fixes
+
+* **db:** grant Data API access explicitly and restrict staff reads ([#93](https://github.com/plutocms/supabase/issues/93)) ([0ed2d56](https://github.com/plutocms/supabase/commit/0ed2d56c593ed6550312692e125ba75525f5fd69))
+* **typegen:** keep the PostgREST version block and match the app's lint output ([#94](https://github.com/plutocms/supabase/issues/94)) ([38ec3ea](https://github.com/plutocms/supabase/commit/38ec3ea5e49ef559cfc8142bbbfff401f934cd22))
+
 ## [0.11.1](https://github.com/plutocms/supabase/compare/v0.11.0...v0.11.1) (2026-10-21)
 
 

package/db/migrations/006_data_api_grants.sql

@@ -0,0 +1,48 @@
+-- Data API grants
+--
+-- From 2026-10-30, Supabase stops granting Data API access to new tables
+-- in the public schema on its own. A table that a migration creates needs
+-- an explicit grant, or the API answers "permission denied" (42501).
+--
+-- This file grants the minimal privileges that the RLS policies of this
+-- layer already allow. It changes nothing on an older database: those
+-- tables already hold broader privileges, and grant is additive. Every
+-- statement is safe to run twice.
+--
+-- Rules: anon gets select only, and only on a table with a public read
+-- policy. service_role gets select, insert, update and delete. No file
+-- grants truncate, references, trigger or all.
+
+-- healthcheck: the setup check reads it without a login.
+grant select on public.healthcheck to anon;
+grant select, update on public.healthcheck to authenticated;
+
+-- settings: the policies allow select, insert and update.
+grant select, insert, update on public.settings to authenticated;
+
+-- profiles: select only. A write goes through a security definer function.
+grant select on public.profiles to authenticated;
+
+-- pluto_migrations: the admin reads the migration status.
+grant select on public.pluto_migrations to authenticated;
+
+-- Role tables: today's behavior. Every write policy needs public.is_admin().
+grant select, insert, update, delete on public.roles to authenticated;
+grant select, insert, update, delete on public.role_capabilities to authenticated;
+grant select, insert, update, delete on public.user_roles to authenticated;
+
+-- service_role: select, insert, update and delete on every table.
+grant select, insert, update, delete on public.healthcheck to service_role;
+grant select, insert, update, delete on public.settings to service_role;
+grant select, insert, update, delete on public.profiles to service_role;
+grant select, insert, update, delete on public.pluto_migrations to service_role;
+grant select, insert, update, delete on public.roles to service_role;
+grant select, insert, update, delete on public.role_capabilities to service_role;
+grant select, insert, update, delete on public.user_roles to service_role;
+
+-- Functions. Postgres already gives execute to public. These grants are
+-- explicit, so the access does not depend on that default.
+grant execute on function public.is_admin() to authenticated, service_role;
+grant execute on function public.has_capability(text) to authenticated, service_role;
+grant execute on function public.my_capabilities() to authenticated, service_role;
+grant execute on function public.set_my_locale(text) to authenticated;

package/db/migrations/007_restrict_staff_reads.sql

@@ -0,0 +1,58 @@
+-- Restrict staff reads
+--
+-- Sign-up is open. Before this file, any signed-in user could read every
+-- row of settings, pluto_migrations, roles and role_capabilities, because
+-- the select policies used "using (true)". This file narrows them.
+--
+-- settings: a user who holds at least one capability (staff) reads them.
+--   The admin bar loads the site name and URL for every staff user.
+-- pluto_migrations: only an admin reads it. The migrations page is
+--   admin only (requireAdmin -> public.is_admin()).
+-- roles, role_capabilities: only an admin reads them. Only security
+--   definer functions read them for other users.
+--
+-- dashboard_user keeps its access where it had access before. Every
+-- statement is safe to run twice.
+
+-- settings
+drop policy if exists "Enable read access for authenticated users on settings" on public.settings;
+drop policy if exists "Enable read access for staff on settings" on public.settings;
+
+create policy "Enable read access for staff on settings"
+on public.settings
+for select
+to authenticated, dashboard_user
+using (
+  current_user = 'dashboard_user'
+  or exists (select 1 from public.my_capabilities())
+);
+
+-- pluto_migrations
+drop policy if exists "Enable read access for authenticated users on pluto_migrations" on public.pluto_migrations;
+drop policy if exists "Enable read access for admins on pluto_migrations" on public.pluto_migrations;
+
+create policy "Enable read access for admins on pluto_migrations"
+on public.pluto_migrations
+for select
+to authenticated, dashboard_user
+using (current_user = 'dashboard_user' or public.is_admin());
+
+-- roles
+drop policy if exists "Enable read access for authenticated users on roles" on public.roles;
+drop policy if exists "Enable read access for admins on roles" on public.roles;
+
+create policy "Enable read access for admins on roles"
+on public.roles
+for select
+to authenticated
+using (public.is_admin());
+
+-- role_capabilities
+drop policy if exists "Enable read access for authenticated users on role_capabilities" on public.role_capabilities;
+drop policy if exists "Enable read access for admins on role_capabilities" on public.role_capabilities;
+
+create policy "Enable read access for admins on role_capabilities"
+on public.role_capabilities
+for select
+to authenticated
+using (public.is_admin());

