Jakob Wennberg and Claude Fable 5
aec81cb7ad
fix(db): lock down exchange_rates writes, drop duplicate JEL index, receipts anon read ( #969 )
...
Three Supabase-advisor findings from the 2026-07-09 production log triage:
1. exchange_rates (rls_policy_always_true): the exchange_rates_insert
policy was WITH CHECK (true) for authenticated, letting any signed-in
user poison the shared FX cache that feeds money math (amount_sek on
ingested transactions, invoice SEK conversion). Migration
20260710100000 drops the policy and revokes INSERT from
anon/authenticated; only the service role writes the cache now (the
05:00 enable-banking sync cron and the v1 API-key paths both use the
service client). writeCachedRate() in lib/currency/riksbanken.ts was
already fail-soft and never inspects the upsert result, so
user-client paths (bank file import, refresh-exchange-rate) keep
returning the fetched rate unchanged when the cache write is
rejected; documented and covered by a new unit test.
2. journal_entry_lines (duplicate_index): idx_journal_entry_lines_entry
and idx_journal_entry_lines_entry_id are byte-identical btree indexes
on (journal_entry_id), verified via pg_indexes on prod. Migration
20260710101000 drops idx_journal_entry_lines_entry (created outside
the migration history); the repo-defined _entry_id stays.
3. receipts bucket (public_bucket_allows_listing): receipts_public_read
gave anon SELECT over every object in the bucket, enabling anonymous
listing. The bucket is unused: no code references it, public.receipts
has 0 rows in prod, 2 orphan objects from 2026-02-26. Migration
20260710102000 drops the anon policy; authenticated own-folder
policies stay untouched.
New tests/pg/db-advisor-lockdowns.pg.test.ts covers all three
(authenticated INSERT rejected, SELECT still works, privilege revoked,
duplicate index gone, anon cannot list receipts).
Co-authored-by: Claude Fable 5 <noreply@anthropic.com >
2026-07-10 11:05:40 +02:00
..
2026-07-09 12:19:57 +02:00
2026-06-08 09:41:36 +02:00
2026-02-13 15:39:13 +01:00
2026-02-13 15:39:13 +01:00
2026-02-13 15:39:13 +01:00
2026-02-13 15:39:13 +01:00
2026-02-13 15:39:13 +01:00
2026-02-13 15:39:13 +01:00
2026-02-13 15:39:13 +01:00
2026-02-13 15:39:13 +01:00
2026-02-13 15:39:13 +01:00
2026-02-18 09:33:30 +01:00
2026-02-26 20:53:57 +01:00
2026-03-06 10:16:22 +01:00
2026-02-19 09:48:02 +01:00
2026-02-19 09:48:02 +01:00
2026-02-19 09:48:02 +01:00
2026-02-19 09:48:02 +01:00
2026-02-19 09:48:02 +01:00
2026-03-11 14:54:53 +01:00
2026-02-19 09:48:02 +01:00
2026-02-26 20:53:57 +01:00
2026-02-20 12:23:17 +01:00
2026-02-19 14:32:54 +01:00
2026-03-06 10:16:22 +01:00
2026-02-20 12:23:17 +01:00
2026-02-26 20:53:57 +01:00
