fix(db): make hosted default ACL migrations postgres-safe

[BigSimmo]

Summary

• Replace the hosted-incompatible pending default-privilege guard and reassertion with idempotent SQL that targets role postgres in schema public.
• Add the forward-only repair migration and keep the final document-title word-scope trigger semantically intact after that repair.
• Align roles.sql, the schema snapshot, CI replay, drift tooling, ACL verification, tests, and the regenerated drift manifest.
• Use migration filenames that exactly match hosted history; previously applied production history is not rewritten.

Verification

• Docker schema replay and drift-manifest regeneration passed with supabase/postgres:17.6.1.127 (28s).
• tests/supabase-schema.test.ts passed: 66/66.
• Focused migration guard/title-scope checks passed: 5/5.
• Prettier passed for changed workflow, documentation, and TypeScript files.
• ESLint passed for changed TypeScript and test files.
• Static migration-order and idempotency contract passed.

Verification not run: the complete npm run verify:pr-local broad gate was left to PR CI because the focused database suite and deterministic Docker replay passed locally.

Production deployment evidence

Target: Clinical KB Database (sjrfecxgysukkwxsowpy).

Applied hosted migrations:

• 20260719055541_assert_postgres_default_privileges
• 20260719055555_reassert_postgres_default_privileges
• 20260719055609_repair_postgres_default_privileges
• 20260719055623_enforce_public_title_word_scope

Post-deployment verification:

• public.default_privileges_status('postgres', 'public') -> safe = true
• unsafe_title_word_rows = 0
• document_title_words_enforce_public_scope exists once and is enabled (tgenabled = O)
• Both title-word constraints are validated
• The ACL status helper remains executable by service_role only, not PUBLIC, anon, or authenticated

Risk and rollout

• Risk: Medium; this changes future-object ACL defaults and migration replay, but the same forward migrations are already live and verified on the target project.
• Rollback: Create a new forward migration that restores the desired ACL and trigger state; do not rewrite hosted migration history.
• Provider or production effects: Explicitly authorized hosted migrations were applied to Clinical KB Database; no production rows were deleted because the unsafe-row preflight returned zero.

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Notes

• No clinical answer, retrieval, source-governance, patient-data, or SaMD behavior changed.
• The failed hosted migration made no production change; the repair was forward-only and idempotent.

Summary by CodeRabbit

• Security Enhancements

  • Strengthened database default-privilege protections for future tables, sequences, and functions.
  • Restricted unexpected grants and grantable permissions, with fail-closed validation to block unsafe configurations.
  • Hardened public title-word data with stricter access controls, validation, and cleanup of legacy records.

• Reliability

  • Improved local database reset verification to recover gracefully when cached container images cannot be loaded.
  • Updated database checks and schema replay safeguards to reflect the strengthened privilege model.

• Documentation

  • Updated operational guidance for verifying and repairing database privileges.

[supabase]

Updates to Preview Branch (codex/postgres-default-privileges-repair) ↗︎

Deployments	Status	Updated
Database	✅	Sun, 19 Jul 2026 06:47:49 UTC
Services	✅	Sun, 19 Jul 2026 06:47:49 UTC
APIs	✅	Sun, 19 Jul 2026 06:47:49 UTC

Tasks are run on every commit but only new migration files are pushed.
Close and reopen this PR if you want to apply changes from existing seed or migration files.

Tasks	Status	Updated
Configurations	✅	Sun, 19 Jul 2026 06:47:52 UTC
Migrations	✅	Sun, 19 Jul 2026 06:47:54 UTC
Seeding	✅	Sun, 19 Jul 2026 06:47:55 UTC
Edge Functions	✅	Sun, 19 Jul 2026 06:47:56 UTC

---

View logs for this Workflow Run ↗︎.
Learn more about Supabase for Git ↗︎.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 7424e30e-61e0-4b58-9bcb-870cb29f82c1

📥 Commits

Reviewing files that changed from the base of the PR and between 1ed2710 and d31fca5.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/ci.yml

---

📝 Walkthrough

Walkthrough

The change moves default-privilege bootstrapping, verification, repair, replay, tooling, documentation, snapshots, and tests from supabase_admin to postgres, while adding grantability checks and postgres-specific fail-closed migration enforcement.

Changes

Postgres default privilege hardening

Layer / File(s)	Summary
ACL verification and repair migrations supabase/migrations/20260719055541..., supabase/migrations/20260719055555..., supabase/migrations/20260719055609...	Default privilege status inspection and repair migrations now target postgres, enforce expected service_role privileges, reject unexpected grantable ACL entries, and raise 42501 for unsafe states.
Bootstrap and schema enforcement supabase/roles.sql, supabase/schema.sql, supabase/migrations/20260719055623...	Bootstrap and schema assertion logic now configures and verifies postgres future-object privileges, including updated fail-closed title-word migration checks.
Replay, tooling, and operator guidance .github/workflows/ci.yml, scripts/..., docs/process-hardening.md, supabase/drift-manifest.json	CI image loading tolerates cache failures; replay, drift generation, ACL checking, documentation, and stored ACL snapshots now use postgres-based bootstrap and verification.
Schema replay test coverage tests/supabase-schema.test.ts	Replay guards and migration assertions now reference postgres privilege migrations and validate postgres-specific unsafe-state behavior.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• BigSimmo/Database#582 — Modifies overlapping default-privilege hardening and ACL remediation.
• BigSimmo/Database#715 — Updates the same default-ACL plumbing and role assumptions.
• BigSimmo/Database#839 — References the replaced default-privilege migration and related test fixtures.

Suggested labels: codex

Sequence Diagram(s)

sequenceDiagram
  participant CI
  participant roles.sql
  participant PostgreSQL
  participant ACLCheck
  CI->>roles.sql: Bootstrap postgres default privileges
  roles.sql->>PostgreSQL: Apply ALTER DEFAULT PRIVILEGES
  ACLCheck->>PostgreSQL: Read postgres ACL status
  PostgreSQL-->>ACLCheck: Return ACL entries and safety result
  ACLCheck-->>CI: Pass or report unsafe defaults

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: making hosted default ACL migrations postgres-safe.
Description check	✅ Passed	The description follows the template and includes summary, verification, risk/rollback, governance, and notes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/postgres-default-privileges-repair

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

• Migration replay — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.
• PR required — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #3526 (success).

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.

[BigSimmo]

@codex fil failing CI testing

[chatgpt-codex-connector]

Summary

• I checked the current PR head (d31fca51648eb684790b4900b4dce4fa57cd377d) and the two CI jobs called out by triage are now green:
  • Migration replay completed with success.
  • PR required completed with success.
• No code changes were needed. The worktree is clean on branch work, so I did not commit and did not call make_pr.
• The PR required failure was downstream of Migration replay: the workflow explicitly requires db-reset-verify to succeed when database files changed.
• The Migration replay job is the Supabase local replay gate that starts Supabase, bootstraps default ACLs, then runs supabase migration up --local.

Testing

• ✅ python3 - <<'PY' ... GitHub check-runs API for d31fca51648eb684790b4900b4dce4fa57cd377d ... PY — confirmed Migration replay and PR required are now completed successfully.
• ✅ git status --short --branch && git diff --stat — confirmed the local worktree is clean on branch work.
• ⚠️ set -o pipefail ... supabase start ... supabase migration up --local — local replay could not run in this container because supabase and docker are not installed here; no repo files were left changed.

View task →