@supacloud/lite 0.29.0 → 0.29.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.29.1](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.29.0...supacloud-lite-v0.29.1) (2026-10-15)
+
+
+### Bug Fixes
+
+* **lite:** enforce read-only table and view requests ([#1941](https://github.com/vibeunion/supacloud/issues/1941)) ([d726716](https://github.com/vibeunion/supacloud/commit/d726716a1492a5a581f99a1aa40f15a1125a23aa))
+
 ## [0.29.0](https://github.com/vibeunion/supacloud/compare/supacloud-lite-v0.28.3...supacloud-lite-v0.29.0) (2026-10-15)
 
 

package/dist/cli.js

@@ -8,7 +8,7 @@ import { dirname as dirname8, join as join10, resolve as resolve6 } from "path";
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.29.0",
+  version: "0.29.1",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -8365,10 +8365,10 @@ function renderFilter(f, alias) {
 }
 
 // src/runtime/rest/errors.ts
-function statusForSqlState(code) {
+function statusForSqlState(code, authenticated = true) {
   switch (code) {
     case "42501":
-      return 403;
+      return authenticated ? 403 : 401;
     case "25006":
       return 405;
     case "23503":
@@ -8386,7 +8386,7 @@ function statusForSqlState(code) {
       return 400;
   }
 }
-function errorToResponse(e) {
+function errorToResponse(e, authenticated = true) {
   if (e instanceof ApiError) {
     return jsonResponse(e.status, e.body);
   }
@@ -8395,7 +8395,7 @@ function errorToResponse(e) {
   }
   const pg = e;
   if (pg && typeof pg.code === "string" && /^[0-9A-Z]{5}$/.test(pg.code)) {
-    return jsonResponse(statusForSqlState(pg.code), {
+    return jsonResponse(statusForSqlState(pg.code, authenticated), {
       code: pg.code,
       message: pg.message,
       details: pg.detail ?? null,
@@ -8515,7 +8515,7 @@ class RestHandler {
       }
       return await this.handleTable(req, ctx, url, schema, decodeURIComponent(rest));
     } catch (e) {
-      return errorToResponse(e);
+      return errorToResponse(e, ctx.role !== "anon");
     }
   }
   async handleTable(req, ctx, url, schema, table) {
@@ -8543,7 +8543,10 @@ class RestHandler {
             ...explain.options.map((o) => o.toUpperCase()),
             `FORMAT ${explain.format}`
           ].join(", ");
-          const res = await this.db.withContext(ctx, (query) => query(`explain (${explainOpts}) ${plan.sql}`, plan.params));
+          const res = await this.db.withContext(ctx, async (query) => {
+            await query("set transaction read only");
+            return query(`explain (${explainOpts}) ${plan.sql}`, plan.params);
+          });
           const cell = res.rows[0]["QUERY PLAN"];
           if (explain.format === "JSON") {
             const body = typeof cell === "string" ? cell : JSON.stringify(cell);
@@ -8561,6 +8564,7 @@ class RestHandler {
         }
         const built = builder.buildSelect(table, { count: prefer.count !== undefined });
         const { rows, count } = await this.db.withContext(ctx, async (query) => {
+          await query("set transaction read only");
           const res = await query(built.sql, built.params);
           let count = null;
           if (built.countSql) {
@@ -8716,6 +8720,8 @@ class RestHandler {
     const fn = pickOverload(fns, Object.keys(args));
     const call = renderCall(schema, fn, args);
     const q = parseQuery(searchParams);
+    if (method === "GET" || method === "HEAD")
+      applyRequestRange(q, req);
     if (fn.volatility === "v") {
       return await this.runRpc(ctx, fn, call, q, prefer, wantsObject, wantsCsv, schema, method).finally(() => this.db.invalidateSchemaCache());
     }
@@ -8740,6 +8746,10 @@ class RestHandler {
       const res = await withRpcContext((query) => query(`select coalesce(json_agg(_v), '[]'::json) as body from ${call} as _t(_v)`, []));
       return jsonResponse(200, res.rows[0].body);
     }
+    if (this.maxRows !== undefined) {
+      const requested = q.limits.get("");
+      q.limits.set("", requested === undefined ? this.maxRows : Math.min(requested, this.maxRows));
+    }
     const alias = "_f";
     const exprs = [];
     for (const item of q.select) {
@@ -8795,6 +8805,7 @@ function assertObjectCardinality(rows) {
 }
 function pickOverload(fns, providedNames) {
   const provided = new Set(providedNames);
+  const exact = [];
   let best = null;
   for (const fn of fns) {
     const names = new Set(fn.args.map((a) => a.name));
@@ -8802,11 +8813,20 @@ function pickOverload(fns, providedNames) {
     if (!allProvidedKnown)
       continue;
     if (fn.args.length === provided.size)
-      return fn;
+      exact.push(fn);
     if (!best)
       best = fn;
   }
-  return best ?? fns[0];
+  if (exact.length > 1) {
+    const candidates = exact.map((fn) => `${fn.schema}.${fn.name}(${fn.args.map((arg) => `${arg.name} => ${arg.type}`).join(", ")})`);
+    throw new ApiError(300, {
+      code: "PGRST203",
+      message: `Could not choose the best candidate function between: ${candidates.join(", ")}`,
+      details: null,
+      hint: "Try renaming the parameters or the function itself in the database so function overloading can be resolved"
+    });
+  }
+  return exact[0] ?? best ?? fns[0];
 }
 function renderCall(schema, fn, args) {
   const parts = [];