2026-02-20 12:23:17 +01:00
2026-02-20 12:23:17 +01:00
2026-02-20 14:21:28 +01:00
2026-02-20 17:16:22 +01:00
2026-02-21 14:57:15 +01:00
2026-02-21 14:57:15 +01:00
2026-02-21 14:57:15 +01:00
2026-02-21 17:14:08 +01:00
2026-02-26 20:53:57 +01:00
2026-02-21 17:14:08 +01:00
2026-02-21 17:14:08 +01:00
2026-02-21 17:14:08 +01:00
2026-02-21 17:14:08 +01:00
2026-03-06 10:16:22 +01:00
2026-03-06 10:16:22 +01:00
2026-03-06 10:16:22 +01:00
2026-03-06 10:16:22 +01:00
2026-03-06 10:16:22 +01:00
2026-03-06 10:16:22 +01:00
2026-03-06 10:16:22 +01:00
2026-03-06 10:16:22 +01:00
2026-03-06 10:16:22 +01:00
2026-03-06 10:16:22 +01:00
2026-03-06 10:16:22 +01:00
2026-03-06 10:16:22 +01:00
2026-03-06 10:16:22 +01:00
2026-03-06 10:16:22 +01:00
2026-03-06 10:16:22 +01:00
2026-03-06 10:16:22 +01:00
2026-03-06 10:16:22 +01:00
2026-03-06 10:16:22 +01:00
2026-03-06 10:16:22 +01:00
2026-03-06 10:16:22 +01:00
2026-03-06 10:16:22 +01:00
2026-03-06 10:16:22 +01:00
2026-03-11 14:54:53 +01:00
2026-03-06 10:16:22 +01:00
2026-03-06 10:16:22 +01:00
2026-03-11 14:54:53 +01:00
2026-03-11 18:05:37 +01:00
2026-03-16 14:21:32 +01:00
2026-03-16 14:21:32 +01:00
2026-03-18 17:53:54 +01:00
2026-03-21 12:57:14 +01:00
2026-03-21 12:57:14 +01:00
2026-03-23 13:00:37 +01:00
2026-03-23 13:00:37 +01:00
2026-03-24 13:41:12 +01:00
2026-03-24 13:41:12 +01:00
2026-03-25 14:54:53 +01:00
2026-03-26 10:07:36 +01:00
2026-03-26 10:07:36 +01:00
2026-03-26 10:07:36 +01:00
2026-03-26 13:30:26 +01:00
2026-03-29 23:49:09 +02:00
2026-03-30 13:20:07 +02:00
2026-03-31 16:41:52 +02:00
2026-03-31 16:41:52 +02:00
2026-03-31 16:41:52 +02:00
2026-03-31 16:41:52 +02:00
2026-03-31 16:41:52 +02:00
2026-03-31 16:41:52 +02:00
2026-04-01 14:46:41 +02:00
2026-04-01 14:46:41 +02:00
2026-04-01 17:08:00 +02:00
2026-04-01 17:08:00 +02:00
2026-04-09 16:22:51 +02:00
2026-04-02 10:48:13 +02:00
2026-04-01 17:08:00 +02:00
2026-04-01 17:08:00 +02:00
2026-04-01 17:08:00 +02:00
2026-04-03 16:45:17 +02:00
2026-04-14 15:35:50 +02:00
2026-04-15 11:17:39 +02:00
2026-04-15 11:17:39 +02:00
2026-04-15 10:52:00 +02:00
2026-04-15 11:17:39 +02:00
2026-04-18 10:05:32 +02:00
2026-04-18 10:26:02 +02:00
2026-04-18 13:26:41 +02:00
2026-04-18 13:26:41 +02:00
2026-04-18 14:32:22 +02:00
2026-04-20 21:50:07 +02:00
2026-04-20 13:42:37 +02:00
2026-04-21 12:55:43 +02:00
2026-04-20 21:03:23 +02:00
2026-04-20 21:50:07 +02:00
2026-04-20 21:50:07 +02:00
2026-04-20 21:50:07 +02:00
2026-04-21 13:25:13 +02:00
2026-04-21 12:55:43 +02:00
2026-04-21 17:08:38 +02:00
2026-04-21 14:33:38 +02:00
2026-04-21 14:33:38 +02:00
2026-04-22 18:14:01 +02:00
2026-04-22 18:14:01 +02:00
2026-04-21 22:28:41 +02:00
2026-04-22 18:14:01 +02:00
2026-04-21 21:39:57 +02:00
