fix(db): supabase-target checks vs platform-managed state - #109
Merged
Conversation
Two checker corrections surfaced by the first post-contract apply against production, both verified with live probes on production and on a fresh project: - the runtime ACL union resolved object_name to type name (63-byte limit) because the first branch selected relname bare, silently truncating any function signature longer than 63 characters so it could never match the expected set; the six long-signature webhooks functions were falsely flagged. Casting the first branch to text fixes resolution for the whole union. - supautils grants every role that postgres creates back to postgres (grantor supabase_admin) on every Supabase project, including fresh ones (probe-verified). The zero-membership check now exempts exactly that platform-managed membership and still flags everything else.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two checker corrections found by the first post-Wave-B
--applyagainst production (the assertion had not run since the contract was tightened). Both live-probe-verified on production AND a fresh 2026 project:relname(typename), so the union resolvedobject_nametonameand truncated every function signature past 63 bytes — the six long-signaturewebhooks_*functions could never match the expected set. One-line::textcast.postgrescreates is granted back topostgres(grantorsupabase_admin) on every Supabase project — verified by creating a probe role on a fresh project. The zero-membership check now exempts exactlyapp_* → postgresand flags all else.Verification notes
pnpm lint/pnpm typecheckpnpm db:migrate -- --dry-runagainst production with the fixed checker: "Production schema contract verified." with 0000 baselined and 0001/0002/0003 applied.(DB-state note recorded in the PR trail: the one-time 0000 ledger-hash update documented in #108 was executed before the apply; two stale
max-tier entitlement rows were normalized topremiumto satisfy 0001's CHECK constraint.)