opencode-supabase 0.1.1 → 0.1.2-alpha.1

package/skills/supabase-postgres-best-practices/references/security-privileges.md

@@ -0,0 +1,54 @@
+---
+title: Apply Principle of Least Privilege
+impact: MEDIUM
+impactDescription: Reduced attack surface, better audit trail
+tags: privileges, security, roles, permissions
+---
+
+## Apply Principle of Least Privilege
+
+Grant only the minimum permissions required. Never use superuser for application queries.
+
+**Incorrect (overly broad permissions):**
+
+```sql
+-- Application uses superuser connection
+-- Or grants ALL to application role
+grant all privileges on all tables in schema public to app_user;
+grant all privileges on all sequences in schema public to app_user;
+
+-- Any SQL injection becomes catastrophic
+-- drop table users; cascades to everything
+```
+
+**Correct (minimal, specific grants):**
+
+```sql
+-- Create role with no default privileges
+create role app_readonly nologin;
+
+-- Grant only SELECT on specific tables
+grant usage on schema public to app_readonly;
+grant select on public.products, public.categories to app_readonly;
+
+-- Create role for writes with limited scope
+create role app_writer nologin;
+grant usage on schema public to app_writer;
+grant select, insert, update on public.orders to app_writer;
+grant usage on sequence orders_id_seq to app_writer;
+-- No DELETE permission
+
+-- Login role inherits from these
+create role app_user login password 'xxx';
+grant app_writer to app_user;
+```
+
+Revoke public defaults:
+
+```sql
+-- Revoke default public access
+revoke all on schema public from public;
+revoke all on all tables in schema public from public;
+```
+
+Reference: [Roles and Privileges](https://supabase.com/blog/postgres-roles-and-privileges)

package/skills/supabase-postgres-best-practices/references/security-rls-basics.md

@@ -0,0 +1,50 @@
+---
+title: Enable Row Level Security for Multi-Tenant Data
+impact: CRITICAL
+impactDescription: Database-enforced tenant isolation, prevent data leaks
+tags: rls, row-level-security, multi-tenant, security
+---
+
+## Enable Row Level Security for Multi-Tenant Data
+
+Row Level Security (RLS) enforces data access at the database level, ensuring users only see their own data.
+
+**Incorrect (application-level filtering only):**
+
+```sql
+-- Relying only on application to filter
+select * from orders where user_id = $current_user_id;
+
+-- Bug or bypass means all data is exposed!
+select * from orders;  -- Returns ALL orders
+```
+
+**Correct (database-enforced RLS):**
+
+```sql
+-- Enable RLS on the table
+alter table orders enable row level security;
+
+-- Create policy for users to see only their orders
+create policy orders_user_policy on orders
+  for all
+  using (user_id = current_setting('app.current_user_id')::bigint);
+
+-- Force RLS even for table owners
+alter table orders force row level security;
+
+-- Set user context and query
+set app.current_user_id = '123';
+select * from orders;  -- Only returns orders for user 123
+```
+
+Policy for authenticated role:
+
+```sql
+create policy orders_user_policy on orders
+  for all
+  to authenticated
+  using (user_id = auth.uid());
+```
+
+Reference: [Row Level Security](https://supabase.com/docs/guides/database/postgres/row-level-security)

package/skills/supabase-postgres-best-practices/references/security-rls-performance.md

@@ -0,0 +1,57 @@
+---
+title: Optimize RLS Policies for Performance
+impact: HIGH
+impactDescription: 5-10x faster RLS queries with proper patterns
+tags: rls, performance, security, optimization
+---
+
+## Optimize RLS Policies for Performance
+
+Poorly written RLS policies can cause severe performance issues. Use subqueries and indexes strategically.
+
+**Incorrect (function called for every row):**
+
+```sql
+create policy orders_policy on orders
+  using (auth.uid() = user_id);  -- auth.uid() called per row!
+
+-- With 1M rows, auth.uid() is called 1M times
+```
+
+**Correct (wrap functions in SELECT):**
+
+```sql
+create policy orders_policy on orders
+  using ((select auth.uid()) = user_id);  -- Called once, cached
+
+-- 100x+ faster on large tables
+```
+
+Use security definer functions for complex checks:
+
+```sql
+-- Create helper function (runs as definer, bypasses RLS)
+create or replace function is_team_member(team_id bigint)
+returns boolean
+language sql
+security definer
+set search_path = ''
+as $$
+  select exists (
+    select 1 from public.team_members
+    where team_id = $1 and user_id = (select auth.uid())
+  );
+$$;
+
+-- Use in policy (indexed lookup, not per-row check)
+create policy team_orders_policy on orders
+  using ((select is_team_member(team_id)));
+```
+
+Always add indexes on columns used in RLS policies:
+
+```sql
+create index orders_user_id_idx on orders (user_id);
+```
+
+Reference: [RLS Performance](https://supabase.com/docs/guides/database/postgres/row-level-security#rls-performance-recommendations)