2026-04-22 18:14:01 +02:00
2026-04-22 18:14:01 +02:00
2026-04-23 11:57:12 +02:00
2026-04-23 11:57:12 +02:00
2026-05-14 01:10:44 +02:00
2026-04-27 10:32:15 +02:00
2026-04-27 10:32:15 +02:00
2026-04-27 10:32:15 +02:00
2026-04-27 10:32:15 +02:00
2026-04-27 10:32:15 +02:00
2026-04-27 16:29:58 +02:00
2026-04-27 16:29:58 +02:00
2026-04-27 16:29:58 +02:00
2026-04-27 20:55:56 +02:00
2026-04-28 18:26:03 +02:00
2026-04-28 18:26:03 +02:00
2026-04-28 21:55:51 +02:00
2026-05-04 11:12:29 +02:00
2026-05-04 11:12:29 +02:00
2026-05-04 11:12:29 +02:00
2026-05-04 11:12:29 +02:00
2026-05-04 11:12:29 +02:00
2026-05-05 09:53:37 +02:00
2026-05-04 19:01:21 +02:00
2026-05-04 19:01:21 +02:00
2026-05-04 19:01:21 +02:00
2026-05-05 09:53:37 +02:00
2026-05-05 17:08:29 +02:00
2026-05-05 13:48:53 +02:00
2026-05-06 10:24:57 +02:00
2026-05-06 11:12:02 +02:00
2026-05-06 10:24:57 +02:00
2026-05-06 10:24:57 +02:00
2026-05-06 10:24:57 +02:00
2026-05-06 10:24:57 +02:00
2026-05-06 10:24:57 +02:00
2026-05-06 10:24:57 +02:00
2026-05-06 14:08:38 +02:00
2026-05-06 16:41:36 +02:00
2026-05-06 14:08:38 +02:00
2026-05-06 16:41:36 +02:00
2026-05-06 18:24:52 +02:00
2026-05-09 12:41:16 +02:00
2026-05-09 12:41:16 +02:00
2026-05-09 12:41:16 +02:00
2026-05-11 16:34:07 +02:00
2026-05-10 14:21:26 +02:00
2026-05-10 14:21:26 +02:00
2026-05-10 14:21:26 +02:00
2026-05-10 19:09:57 +02:00
2026-05-11 17:12:00 +02:00
2026-05-12 13:12:17 +02:00
2026-05-12 13:12:17 +02:00
2026-05-12 13:12:17 +02:00
2026-05-12 01:10:01 +02:00
2026-05-12 01:10:01 +02:00
2026-05-12 17:16:39 +02:00
2026-05-12 20:47:13 +02:00
2026-05-13 00:26:04 +02:00
2026-05-13 00:26:04 +02:00
2026-05-13 00:26:04 +02:00
2026-05-13 09:33:06 +02:00
2026-05-14 01:10:44 +02:00
2026-05-13 09:33:06 +02:00
2026-05-13 10:45:08 +02:00
2026-05-13 10:45:08 +02:00
2026-05-13 11:54:06 +02:00
2026-05-13 11:54:06 +02:00
2026-05-13 20:16:27 +02:00
2026-05-13 19:15:31 +02:00
2026-05-14 01:10:44 +02:00
2026-05-14 01:10:44 +02:00
2026-05-13 21:53:22 +02:00
2026-05-15 00:49:59 +02:00
2026-05-14 16:39:56 +02:00
2026-05-14 16:39:38 +02:00
2026-05-15 00:49:59 +02:00
2026-05-15 14:00:04 +02:00
2026-05-15 14:00:04 +02:00
2026-05-15 14:00:04 +02:00
2026-05-15 14:00:04 +02:00
2026-05-15 20:38:19 +02:00
2026-05-15 20:38:19 +02:00
2026-05-15 20:38:19 +02:00
2026-05-16 11:42:47 +02:00
2026-05-16 15:55:27 +02:00
2026-06-08 09:41:39 +02:00
2026-05-16 15:55:27 +02:00
2026-05-17 14:50:48 +02:00
2026-05-17 14:50:48 +02:00
2026-05-17 23:52:49 +02:00
2026-05-17 23:52:49 +02:00
2026-05-17 23:52:49 +02:00
2026-05-17 23:52:49 +02:00
2026-05-17 23:52:49 +02:00
2026-05-17 23:52:49 +02:00
2026-05-17 15:38:36 +02:00
2026-05-17 16:25:43 +02:00
2026-05-17 15:38:36 +02:00
