feat(schema): agent-observability tables (obs_messages/obs_contacts) — provenance record - #66
Merged
Merged
Conversation
…tacts) Provenance record for the message-observability tables + read RPCs consumed by george's obs wiring. Already applied to the live project via Supabase MCP on 2026-07-13; idempotent, so re-applying is a no-op. bia-admin owns the schema; george ships none. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
📝 WalkthroughWalkthroughAdds a Supabase migration with agent-scoped message and contact tables, indexes, service-role-only access, and SQL functions for message statistics, time-series aggregation, conversation counts, and searchable conversation listings. ChangesAgent observability
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@supabase/migrations/20260713000000_agent_observability_schema.sql`:
- Around line 52-56: Add explicit, idempotently guarded deny-all FOR ALL RLS
policies for the anon and authenticated API roles on both obs_messages and
obs_contacts. Each policy must use USING (false) and WITH CHECK (false), while
preserving service-role access and the existing RLS enablement.
- Around line 63-65: Restrict the observability RPC functions, including
obs_message_stats and the other functions defined in this migration, to
service_role execution only. After each function definition, revoke EXECUTE from
PUBLIC, anon, and authenticated, then grant EXECUTE explicitly to service_role;
do not rely on table privilege revocations for this boundary.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 151cba05-23bc-4f12-8d4d-d5bf1a0ad80b
📒 Files selected for processing (1)
supabase/migrations/20260713000000_agent_observability_schema.sql
Comment on lines
+52
to
+56
| -- RLS deny-all + revoke Data API grants: matches this project's internal-table | ||
| -- pattern (service-role bypasses RLS and keeps full access; anon/authenticated | ||
| -- get neither rows nor privilege). | ||
| alter table obs_messages enable row level security; | ||
| alter table obs_contacts enable row level security; |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Add explicit deny-all RLS policies.
RLS is enabled, but this migration defines no policies. Add idempotently guarded FOR ALL policies with USING (false) and WITH CHECK (false) for the API roles on both tables. As per coding guidelines, files matching supabase/migrations/**/*.sql must add RLS policies in the same migration and default to deny.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@supabase/migrations/20260713000000_agent_observability_schema.sql` around
lines 52 - 56, Add explicit, idempotently guarded deny-all FOR ALL RLS policies
for the anon and authenticated API roles on both obs_messages and obs_contacts.
Each policy must use USING (false) and WITH CHECK (false), while preserving
service-role access and the existing RLS enablement.
Source: Coding guidelines
Comment on lines
+63
to
+65
| create or replace function obs_message_stats(since timestamptz, agent text default 'default') | ||
| returns table (channel text, inbound bigint, outbound bigint, total bigint, conversations bigint) | ||
| language sql stable as $$ |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Restrict RPC execution to service_role.
These functions inherit PUBLIC EXECUTE access. Revoke EXECUTE from PUBLIC, anon, and authenticated, then grant it explicitly to service_role; revoking table privileges alone does not enforce the stated RPC access boundary.
Suggested ACL hardening
+revoke all on function public.obs_message_stats(timestamptz, text) from public, anon, authenticated;
+grant execute on function public.obs_message_stats(timestamptz, text) to service_role;
+revoke all on function public.obs_conversation_count(timestamptz, text) from public, anon, authenticated;
+grant execute on function public.obs_conversation_count(timestamptz, text) to service_role;
+revoke all on function public.obs_message_series(timestamptz, text, text) from public, anon, authenticated;
+grant execute on function public.obs_message_series(timestamptz, text, text) to service_role;
+revoke all on function public.obs_conversations(text, integer, text) from public, anon, authenticated;
+grant execute on function public.obs_conversations(text, integer, text) to service_role;Also applies to: 78-80, 86-88, 100-110
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@supabase/migrations/20260713000000_agent_observability_schema.sql` around
lines 63 - 65, Restrict the observability RPC functions, including
obs_message_stats and the other functions defined in this migration, to
service_role execution only. After each function definition, revoke EXECUTE from
PUBLIC, anon, and authenticated, then grant EXECUTE explicitly to service_role;
do not rely on table privilege revocations for this boundary.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Provenance record for the message-observability schema consumed by george's obs wiring (companion PR in the george repo).
obs_messages,obs_contacts) + four read RPCs (stats/series/conversation-count/inbox).ujkaregrwrppaehvbahf) via the Supabase MCP on 2026-07-13; idempotent (IF NOT EXISTS/CREATE OR REPLACE), so re-applying is a no-op.packages/core/schema.sql. bia-admin owns the schema; george ships none (its schema-ownership guard stays green).Security advisors after apply: no new ERROR/WARN; the obs tables show only the expected INFO
rls_enabled_no_policy(intended for service-role-only deny-all).🤖 Generated with Claude Code
Summary by CodeRabbit