poyrazavsever/neta
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: enhance service role handling and storage policies in migrations and schemas

Browse Source
This commit is contained in:
Poyraz Avsever
2026-06-14 12:52:11 +03:00
parent b1620d4748
commit da8c55d1ad
10 changed files with 250 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/database/0011-service-role-claims-and-storage-policies.md
+18
View File
@@ -0,0 +1,18 @@
# 0011 - Service Role Claims And Storage Policies
SQL file:
`supabase/migrations/0011_fix_service_role_claims_and_storage_policies.sql`
## Purpose
Fixes service-role detection for self-hosted PostgREST deployments and allows trusted server-side storage operations to pass RLS.
PostgREST stores JWT claims in `request.jwt.claims` JSON when legacy GUCs are disabled. Earlier SQL only checked the legacy `request.jwt.claim.role` value, so service-role requests could be rejected.
## Changes
- Adds `public.neta_current_jwt_role()`.
- Updates `public.request_internal_auth_creation()` to read both modern and legacy JWT claim formats.
- Recreates avatar and project asset storage policies to allow service-role operations.
- Reloads the PostgREST schema cache.
docs/database/query-order.md
+2 -1
View File
@@ -14,6 +14,7 @@ This file is the canonical order of SQL files for database setup and migration.
| 0008 | `supabase/migrations/0008_add_project_progress_and_quota.sql` | `docs/database/0008-project-progress-and-quota.md` | Pending execution |
| 0009 | `supabase/migrations/0009_lock_registration_after_first_admin.sql` | `docs/database/0009-lock-registration-after-first-admin.md` | Pending execution |
| 0010 | `supabase/migrations/0010_allow_internal_auth_user_creation.sql` | `docs/database/0010-internal-auth-user-creation.md` | Pending execution |
| 0011 | `supabase/migrations/0011_fix_service_role_claims_and_storage_policies.sql` | `docs/database/0011-service-role-claims-and-storage-policies.md` | Pending execution |
| seed-0001 | `supabase/seeds/0001_demo_freelancer_os_data.sql` | `docs/database/seed-0001-demo-freelancer-os-data.md` | Optional demo seed, pending execution |
## How To Add The Next Query
@@ -38,4 +39,4 @@ Use the migration helper from the repository root:
DATABASE_URL='postgresql://postgres:password@host:5432/postgres' sh ./scripts/apply-migrations.sh
```
The helper applies missing queries from `0001` through `0010` in the order listed above and records completed migrations in `neta_internal.schema_migrations`. It uses local `psql` when available, otherwise it runs `psql` through Docker. After migrations, it sends `NOTIFY pgrst, 'reload schema'` so PostgREST can see new RPC functions without a manual restart.
The helper applies missing queries from `0001` through `0011` in the order listed above and records completed migrations in `neta_internal.schema_migrations`. It uses local `psql` when available, otherwise it runs `psql` through Docker. After migrations, it sends `NOTIFY pgrst, 'reload schema'` so PostgREST can see new RPC functions without a manual restart.