fix: stop world-readable exposure of private session metadata (#1926) - #1932
fix: stop world-readable exposure of private session metadata (#1926)#1932atul-upadhyay-7 wants to merge 2 commits into
Conversation
…ry (durdana3105#1925) Authenticated users could delete their own leaderboard row and re-insert it with arbitrary xp/streak/badges values, bypassing the UPDATE hardening from previous migrations. Drop the permissive INSERT/DELETE RLS policies and revoke those privileges from anon + authenticated; join_leaderboard() remains the only row-creation path.
…a3105#1926) The sessions SELECT policy (USING true, no role restriction) exposed every session row - including invite-only is_private=true sessions - to anonymous and authenticated users alike. session_participants had the same open policy. Replace with an anonymous-deny policy plus a scoped authenticated policy that only allows viewing public sessions and sessions the user mentors, is invited to, or participates in. session_participants follows the same access rule.
|
@atul-upadhyay-7 is attempting to deploy a commit to the durdana3105's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
Warning Review limit reached
Next review available in: 56 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Fixes #1926
Problem
The
sessionsSELECT policy"Anyone can view sessions"usesUSING (true)with no role restriction, so both anonymous and authenticated users can read every session row — including invite-onlyis_private = truesessions. This leaks private session titles, descriptions, mentor identities, and scheduling details.session_participantshas the same openUSING (true)SELECT, leaking who attends private sessions.Changes
New migration
20260805000003_restrict_private_session_visibility.sql:sessions("Anyone can view sessions","Authenticated users can view sessions","sessions_select").anonymous_cannot_view_sessions— anonymous users see no session rows.authenticated_users_can_view_sessions— scoped to:is_private = false),mentor_id = auth.uid()),session_invites),session_participants).session_participantsSELECT (scoped + anon-deny).The SECURITY DEFINER
join_session()RPC and the app's authenticated session queries are unaffected.Verification
from("sessions")queries live in authenticated pages (Dashboard,Sessions,MentorDashboard, widgets, hooks) — they keep working since public sessions remain visible.sessions.