package/src/server/index.ts

@@ -2,6 +2,7 @@ import type { Plugin } from "@opencode-ai/plugin";
 
 import { createServerLogWriter, createSupabaseLogger } from "../shared/log.ts";
 import { createSupabaseAuth } from "./auth.ts";
+import { registerSupabaseSkillPaths } from "./skills.ts";
 import { createSupabaseTools } from "./tools.ts";
 
 const server: Plugin = async (input, options) => {
@@ -10,6 +11,11 @@ const server: Plugin = async (input, options) => {
   });
 
   return {
+    config: async (config) => {
+      registerSupabaseSkillPaths(config, options, {
+        warn: logger.warn,
+      });
+    },
     auth: createSupabaseAuth(input, options, { logger }),
     tool: createSupabaseTools(input, options, { logger }),
   };

package/src/server/skills.ts

@@ -0,0 +1,111 @@
+import fs from "node:fs";
+import path from "node:path";
+
+export const BUNDLED_SUPABASE_SKILLS = [
+  "supabase",
+  "supabase-postgres-best-practices",
+] as const;
+
+export type BundledSupabaseSkill = (typeof BUNDLED_SUPABASE_SKILLS)[number];
+
+type Warn = (message: string, data?: Record<string, unknown>) => unknown;
+
+type ResolverDeps = {
+  warn?: Warn;
+};
+
+type RegisterDeps = ResolverDeps & {
+  skillsRoot?: string;
+  exists?: (path: string) => boolean;
+};
+
+type ConfigWithSkills = object & {
+  skills?: {
+    paths?: unknown;
+  } | false;
+};
+
+type SkillsConfig = {
+  paths?: unknown;
+} & Record<string, unknown>;
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function pluginSkillsOption(options: unknown) {
+  if (!isRecord(options) || !("skills" in options)) return true;
+  return (options as { skills?: unknown }).skills;
+}
+
+export function resolveEnabledSupabaseSkills(options: unknown, deps: ResolverDeps = {}) {
+  const value = pluginSkillsOption(options);
+  if (value === false) return [];
+  if (value === true || value === undefined) return [...BUNDLED_SUPABASE_SKILLS];
+
+  if (!isRecord(value)) {
+    deps.warn?.("invalid Supabase skills option; loading bundled skills", { value });
+    return [...BUNDLED_SUPABASE_SKILLS];
+  }
+
+  const known = new Set<string>(BUNDLED_SUPABASE_SKILLS);
+  for (const key of Object.keys(value)) {
+    if (!known.has(key)) {
+      deps.warn?.("unknown Supabase bundled skill option ignored", { skill: key });
+      continue;
+    }
+    if (value[key] !== undefined && typeof value[key] !== "boolean") {
+      deps.warn?.("invalid Supabase bundled skill option value", {
+        skill: key,
+        value: value[key] as unknown,
+      });
+    }
+  }
+
+  return BUNDLED_SUPABASE_SKILLS.filter((skill) => value[skill] !== false);
+}
+
+export function defaultSkillsRoot() {
+  return path.resolve(path.dirname(new URL(import.meta.url).pathname), "../../skills");
+}
+
+export function registerSupabaseSkillPaths(
+  config: object,
+  options: unknown,
+  deps: RegisterDeps = {},
+) {
+  const configWithSkills = config as ConfigWithSkills;
+  const skillsRoot = deps.skillsRoot ?? defaultSkillsRoot();
+  const exists = deps.exists ?? fs.existsSync;
+  const enabled = resolveEnabledSupabaseSkills(options, deps);
+  const skillsConfig: SkillsConfig = isRecord(configWithSkills.skills)
+    ? (configWithSkills.skills as SkillsConfig)
+    : {};
+
+  if (!isRecord(configWithSkills.skills)) {
+    configWithSkills.skills = skillsConfig;
+  }
+
+  if (!Array.isArray(skillsConfig.paths)) {
+    if (skillsConfig.paths !== undefined) {
+      deps.warn?.("invalid Supabase skills.paths value; resetting to array", {
+        value: skillsConfig.paths as unknown,
+      });
+    }
+    skillsConfig.paths = [];
+  }
+
+  const paths = skillsConfig.paths as string[];
+
+  for (const skill of enabled) {
+    const skillPath = path.join(skillsRoot, skill);
+    if (!exists(skillPath)) {
+      deps.warn?.("bundled Supabase skill directory not found", { skill, path: skillPath });
+      continue;
+    }
+
+    if (!paths.includes(skillPath)) {
+      paths.push(skillPath);
+    }
+  }
+}