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@plutocms/supabase",
   "type": "module",
-  "version": "0.11.1",
+  "version": "0.11.2",
   "trustedDependencies": [
     "@parcel/watcher",
     "@plutocms/pluto",

package/server/utils/typegen.ts

@@ -14,13 +14,21 @@ const execFileAsync = promisify(execFile)
  * directly via --db-url).
  */
 function resolveSupabaseBin(rootDir: string): string {
-  const binName = process.platform === 'win32' ? 'supabase.cmd' : 'supabase'
-  const localBin = join(rootDir, 'node_modules/.bin', binName)
-  return existsSync(localBin) ? localBin : 'supabase'
+  // On Windows, npm installs `supabase.cmd` and Bun installs `supabase.exe`.
+  const binNames = process.platform === 'win32'
+    ? ['supabase.cmd', 'supabase.exe']
+    : ['supabase']
+  const localBin = binNames
+    .map((name) => join(rootDir, 'node_modules/.bin', name))
+    .find((path) => existsSync(path))
+  return localBin ?? 'supabase'
 }
 
 // The block, with its leading comment lines. The block has no nested braces.
 const INTERNAL_BLOCK = /(?:^[ \t]*\/\/[^\n]*\n)*^[ \t]*__InternalSupabase:\s*\{[^{}]*\}[ \t]*\n/m
+// The block itself. The name alone is not enough: the output also has it in
+// `Omit<Database, '__InternalSupabase'>`.
+const HAS_BLOCK = /^[ \t]*__InternalSupabase:\s*\{/m
 const DATABASE_OPEN = /^export type Database = \{[ \t]*\n/m
 
 /**
@@ -36,7 +44,7 @@ export function keepInternalSupabase(
   next: string,
   existing: string | null
 ): string {
-  if (!existing || next.includes('__InternalSupabase')) {
+  if (!existing || HAS_BLOCK.test(next)) {
     return next
   }
 
@@ -48,8 +56,41 @@ export function keepInternalSupabase(
   }
 
   const at = open.index + open[0].length
+  // The CLI writes a whitespace-only line after the opening brace. After the
+  // block it would stay as a blank line, so remove it.
+  const rest = next.slice(at).replace(/^(?:[ \t]*\n)+/, '')
 
-  return next.slice(0, at) + block + next.slice(at)
+  return next.slice(0, at) + block + rest
+}
+
+/**
+ * Imports a package from the app's node_modules (resolved from `rootDir`).
+ */
+async function importFromApp(rootDir: string, name: string) {
+  const entry = createRequire(join(rootDir, 'package.json')).resolve(name)
+  const mod = await import(pathToFileURL(entry).href)
+  return mod.default ?? mod
+}
+
+/**
+ * Fixes the text with the ESLint of the app. It resolves ESLint and the
+ * app's config from `rootDir`. It returns the text unchanged when the app
+ * has no ESLint, when ESLint ignores the file, or when the fix fails.
+ */
+async function fixWithAppEslint(
+  rootDir: string,
+  filePath: string,
+  text: string
+): Promise<string> {
+  try {
+    const { ESLint } = await importFromApp(rootDir, 'eslint')
+    const eslint = new ESLint({ cwd: rootDir, fix: true })
+    const [result] = await eslint.lintText(text, { filePath })
+
+    return result?.output ?? text
+  } catch {
+    return text
+  }
 }
 
 /**
@@ -63,11 +104,7 @@ async function formatWithAppPrettier(
   text: string
 ): Promise<string> {
   try {
-    const entry = createRequire(join(rootDir, 'package.json')).resolve(
-      'prettier'
-    )
-    const prettier = await import(pathToFileURL(entry).href)
-    const api = prettier.default ?? prettier
+    const api = await importFromApp(rootDir, 'prettier')
     const options = (await api.resolveConfig(filePath)) ?? {}
 
     return await api.format(text, { ...options, filepath: filePath })
@@ -115,11 +152,14 @@ export async function regenerateSupabaseTypes(
       ? readFileSync(targetPath, 'utf-8')
       : null
 
-    const processed = await formatWithAppPrettier(
+    // The same steps as a usual `lint:fix`: ESLint first, then Prettier. So
+    // an unchanged schema gives the same text as the committed file.
+    const fixed = await fixWithAppEslint(
       rootDir,
       targetPath,
       keepInternalSupabase(stdout, existing)
     )
+    const processed = await formatWithAppPrettier(rootDir, targetPath, fixed)
 
     if (existing === processed) {
       return