Joachim Hesthammer
5aa449ad3c
* Lock down OAuth used codes table * test(db): lock oauth_used_codes lockdown contract + reload PostgREST cache Add a pg-real test asserting anon/authenticated are denied SELECT/INSERT on public.oauth_used_codes while the privileged (service-role) connection can still read it, per the project's requirement that RLS changes ship a *.pg.test.ts. Also append NOTIFY pgrst, 'reload schema' so PostgREST picks up the privilege change immediately (migration rule 8). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Jakob Wennberg <jakob.wennberg@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
10 lines
406 B
SQL
10 lines
406 B
SQL
-- OAuth authorization-code replay tracking is internal-only. The token
|
|
-- endpoint uses a service-role client, so browser-facing API roles must not
|
|
-- access this table.
|
|
ALTER TABLE public.oauth_used_codes ENABLE ROW LEVEL SECURITY;
|
|
|
|
REVOKE ALL ON TABLE public.oauth_used_codes FROM anon, authenticated;
|
|
|
|
-- Privilege change: tell PostgREST to reload its schema/role cache.
|
|
NOTIFY pgrst, 'reload schema';
|