package/dist/index.js

@@ -88,7 +88,7 @@ function randomToken(bytes = 32) {
 // package.json
 var package_default = {
   name: "@supacloud/lite",
-  version: "0.29.0",
+  version: "0.29.1",
   description: "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   type: "module",
   license: "Apache-2.0",
@@ -8359,10 +8359,10 @@ function renderFilter(f, alias) {
 }
 
 // src/runtime/rest/errors.ts
-function statusForSqlState(code) {
+function statusForSqlState(code, authenticated = true) {
   switch (code) {
     case "42501":
-      return 403;
+      return authenticated ? 403 : 401;
     case "25006":
       return 405;
     case "23503":
@@ -8380,7 +8380,7 @@ function statusForSqlState(code) {
       return 400;
   }
 }
-function errorToResponse(e) {
+function errorToResponse(e, authenticated = true) {
   if (e instanceof ApiError) {
     return jsonResponse(e.status, e.body);
   }
@@ -8389,7 +8389,7 @@ function errorToResponse(e) {
   }
   const pg = e;
   if (pg && typeof pg.code === "string" && /^[0-9A-Z]{5}$/.test(pg.code)) {
-    return jsonResponse(statusForSqlState(pg.code), {
+    return jsonResponse(statusForSqlState(pg.code, authenticated), {
       code: pg.code,
       message: pg.message,
       details: pg.detail ?? null,
@@ -8509,7 +8509,7 @@ class RestHandler {
       }
       return await this.handleTable(req, ctx, url, schema, decodeURIComponent(rest));
     } catch (e) {
-      return errorToResponse(e);
+      return errorToResponse(e, ctx.role !== "anon");
     }
   }
   async handleTable(req, ctx, url, schema, table) {
@@ -8537,7 +8537,10 @@ class RestHandler {
             ...explain.options.map((o) => o.toUpperCase()),
             `FORMAT ${explain.format}`
           ].join(", ");
-          const res = await this.db.withContext(ctx, (query) => query(`explain (${explainOpts}) ${plan.sql}`, plan.params));
+          const res = await this.db.withContext(ctx, async (query) => {
+            await query("set transaction read only");
+            return query(`explain (${explainOpts}) ${plan.sql}`, plan.params);
+          });
           const cell = res.rows[0]["QUERY PLAN"];
           if (explain.format === "JSON") {
             const body = typeof cell === "string" ? cell : JSON.stringify(cell);
@@ -8555,6 +8558,7 @@ class RestHandler {
         }
         const built = builder.buildSelect(table, { count: prefer.count !== undefined });
         const { rows, count } = await this.db.withContext(ctx, async (query) => {
+          await query("set transaction read only");
           const res = await query(built.sql, built.params);
           let count = null;
           if (built.countSql) {
@@ -8710,6 +8714,8 @@ class RestHandler {
     const fn = pickOverload(fns, Object.keys(args));
     const call = renderCall(schema, fn, args);
     const q = parseQuery(searchParams);
+    if (method === "GET" || method === "HEAD")
+      applyRequestRange(q, req);
     if (fn.volatility === "v") {
       return await this.runRpc(ctx, fn, call, q, prefer, wantsObject, wantsCsv, schema, method).finally(() => this.db.invalidateSchemaCache());
     }
@@ -8734,6 +8740,10 @@ class RestHandler {
       const res = await withRpcContext((query) => query(`select coalesce(json_agg(_v), '[]'::json) as body from ${call} as _t(_v)`, []));
       return jsonResponse(200, res.rows[0].body);
     }
+    if (this.maxRows !== undefined) {
+      const requested = q.limits.get("");
+      q.limits.set("", requested === undefined ? this.maxRows : Math.min(requested, this.maxRows));
+    }
     const alias = "_f";
     const exprs = [];
     for (const item of q.select) {
@@ -8789,6 +8799,7 @@ function assertObjectCardinality(rows) {
 }
 function pickOverload(fns, providedNames) {
   const provided = new Set(providedNames);
+  const exact = [];
   let best = null;
   for (const fn of fns) {
     const names = new Set(fn.args.map((a) => a.name));
@@ -8796,11 +8807,20 @@ function pickOverload(fns, providedNames) {
     if (!allProvidedKnown)
       continue;
     if (fn.args.length === provided.size)
-      return fn;
+      exact.push(fn);
     if (!best)
       best = fn;
   }
-  return best ?? fns[0];
+  if (exact.length > 1) {
+    const candidates = exact.map((fn) => `${fn.schema}.${fn.name}(${fn.args.map((arg) => `${arg.name} => ${arg.type}`).join(", ")})`);
+    throw new ApiError(300, {
+      code: "PGRST203",
+      message: `Could not choose the best candidate function between: ${candidates.join(", ")}`,
+      details: null,
+      hint: "Try renaming the parameters or the function itself in the database so function overloading can be resolved"
+    });
+  }
+  return exact[0] ?? best ?? fns[0];
 }
 function renderCall(schema, fn, args) {
   const parts = [];