2026-05-17 15:38:36 +02:00
2026-05-28 11:27:01 +02:00
2026-05-28 11:27:01 +02:00
2026-05-28 11:27:01 +02:00
2026-05-28 11:27:01 +02:00
2026-05-28 11:27:01 +02:00
2026-05-28 11:27:01 +02:00
2026-05-28 11:27:01 +02:00
2026-05-28 11:27:01 +02:00
2026-05-18 19:02:42 +02:00
2026-05-28 11:27:01 +02:00
2026-05-19 13:48:32 +02:00
2026-05-28 11:27:01 +02:00
2026-05-28 11:27:01 +02:00
2026-05-28 11:27:01 +02:00
2026-05-28 11:27:01 +02:00
2026-05-19 16:10:18 +02:00
2026-05-19 16:10:18 +02:00
2026-05-19 16:10:18 +02:00
2026-05-19 16:10:18 +02:00
2026-05-19 16:10:18 +02:00
2026-05-19 16:10:18 +02:00
2026-05-19 16:10:18 +02:00
2026-05-19 17:52:11 +02:00
2026-05-19 17:52:11 +02:00
2026-05-21 01:25:18 +02:00
2026-05-28 11:27:01 +02:00
2026-05-21 21:33:22 +02:00
2026-05-21 21:33:22 +02:00
2026-05-21 16:44:09 +02:00
2026-05-22 10:12:21 +02:00
2026-05-26 22:29:41 +02:00
2026-05-26 22:29:41 +02:00
2026-05-22 11:09:46 +02:00
2026-05-22 12:22:15 +02:00
2026-05-22 15:21:05 +02:00
2026-05-28 11:27:01 +02:00
2026-05-28 11:27:01 +02:00
2026-05-28 11:27:01 +02:00
2026-05-26 22:29:41 +02:00
2026-05-28 11:27:01 +02:00
2026-05-28 11:27:01 +02:00
2026-05-26 22:29:41 +02:00
2026-05-26 22:29:41 +02:00
2026-05-26 22:29:41 +02:00
2026-05-26 22:29:41 +02:00
2026-05-26 22:29:41 +02:00
2026-05-26 22:29:41 +02:00
2026-05-26 22:29:41 +02:00
2026-05-26 22:29:41 +02:00
2026-05-26 22:29:41 +02:00
2026-05-26 22:29:41 +02:00
2026-05-28 11:27:01 +02:00
2026-05-28 11:27:01 +02:00
2026-05-26 22:29:41 +02:00
2026-05-26 22:29:41 +02:00
2026-05-28 11:27:01 +02:00
2026-05-28 11:27:01 +02:00
2026-05-27 11:01:53 +02:00
2026-05-27 17:07:27 +02:00
2026-05-27 14:19:30 +02:00
2026-05-27 17:07:27 +02:00
2026-05-28 11:27:01 +02:00
2026-05-28 11:27:01 +02:00
2026-05-28 11:27:01 +02:00
2026-05-28 21:09:43 +02:00
2026-05-28 21:09:43 +02:00
2026-05-28 21:09:43 +02:00
2026-05-28 21:09:43 +02:00
2026-05-28 21:09:43 +02:00
2026-05-28 21:09:43 +02:00
2026-05-28 21:09:43 +02:00
2026-05-28 21:09:43 +02:00
2026-05-29 12:31:19 +02:00
2026-05-29 13:45:41 +02:00
2026-05-29 12:31:19 +02:00
2026-05-29 12:31:19 +02:00
2026-05-29 13:45:41 +02:00
2026-05-29 13:45:41 +02:00
2026-05-30 01:28:41 +02:00
2026-05-30 01:28:41 +02:00
2026-05-30 01:28:41 +02:00
2026-05-30 01:28:41 +02:00
2026-05-29 14:55:24 +02:00
2026-05-29 14:55:24 +02:00
2026-05-29 16:30:42 +02:00
2026-05-29 16:30:42 +02:00
2026-05-29 16:30:42 +02:00
2026-05-29 16:30:42 +02:00
2026-05-30 10:23:14 +02:00
2026-05-30 10:23:14 +02:00
2026-06-08 09:47:33 +02:00
2026-05-30 13:36:46 +02:00
2026-05-30 13:36:46 +02:00
2026-05-30 13:36:46 +02:00
2026-06-01 14:45:49 +02:00
2026-06-01 18:26:13 +02:00
2026-06-01 14:45:49 +02:00
2026-06-01 18:26:13 +02:00
2026-06-01 18:26:13 +02:00
