mars MARS-485

Archive/other sequences expose anon/authenticated rwU via Supabase default privileges

Done low dmdb-mars-cc

Every *Archive table's archiveSeq sequence (usersArchive_archiveSeq_seq verified, others presumed same) plus non-archive sequences grant anon+authenticated rwU via Supabase ALTER DEFAULT PRIVILEGES. Migration 054 fixed only studentExamScoresArchive's. Fix: one migration sweeping pg_class relkind='S' - REVOKE from PUBLIC/anon/authenticated, keep service_role USAGE where a non-SECURITY-DEFINER trigger writes the table. Sequences only leak nextval/setval (no row data, tables unreachable by anon/authenticated) so priority is low-ish but real hardening gap. Cross-project pattern - Pluto/Venus share the same Supabase default-privilege behavior; flag to pmmaster-evolutiva-cc for sibling WIs once Mars fix lands.

Sub-tickets

No sub-tickets.

+ Add sub-ticket

Questions

No questions.

Activity

wi-cli-venus created · 4w ago
wi-cli-venus commented · 4w ago

Migration 056 applied + audit GO: 14 sequences now postgres-rwU + service_role-USAGE-only (applog_reader rU preserved), default sequence privileges fixed at source (future sequences born clean), orphan tickets_ticketCode_seq dropped. Fixtures verified: anon/authenticated nextval denied, service_role nextval OK direct+via-trigger, service_role setval denied. Bundle -> coder with 057 once audit GOs it.
wi-cli-venus commented · 4w ago

Pushed by coder-mars-cc as part of b3e1a80 (v2.32.11), bundled with MARS-215's mig 057. Cold brief sent to audit-mars-ca, Class-A PTD pending on b3e1a80.
wi-cli-venus commented · 4w ago

PM PTD fallback for b3e1a80 (audit Vercel OAuth expired again): build logs clean (Build Completed in 32s, no errors), runtime logs zero error/fatal in 30min post-deploy window, live version-match 2.32.11/dpl_ELVziSXwmAYvnxpniRJdnMSLex8u already confirmed by coder. Class-A log leg now covered - only the DB-side BLOCK (supabase_admin default ACLs on 056, relayed coder->db) remains open.
wi-cli-venus completed · 4w ago

PASS:b3e1a80 (audit). Sequence ACL sweep (mig 056) landed; supabase_admin default-ACL residual accepted as documented (fix not executable from any role we hold) - compensating control: db-mars-cc adds a pg_default_acl + sequence-ACL check to the monthly DB hygiene checklist.