mirror of
https://github.com/supabase/supabase.git
synced 2026-10-08 19:05:06 +03:00
Charis
3f97eeea5a
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Refactor / security improvement ## What is the current behavior? SQL fragments across Studio are built from plain `string` values with no type-level distinction between developer-authored SQL, DB-sourced identifiers, and user-typed or externally-influenced content. ## What is the new behavior? Extends the safe SQL model to additional Studio interfaces, using `SafeSqlFragment`, `safeSql`, `ident()`, `literal()`, `untrustedSql()`, and `acceptUntrustedSql()` from `@supabase/pg-meta/src/pg-format`: - **Policy editor**: template constants typed as `SafeSqlFragment` via `safeSql` tagged literals; Monaco editor `onInputChange` emits `untrustedSql()`; `acceptUntrustedSql()` called only at the Save gesture; roles selector emits a composed `SafeSqlFragment` via `ident()` + `joinSqlFragments()` - **Auth hooks**: grant/revoke SQL statements use `ident()` for schema and function names - **Docs description editor**: `COMMENT ON` queries use `ident()` and `literal()` for table/column/function names and values - **Cron jobs**: `cron.schedule()` call and HTTP request builder use `literal()` for all user-provided values - **GraphQL linter CTA**: `REVOKE` statement uses `ident()` for schema, table, and role - **Storage public bucket warning**: `DROP POLICY` uses `ident()` for policy name - **View security autofix modal**: `ALTER VIEW` uses `ident()` for schema and view name - **API settings**: `CREATE SCHEMA` mutation uses `safeSql` tagged literal - **Database event trigger delete**: `DROP EVENT TRIGGER` uses `ident()` for trigger name - **Database queues query**: queue list query uses `safeSql` tagged literal - **Role impersonation**: function invocation SQL uses `ident()` and `literal()` ## Manual testing checklist - Authentication > Policies - Authentication > Hooks - Integrations > Queues - Database > Event Triggers - Integrations > Cron Jobs - Table Editor > View entity security autofix - API Settings > expose schema - Linter > GraphQL exposure CTA - Docs > table/column description editor - Role impersonation (user impersonation panel) ## Additional context <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Refactor** * Replaced ad-hoc SQL string building with a safer, fragment-based SQL construction across auth, policies, integrations, storage, and DB operations to improve SQL safety while preserving behavior. * **Bug Fixes / UX** * Policy editor and code editor now propagate role and input changes more reliably, improving editor responsiveness and policy handling without UI changes. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
49 lines
1.4 KiB
TypeScript
49 lines
1.4 KiB
TypeScript
import { safeSql } from '@supabase/pg-meta/src/pg-format'
|
|
import { useQuery } from '@tanstack/react-query'
|
|
|
|
import { databaseQueuesKeys } from './keys'
|
|
import { executeSql } from '@/data/sql/execute-sql-query'
|
|
import type { ResponseError, UseCustomQueryOptions } from '@/types'
|
|
|
|
export type DatabaseQueuesVariables = {
|
|
projectRef?: string
|
|
connectionString?: string | null
|
|
}
|
|
|
|
export type PostgresQueue = {
|
|
queue_name: string
|
|
is_partitioned: boolean
|
|
is_unlogged: boolean
|
|
created_at: string
|
|
}
|
|
|
|
const queueSqlQuery = safeSql`select * from pgmq.list_queues();`
|
|
|
|
export async function getDatabaseQueues({ projectRef, connectionString }: DatabaseQueuesVariables) {
|
|
if (!projectRef) throw new Error('Project ref is required')
|
|
|
|
const { result } = await executeSql({
|
|
projectRef,
|
|
connectionString,
|
|
sql: queueSqlQuery,
|
|
})
|
|
return result
|
|
}
|
|
|
|
export type DatabaseQueueData = PostgresQueue[]
|
|
export type DatabaseQueueError = ResponseError
|
|
|
|
export const useQueuesQuery = <TData = DatabaseQueueData>(
|
|
{ projectRef, connectionString }: DatabaseQueuesVariables,
|
|
{
|
|
enabled = true,
|
|
...options
|
|
}: UseCustomQueryOptions<DatabaseQueueData, DatabaseQueueError, TData> = {}
|
|
) =>
|
|
useQuery<DatabaseQueueData, DatabaseQueueError, TData>({
|
|
queryKey: databaseQueuesKeys.list(projectRef),
|
|
queryFn: () => getDatabaseQueues({ projectRef, connectionString }),
|
|
enabled: enabled && typeof projectRef !== 'undefined',
|
|
...options,
|
|
})
|