2026-06-01 18:26:13 +02:00
2026-06-01 21:08:06 +02:00
2026-06-01 21:08:06 +02:00
2026-06-02 09:37:30 +02:00
2026-06-02 10:24:18 +02:00
2026-06-02 10:24:18 +02:00
2026-06-02 10:24:18 +02:00
2026-06-02 13:25:48 +02:00
2026-06-02 13:25:48 +02:00
2026-06-04 13:14:57 +02:00
2026-06-04 13:14:57 +02:00
2026-06-03 10:52:01 +02:00
2026-06-03 10:52:01 +02:00
2026-06-04 15:32:39 +02:00
2026-06-04 15:32:39 +02:00
2026-06-16 11:26:26 +02:00
2026-06-04 16:16:27 +02:00
2026-06-05 10:11:37 +02:00
2026-06-05 15:47:13 +02:00
2026-06-05 15:47:13 +02:00
2026-06-06 10:05:48 +02:00
2026-06-06 10:42:41 +02:00
2026-06-06 10:42:41 +02:00
2026-06-06 11:13:35 +02:00
2026-06-08 12:43:15 +02:00
2026-06-10 13:52:24 +02:00
2026-06-10 13:52:24 +02:00
2026-06-09 21:05:37 +02:00
2026-06-09 21:05:37 +02:00
2026-06-12 10:05:10 +02:00
2026-06-18 11:49:33 +02:00
2026-06-18 11:49:33 +02:00
2026-06-18 11:49:33 +02:00
2026-06-12 16:35:30 +02:00
2026-06-12 16:35:30 +02:00
2026-06-12 16:35:30 +02:00
2026-06-12 16:35:30 +02:00
2026-06-14 23:40:26 +02:00
2026-06-16 10:42:37 +02:00
2026-06-16 10:42:37 +02:00
2026-06-16 18:22:09 +02:00
2026-06-26 15:29:58 +02:00
2026-06-26 15:30:03 +02:00
2026-06-29 15:56:19 +02:00
2026-06-29 15:56:19 +02:00
2026-06-29 15:56:19 +02:00
2026-06-29 16:34:51 +02:00
2026-06-29 21:47:42 +02:00
2026-07-01 18:13:00 +02:00
2026-06-29 22:59:58 +02:00
2026-06-29 22:59:58 +02:00
2026-06-30 08:58:01 +02:00
2026-07-01 18:13:00 +02:00
2026-07-03 13:57:59 +02:00
2026-07-02 11:27:07 +02:00
2026-07-03 13:57:59 +02:00
2026-07-02 12:26:42 +02:00
2026-07-02 13:36:45 +02:00
2026-07-02 16:05:13 +02:00
2026-07-02 17:02:34 +02:00
2026-07-02 17:02:34 +02:00
2026-07-02 21:21:01 +02:00
2026-07-02 21:21:01 +02:00
2026-07-02 22:21:46 +02:00
2026-07-02 23:28:42 +02:00
2026-07-03 13:57:59 +02:00
2026-07-03 13:57:59 +02:00
2026-07-03 09:41:31 +02:00
2026-07-03 09:42:02 +02:00
2026-07-03 10:56:14 +02:00
2026-07-03 11:48:29 +02:00
2026-07-03 11:48:09 +02:00
2026-07-04 15:58:06 +02:00
2026-07-05 03:05:09 +02:00
2026-07-05 03:05:09 +02:00
2026-07-03 16:50:28 +02:00
2026-07-05 03:05:09 +02:00
2026-07-05 03:05:09 +02:00
2026-07-05 03:05:09 +02:00
2026-07-05 03:05:09 +02:00
2026-07-05 03:05:09 +02:00
2026-07-05 03:05:09 +02:00
2026-07-06 11:20:34 +02:00
2026-07-07 01:14:59 +02:00
2026-07-07 01:14:59 +02:00
2026-07-07 01:50:18 +02:00
2026-07-08 23:54:49 +02:00
2026-07-08 13:48:04 +02:00
2026-07-08 02:14:15 +02:00
2026-07-08 09:54:46 +02:00
2026-07-08 15:04:25 +02:00
2026-07-08 23:54:49 +02:00
2026-07-08 23:54:49 +02:00
2026-07-09 12:19:57 +02:00
2026-07-09 12:19:57 +02:00
2026-07-09 21:27:03 +02:00
2026-07-10 11:05:40 +02:00
2026-07-10 11:05:40 +02:00
2026-07-10 11:05:40 +02:00