fix: stop exposing every user's email address through profiles RLS (#1924)

[atul-upadhyay-7]

Fixes #1924

Problem

The profiles SELECT policy allows any authenticated user to read every profile row, including the email column. The legacy public.users compat table (also storing email) has the same permissive policy. Client code was actively fetching other users' emails via select("*") in the chat directory.

Changes

• Migration (20260805000001_protect_profiles_email_rls.sql):
  • REVOKE SELECT (email) ON public.profiles FROM anon, authenticated; — only the row owner and service role can read emails.
  • Drop the permissive SELECT/INSERT/UPDATE policies on public.users and REVOKE ALL ... FROM anon, authenticated.
• Frontend — replace select("*") with explicit non-sensitive columns in:
  • src/hooks/useMessages.ts (peer directory: id, name, avatar_url, is_mentor, is_learner, last_active, last_seen)
  • src/pages/Chat.tsx, src/pages/Profile.tsx, src/pages/EditProfile.tsx
  • src/components/messages/Sidebar.tsx, src/components/messages/utils.ts — drop email-based display/search fallbacks.

Verification

• npm run typecheck — no new errors (only the pre-existing App.tsx / useSessions.ts errors that also exist on main).
• npx vitest run for chat-related test files — 28/28 pass.
• Admin email display in Admin.tsx is unaffected (served by the admin-gated admin_get_all_profiles SECURITY DEFINER RPC).

Summary by CodeRabbit

• Bug Fixes
  • Improved conversation and people search by matching display names, roles, and message content rather than email addresses.
  • Updated profile displays to use names only, with “Learner” shown when no name is available.
  • Reduced exposure of sensitive profile information by limiting retrieved profile fields.
  • Strengthened access controls for profile email addresses.

[vercel]

@atul-upadhyay-7 is attempting to deploy a commit to the durdana3105's projects Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ae2ee547-8061-44b1-a3cf-00aff4a20b15

📥 Commits

Reviewing files that changed from the base of the PR and between 880eed9 and e873e24.

📒 Files selected for processing (7)

• src/components/messages/Sidebar.tsx
• src/components/messages/utils.ts
• src/hooks/useMessages.ts
• src/pages/Chat.tsx
• src/pages/EditProfile.tsx
• src/pages/Profile.tsx
• supabase/migrations/20260805000001_protect_profiles_email_rls.sql

---

📝 Walkthrough

Walkthrough

The PR restricts profile email access and removes email fields from client profile loading, normalization, display, and search. Profile queries now select explicit non-sensitive columns.

Changes

Profile email protection

Layer / File(s)	Summary
Database email access controls supabase/migrations/20260805000001_protect_profiles_email_rls.sql	The migration revokes client-role access to profiles.email, removes permissive public.users policies, and revokes client-role privileges on that table.
Message profile contracts and search src/hooks/useMessages.ts, src/components/messages/utils.ts, src/components/messages/Sidebar.tsx	Message profile types and normalization no longer include email. Display helpers and message searches use names, roles, and message content.
Page profile queries and display src/pages/Chat.tsx, src/pages/EditProfile.tsx, src/pages/Profile.tsx	Page queries select explicit profile fields. Chat display names and learner filtering no longer derive or match email addresses.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• durdana3105/peer-learning#1866: Addresses profile email exposure in overlapping profile pages and access controls.
• durdana3105/peer-learning#1876: Modifies Supabase profile access controls related to email and metadata exposure.
• durdana3105/peer-learning#1022: Modifies access policies for profile and legacy user data.

Suggested labels: gssoc26, gssoc:approved, quality:clean, type:bug

Suggested reviewers: arshvermagit, nyxsky404, anshika1179

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary security fix: preventing exposure of users' email addresses through profile RLS.
Linked Issues check	✅ Passed	The changes satisfy issue [#1924] by restricting email access, removing legacy table access, using explicit profile columns, and eliminating email-based UI behavior.
Out of Scope Changes check	✅ Passed	All changes directly support the linked security issue and its requirements; no unrelated code changes are evident.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}