test: WebKit hide-on-scroll flake fix + retrieval owner_filter callsite guard#381
Merged
Conversation
…callsites Two follow-ups from the 48h PR review. - tests/ui-tools.spec.ts (#5): the "phone bottom search dock hides while scrolling" test failed on WebKit only (release-browser-matrix) because WebKit doesn't reliably emit a native scroll event for a programmatic scrollTo, so useHideOnScroll never ran and data-scroll-hidden stayed unset. Dispatch an explicit scroll event after each scrollTo; harmless on Chromium/Firefox (the rAF guard dedupes). - tests/retrieval-owner-filter-guard.test.ts (#3): defense-in-depth tripwire. The SQL retrieval_owner_matches fails OPEN on a null owner_filter and RLS is service-role-only, so the app filter is the sole tenant boundary. Until the matcher is made fail-closed (gated on the Supabase Preview migration-drift fix so the SQL change is verifiable), this asserts every src .rpc() owner_filter argument comes from a sanctioned scope helper / the public sentinel, never a literal null. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
BigSimmo
enabled auto-merge (squash)
July 8, 2026 06:55
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…node drift) Use the string-returning readdirSync recursive overload instead of withFileTypes so the scan doesn't depend on Dirent.parentPath/path, which differ across @types/node versions and failed the CI typecheck (TS2339 Property 'path' does not exist on Dirent). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-ups from the 48h PR review (#2/#3/#5 items). Both are test-layer, zero production-code risk.
#5 — release-browser-matrix WebKit flake
tests/ui-tools.spec.ts:756("phone bottom search dock hides while scrolling…") fails only on WebKit (both attempt + retry): WebKit doesn't reliably emit a nativescrollevent for a programmaticscrollTo, souseHideOnScroll's listener never runs anddata-scroll-hiddenstays unset. Fix: dispatch an explicitscrollevent after eachscrollTo. Harmless on Chromium/Firefox (they already pass; the hook's rAF guard dedupes). Needs the WebKit CI leg to confirm green.#3 — retrieval owner_filter callsite guard (defense-in-depth)
retrieval_owner_matches(owner_filter, …)returns TRUE for every row whenowner_filter IS NULL(fails open by design), and RLS is service-role-only, so the app filter is the sole tenant boundary. The full fix (matchernull → deny+ anUNSCOPED_ALLsentinel across the RPCs) is a coupled SQL change that can't be regression-verified while Supabase Preview is red (see note below) — so this ships the zero-risk half now: a test asserting everysrc/.rpc()owner_filterargument comes from a sanctioned scope helper (retrievalOwnerFilter/requireOwnerScope/ownerScopeForDocumentFilteredRetrieval) or the public sentinel, and is never a literal null. Trips CI if a future callsite reintroduces the fail-open.Still needs live access (not in this PR)
7f4e709dbrenamed20260705220000_reconcile_live_database_drift.sql→…230000, orphaning the old version on the remote. Fix on the live DB:supabase migration repair --status reverted 20260705220000 --linkedthensupabase db push. The fail-closed matcher migration (Bump @types/node from 20.19.41 to 25.9.1 #3) should land after this so Preview can verify it.eval:quality(keys rotated). #6a shipped in refactor: honest deriveConfidence naming + drop dead UniversalSearchResponse fields #376.Verification
tsc✅ ·eslint0 errors ✅ · guard test passes against currentmain. (#5 needs the WebKit CI leg.)🤖 Generated with Claude Code