fix(bundle): enforce metadata RBAC#1819
Merged
Merged
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds an RBAC permission check to the bundle metadata update handler requiring Changes
Sequence Diagram(s)sequenceDiagram
participant Client as Client
participant Handler as BundleUpdateHandler
participant RBAC as RBAC Service
participant Supabase as Supabase API
Client->>Handler: POST /bundle/update_metadata (appId, update payload)
Handler->>RBAC: checkPermission(appId, "app.upload_bundle")
alt permission denied
RBAC-->>Handler: denied
Handler-->>Client: 400 { error: "cannot_update_bundle_metadata" }
else permission granted
RBAC-->>Handler: granted
Handler->>Supabase: fetch apikey / persist metadata
Supabase-->>Handler: 200 OK
Handler-->>Client: 200 { status: "ok" }
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
📝 Coding Plan
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@tests/bundle-metadata-rbac.unit.test.ts`:
- Around line 52-80: Convert the two tests that use it(...) to concurrent mode
by replacing it(...) with it.concurrent(...) for the test cases "rejects
metadata writes when upload permission is denied" and "allows metadata writes
when upload permission is granted"; keep the existing mock reset in beforeEach
(vi.clearAllMocks()) so checkPermissionMock and supabaseApikeyMock remain
isolated, and ensure any other tests in this file follow the same
it.concurrent(...) pattern to allow the test file to run in parallel.
- Around line 4-12: The top-level arrow function queryBuilderFactory should be
converted to a function declaration to satisfy the antfu/top-level-function
rule; replace the const queryBuilderFactory = () => ({ ... }) with a function
queryBuilderFactory() { return { select: vi.fn().mockReturnThis(), eq:
vi.fn().mockReturnThis(), single: vi.fn().mockResolvedValue({ data: { id: 123,
app_id: 'com.example.app' }, error: null }), update: vi.fn().mockReturnThis(),
}; } so the implementation and vi.fn mocks remain identical but use function
declaration syntax.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 22ddca38-cedd-4e5c-bd90-dd118042d25f
📒 Files selected for processing (2)
supabase/functions/_backend/public/bundle/update_metadata.tstests/bundle-metadata-rbac.unit.test.ts
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary (AI generated)
POST /bundle/metadataapp.upload_bundlebefore bundle metadata writes proceedMotivation (AI generated)
GHSA-4x68-9j9p-frf5reports that/bundle/metadataonly enforced API key mode viamiddlewareKey(['all', 'write'])and skipped the RBAC layer used by the other bundle write endpoints. That allowed an API key with write mode but insufficient RBAC rights to update bundle metadata.Business Impact (AI generated)
This closes an RBAC bypass on bundle metadata updates. It reduces the chance that a restricted member can change bundle links or comments and keeps bundle write behavior consistent across the API.
Test Plan (AI generated)
bun run lint:backendbunx vitest run tests/bundle-metadata-rbac.unit.test.tsbun run supabase:with-env -- bunx vitest run tests/bundle.test.ts tests/bundle-error-cases.test.ts tests/bundle-metadata-rbac.unit.test.tsbun test:backend(current worktree is timing out in unrelated existing tests such astests/channel_self.test.ts,tests/stats-download.test.ts,tests/updates.test.ts,tests/bundle-semver-validation.test.ts, andtests/cron_stat_org.test.ts)Generated with AI
Summary by CodeRabbit
Bug Fixes
Tests