package/dist/runtime/rest/errors.d.ts

@@ -1,11 +1,11 @@
 /** HTTP status for a Postgres SQLSTATE, following PostgREST's mapping. */
-export declare function statusForSqlState(code: string): number;
+export declare function statusForSqlState(code: string, authenticated?: boolean): number;
 /**
  * Normalize any thrown value into a JSON Response: ApiError/ParseError keep
  * their status; anything with a 5-char SQLSTATE is mapped via
  * {@link statusForSqlState}; everything else becomes a 500.
  */
-export declare function errorToResponse(e: unknown): Response;
+export declare function errorToResponse(e: unknown, authenticated?: boolean): Response;
 /** JSON Response helper; status 204 sends no body. */
 export declare function jsonResponse(status: number, body: unknown, headers?: Record<string, string>): Response;
 //# sourceMappingURL=errors.d.ts.map

package/dist/runtime/rest/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/runtime/rest/errors.ts"],"names":[],"mappings":"AAQA,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAoBtD;AAUD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,QAAQ,CAkBpD;AAED,sDAAsD;AACtD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EACb,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACnC,QAAQ,CAKV"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/runtime/rest/errors.ts"],"names":[],"mappings":"AAQA,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,UAAO,GAAG,MAAM,CAoB5E;AAUD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,UAAO,GAAG,QAAQ,CAkB1E;AAED,sDAAsD;AACtD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,EACb,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACnC,QAAQ,CAKV"}

package/dist/runtime/rest/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/rest/handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAA4B,KAAK,QAAQ,EAAmC,MAAM,mBAAmB,CAAA;AAC5G,OAAO,EAAY,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AAyF3D,oFAAoF;AACpF,qBAAa,WAAW;IAOpB,OAAO,CAAC,EAAE;IANZ,8FAA8F;IAC9F,OAAO,CAAC,cAAc,CAAU;IAChC,8EAA8E;IAC9E,OAAO,CAAC,OAAO,CAAC,CAAQ;gBAGd,EAAE,EAAE,QAAQ,EACpB,IAAI,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;IAMxD,4FAA4F;IACtF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;YAmC9D,WAAW;YAsHX,WAAW;IAgDzB,OAAO,CAAC,YAAY;YAqCN,SAAS;YAqET,MAAM;CA4FrB"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/runtime/rest/handler.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAA4B,KAAK,QAAQ,EAAmC,MAAM,mBAAmB,CAAA;AAC5G,OAAO,EAAY,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AAyF3D,oFAAoF;AACpF,qBAAa,WAAW;IAOpB,OAAO,CAAC,EAAE;IANZ,8FAA8F;IAC9F,OAAO,CAAC,cAAc,CAAU;IAChC,8EAA8E;IAC9E,OAAO,CAAC,OAAO,CAAC,CAAQ;gBAGd,EAAE,EAAE,QAAQ,EACpB,IAAI,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;IAMxD,4FAA4F;IACtF,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;YAmC9D,WAAW;YAyHX,WAAW;IAgDzB,OAAO,CAAC,YAAY;YAqCN,SAAS;YAsET,MAAM;CAgGrB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/lite",
-  "version": "0.29.0",
+  "version": "0.29.1",
   "description": "Bun-native, single-project Supabase-compatible backend powered by PGlite or native PostgreSQL",
   "type": "module",
   "license": "Apache-2.0",