[codex] Restore app-scoped statistics access#1871
Conversation
|
Caution Review failedPull request was closed or merged during review 📝 WalkthroughWalkthroughThis PR implements app-scoped and org-scoped Role-Based Access Control (RBAC) for the metrics system by introducing secure database functions with JWT validation, conditional parameter handling, and caching logic. The TypeScript backend is updated to branch requests based on whether an app ID is provided, and comprehensive tests validate both authenticated and unauthenticated access patterns. Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant Backend as TypeScript Backend
participant Supabase as Supabase RPC
participant JWT as JWT Validator
participant Cache as Metrics Cache
participant DB as Database
Client->>Backend: GET /statistics/app/:app_id
Backend->>Backend: Extract appId & ownerOrg
Backend->>Supabase: get_app_metrics(p_org_id, p_app_id, p_start_date, p_end_date)
Supabase->>JWT: Extract caller role from JWT
Supabase->>Supabase: get_identity_org_appid(caller)
Supabase->>Supabase: check_min_rights(caller, app)
Supabase->>DB: Verify app exists for org
Supabase->>Cache: Check cache entry validity
alt Cache missing or stale
Supabase->>DB: seed_get_app_metrics_caches()
DB-->>Cache: Populate cache
end
Cache-->>Supabase: Return cached metrics JSON
Supabase->>Supabase: jsonb_to_recordset & filter by app_id
Supabase-->>Backend: Metrics rows
Backend->>Backend: Coerce to AppMetricRow[] via ?? []
Backend-->>Client: Statistics response
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 SQLFluff (4.0.4)supabase/migrations/20260327210500_app_scoped_metrics_rbac.sqlUser Error: No dialect was specified. You must configure a dialect or specify one on the command line using --dialect after the command. Available dialects: Comment |
|
1 participant
Summary (AI generated)
public.get_app_metrics(org_id, app_id, start_date, end_date)overload that preserves the March org-level hardening while allowing app-level readers to fetch their own metrics/statistics/app/:app_idto the new app-scoped RPC instead of the org-scoped RPC that now requires broader access200response with an empty array no longer passes as successMotivation (AI generated)
The March 13, 2026 security hardening correctly restricted the org-scoped metrics RPC, but the app statistics endpoint still called that org-scoped RPC after only checking
app.read. For app-scoped users and subkeys, the endpoint therefore returned200with empty metrics even though chart data existed.Business Impact (AI generated)
This restores MAU and bandwidth charts for app-scoped customers without weakening the org-level RBAC fix. It removes a silent failure mode on a core dashboard path and reduces support/debug time for missing statistics.
Test Plan (AI generated)
bun lint supabase/functions/_backend/public/statistics/index.ts tests/statistics.test.tsbun run supabase:db:resetSUPABASE_URL=http://127.0.0.1:62001 SUPABASE_DB_URL=postgresql://postgres:postgres@127.0.0.1:62002/postgres SUPABASE_ANON_KEY=sb_publishable_ACJWlzQHlZjBrEguHvfOxg_3BJgxAaH bun test tests/statistics.test.tsGenerated with AI
Summary by CodeRabbit
New Features
Bug Fixes
Tests