mirror of
https://github.com/supabase/supabase.git
synced 2026-10-13 13:19:09 +03:00
samrose
801b912fc8
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Feature — wires up the new advisor lint `pg_graphql_anon_table_exposed` so it renders properly in Studio and ships with self-hosted Supabase. The lint itself was added to splinter in supabase/splinter#158 (already merged). ## What is the current behavior? Splinter's `main` exposes lint `0026_pg_graphql_anon_table_exposed`, which detects tables, views, and materialized views whose schema is visible through the public `/graphql/v1` introspection endpoint when the `anon` role has `SELECT` on them. The hosted advisor (mgmt-api) auto-fetches `splinter.sql` from raw.githubusercontent.com, so the lint will start firing on cloud projects, but: - Studio has no `lintInfoMap` entry for it, so the row renders without an icon, title mapping, "Fix" CTA, or category classification. - Self-hosted Supabase ships with a vendored copy of the lint SQL in `packages/pg-meta`; without an update there, self-hosted users never see the lint at all. ## What is the new behavior? Two minimal additions: - **`apps/studio/components/interfaces/Linter/Linter.utils.tsx`** — adds a `lintInfoMap` entry for `pg_graphql_anon_table_exposed`: title `"pg_graphql Anon Role Exposes Objects in Introspection"`, `Eye` icon, `security` category, `"View object"` CTA pointing at the table editor scoped by `metadata.schema` and `metadata.name`, docs link to the splinter docs page. - **`packages/pg-meta/src/sql/studio/advisor/lints.ts`** — vendors the lint's SQL block into `getLintsSQL()` so self-hosted deployments include it. Follows the file's documented copy-paste convention from splinter: every backtick inside SQL string literals is escaped (`` ` `` → `` \` ``), and the hardcoded docs URL is replaced with `${literal(\`${docsUrl}/...\`)}`. No changes to the OpenAPI surface, no changes to the `LINT_TYPES` literal union (auto-generated; matches the precedent of how lints 0023–0025 were added — Studio's `LintInfo.name` is typed as `string`, not the strict enum). ## Additional context - Splinter PR (merged): https://github.com/supabase/splinter/pull/158 - Splinter lint source: https://github.com/supabase/splinter/blob/main/lints/0026_pg_graphql_anon_table_exposed.sql - Splinter docs page: https://github.com/supabase/splinter/blob/main/docs/0026_pg_graphql_anon_table_exposed.md - The hosted advisor flow that fetches splinter.sql automatically lives in the platform mgmt-api (`getLintSql` in `advisors-utils.ts`), with a 1-hour cache TTL — cloud projects will pick up the new lint independently of this PR; this PR is about the Studio display mapping and the self-hosted SQL bundle. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a new security linter check that identifies tables and views exposed to anonymous GraphQL access, with warnings and remediation guidance to help resolve the issue. <!-- end of auto-generated comment: release notes by coderabbit.ai -->