pg_net EXECUTE to PUBLIC: measure whether this ref grants net.http_post to every login role
Per-ref leg of ENAMEL-35 (db-enamel-cc, 2026-09-11). MEASURED on ref eprpywqwzsvrjeaforei: proacl is NULL on every net.* function, which means EXECUTE to PUBLIC, and has_function_privilege on net.http_post returns TRUE for all THIRTEEN login roles including supabase_read_only_user, applog_writer and venusApp. Consequence: any DB credential on that ref is an arbitrary outbound-HTTP primitive with the database as origin, plus net.worker_restart. Table grants do not bound it and no per-relation privilege audit surfaces it. Root cause is upstream: extensions.grant_pg_net_access() contains the correct REVOKE ... FROM PUBLIC but gates it on extversion IN ('0.2'...'0.11.0') under the comment '0.12.0 onwards dont need these applied'; that ref runs 0.20.3 so it never fires and the premise is false. SCOPE FOR THIS REF, read-only: (1) select extversion from pg_extension where extname='pg_net'; (2) has_function_privilege per login role on net.http_post, net.http_get and net.worker_restart; (3) proacl on every net.* function. VERSION IS THE DISCRIMINATOR - do not inherit enamels result, measure this ref. DO NOT WRITE A REVOKE MIGRATION: as postgres the REVOKE raises no error and changes nothing, because a non-owner revoke warns rather than failing, so the migration would ship green and fix nothing; set role supabase_admin is 42501. Remediation is a Supabase support request or an explicit accept-the-condition, and that routes to Elazar.
Activity
-
MEASURED ON VENUS ref fjnhfjwskixzsilxrkph, 2026-09-11 12:38-12:45 UTC, read-only. CONFIRMED - venus is identical to enamel, not inherited. (1) pg_net extversion = 0.20.0, schema extensions. extensions.grant_pg_net_access() on THIS ref carries the same gate, verbatim: extversion IN ('0.2','0.6','0.7','0.7.1','0.8.0','0.10.0','0.11.0'). 0.20.0 is not in that list, so the REVOKE never fires here either. (2) proacl is NULL on ALL TWELVE net.* functions (_await_response, _encode_url_with_params_array, _http_collect_response, _urlencode_string, check_worker_is_up, http_collect_response, http_delete, http_get, http_post, wait_until_running, wake, worker_restart), every one owned by supabase_admin. NULL proacl = EXECUTE to PUBLIC. (3) has_function_privilege is TRUE on net.http_post, net.http_get AND net.worker_restart for ALL SIXTEEN login roles on this ref - agent_audit_venus_ca, agent_db_venus_cc, applog_reader, applog_writer, authenticator, errscan_ro, pgbouncer, pm_triage_reader, postgres, supabase_admin, supabase_auth_admin, supabase_etl_admin, supabase_functions_admin, supabase_read_only_user, supabase_replication_admin, supabase_storage_admin. Venus has 16 login roles where enamel has 13; the named read-only roles minted for attribution (errscan_ro, pm_triage_reader, applog_reader, supabase_read_only_user, agent_audit_venus_ca, agent_db_venus_cc) are all inside the set. No REVOKE migration written, per ruling 1.