From e1f5c91835fb959751aee28815ce16ee389a17b5 Mon Sep 17 00:00:00 2001 From: Your Name Date: Fri, 21 Aug 2026 21:22:10 +0530 Subject: [PATCH] fix: revoke CREATEROLE from supabase_auth_admin --- migrations/db/init-scripts/00000000000001-auth-schema.sql | 2 +- .../20260821154147_revoke_createrole_from_auth_admin.sql | 4 ++++ nix/tests/expected/roles.out | 2 +- nix/tests/expected/z_multigres-orioledb-17_roles.out | 2 +- 4 files changed, 7 insertions(+), 3 deletions(-) create mode 100644 migrations/db/migrations/20260821154147_revoke_createrole_from_auth_admin.sql diff --git a/migrations/db/init-scripts/00000000000001-auth-schema.sql b/migrations/db/init-scripts/00000000000001-auth-schema.sql index ad47aadd9c..11d4635f75 100644 --- a/migrations/db/init-scripts/00000000000001-auth-schema.sql +++ b/migrations/db/init-scripts/00000000000001-auth-schema.sql @@ -109,7 +109,7 @@ $$ language sql stable; GRANT USAGE ON SCHEMA auth TO anon, authenticated, service_role; -- Supabase super admin -CREATE USER supabase_auth_admin NOINHERIT CREATEROLE LOGIN NOREPLICATION; +CREATE USER supabase_auth_admin NOINHERIT NOCREATEROLE LOGIN NOREPLICATION; GRANT ALL PRIVILEGES ON SCHEMA auth TO supabase_auth_admin; GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA auth TO supabase_auth_admin; GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA auth TO supabase_auth_admin; diff --git a/migrations/db/migrations/20260821154147_revoke_createrole_from_auth_admin.sql b/migrations/db/migrations/20260821154147_revoke_createrole_from_auth_admin.sql new file mode 100644 index 0000000000..e1cce2f740 --- /dev/null +++ b/migrations/db/migrations/20260821154147_revoke_createrole_from_auth_admin.sql @@ -0,0 +1,4 @@ +-- migrate:up +alter role supabase_auth_admin nocreaterole; + +-- migrate:down diff --git a/nix/tests/expected/roles.out b/nix/tests/expected/roles.out index 78a60dc24d..2ae613b438 100644 --- a/nix/tests/expected/roles.out +++ b/nix/tests/expected/roles.out @@ -45,7 +45,7 @@ order by rolname; postgres | t | t | f | t | t | t | -1 | t | service_role | f | f | f | t | f | f | -1 | t | supabase_admin | t | t | t | t | t | t | -1 | t | - supabase_auth_admin | t | t | f | f | f | f | -1 | f | + supabase_auth_admin | f | t | f | f | f | f | -1 | f | supabase_etl_admin | f | t | f | t | f | t | -1 | t | supabase_functions_admin | t | t | f | f | f | f | -1 | f | supabase_privileged_role | f | f | f | t | f | f | -1 | f | diff --git a/nix/tests/expected/z_multigres-orioledb-17_roles.out b/nix/tests/expected/z_multigres-orioledb-17_roles.out index 9e530eee17..e47917c96f 100644 --- a/nix/tests/expected/z_multigres-orioledb-17_roles.out +++ b/nix/tests/expected/z_multigres-orioledb-17_roles.out @@ -42,7 +42,7 @@ order by rolname; postgres | t | t | f | t | t | t | -1 | t | service_role | f | f | f | t | f | f | -1 | t | supabase_admin | t | t | t | t | t | t | -1 | t | - supabase_auth_admin | t | t | f | f | f | f | -1 | f | + supabase_auth_admin | f | t | f | f | f | f | -1 | f | supabase_etl_admin | f | t | f | t | f | t | -1 | t | supabase_functions_admin | t | t | f | f | f | f | -1 | f | supabase_privileged_role | f | f | f | t | f | f | -1 | f |