You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
add the app-scoped App Preview role for preview bundle upload/promotion and channel lifecycle
let API keys be limited to selected apps while every app binding keeps the owning organization org_id
omit only the organization-wide RBAC role for app-only keys; do not create organization-less keys
remove the automatic compatibility org-reader role only for app-only keys, while preserving the organization on every app binding
verify the CLI create/delete path, including intentional --delete-bundle denial
consolidate the PR to one forward-only migration, including the scheduler repair
Security boundary
The role grants only app.read, app.read_bundles, app.upload_bundle, app.create_channel, channel.read, channel.promote_bundle, and channel.delete for selected apps. It excludes organization-wide access, app settings, user/role management, device controls, rollbacks, channel settings, and bundle deletion.
Every selected-app binding retains the owning organization org_id. “App-only” means no organization-wide RBAC role, not no organization association.
Dynamic PR channels mean this is app-scoped, not PR-name scoped: the key can operate on any channel in its selected app. A hard PR-only boundary would need a separate channel ownership/prefix model.
Rollout
Deploy the migration and dashboard.
Create a new key with Limit this key to selected apps, select the preview app, and choose App Preview.
Publish the CLI source containing the current exact channel permissions, then use npx @capgo/cli@latest.
Do not use channel delete --delete-bundle with this role.
Validation
migration-order check passed with exactly one new migration
bun lint:backend, bun test:unit (1,047 tests), and bun test:db (252 tests) passed locally
GitHub CI and automated review are rerunning on 3bfc8c850c0ce693ece4a8f0e150c9a809f3e80e
Visual
Note
High Risk
Changes API key RBAC binding behavior, introduces a new privileged-but-scoped role, and alters database function grants—areas that directly affect authorization and production security posture.
Overview
Introduces the assignable app_preview app role for CI preview workflows (bundle upload/promote, channel create/delete on selected apps, without org-wide access or bundle delete), wired through migration/seed, channel permission defaults, and i18n.
The API Keys UI gains “Limit this key to selected apps”: org pickers become an app filter only, org-level roles and org-create grants are hidden, and create/update sends app-scoped bindings only while listing logic treats legacy apikey_org_reader as non-display org access.
Backend API key create/update stops enriching app-only keys with the compatibility apikey_org_reader org binding and drops the allowSystemRole escape hatch on role binding creation. createAiApiKey member keys now require at least one app and no longer add org_member org bindings. assertApiKeyManagerCanAssignBindings runs for JWT key managers (not only API-key auth) and treats app_preview like other sensitive assignable roles unless the caller has org.update_user_roles.
The forward migration adds the role/permissions, deletes compatibility org-reader bindings, reasserts several RPC EXECUTE grants, and restores the process_all_cron_tasks cron job. Coverage includes Playwright, CLI lifecycle, RBAC SQL, unit tests, and a visual-diff route for the create-key dialog.
Reviewed by Cursor Bugbot for commit b0db1d7. Bugbot is set up for automated code reviews on this repo. Configure here.
App-scoped API keys now support the app_preview role, app-only creation and editing, restricted RBAC permissions, and organization filtering. Backend compatibility bindings were removed, database permissions and metadata were updated, and automated UI, API, CLI, and RBAC tests were added.
App Preview API Keys
Layer / File(s)
Summary
Preview role and permission contract supabase/migrations/..., supabase/seed.sql, src/components/..., src/stores/organization.ts, messages/en.json
Defines app_preview, its permissions, translations, role picker entry, and channel permission defaults.
Binding creation and assignment enforcement supabase/functions/_backend/private/role_bindings.ts, supabase/functions/_backend/public/apikey/*
Removes legacy organization-reader binding enrichment and applies direct binding validation, including app-preview assignment restrictions.
App-only API key creation and editing src/pages/ApiKeys.vue, src/services/apikeys.ts
Adds app-only scope state, conditional form sections, validation, app-only bindings, permission generation, edit detection, and selected-app requirements.
Preview scope validation and visual coverage playwright/*, tests/*, scripts/visual-diff.ts, .github/pr-screenshots/*
Tests app-only persistence, RBAC boundaries, CLI lifecycle behavior, service validation, and visual-diff setup.
No successful run was found on main (caa8138) during the generation of this report, so 6e178ee was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Not approving: Cursor Bugbot did not complete (check skipped; usage limit reached), and this RBAC/API-key binding change exceeds the low-risk approval threshold. Assigned Dalanir and WcaleNieWolny for human review.
Sent by Cursor Approval Agent: Pull Request Approver External
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Cursor Bugbot did not complete (usage limit reached), so I am not approving. Requested human review for the RBAC/API key migration changes.
Sent by Cursor Approval Agent: Pull Request Approver
Move the app_preview gate ahead of the org role precheck.replaceApiKeyBindings() already requires org.update_user_roles for every affected org before calling assertApiKeyManagerCanAssignBindings(), so the new deny list in that helper never runs on this PUT path.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@supabase/functions/_backend/public/apikey/put.ts` around lines 102 - 103,
Move the app_preview deny-list gate before the org role precheck in the PUT
flow, specifically before assertApiKeyManagerCanAssignBindings and its call to
replaceApiKeyBindings. Ensure app_preview requests are rejected before
org.update_user_roles validation can short-circuit the new gate.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/pages/ApiKeys.vue`:
- Around line 992-1017: Update validateApiKeyScope so the appOnlyScope branch
uses a dedicated “select at least one app” translation key when selectedAppIds
is empty, and add the corresponding select-at-least-one-app entry to
messages/en.json. Keep the existing role and organization validation messages
unchanged.
In `@supabase/migrations/20260708000000_prod_baseline.sql`:
- Around line 10111-10115: Remove the process_all_cron_tasks scheduler
registration from the prod baseline migration and add it to a new forward
migration using the same cron.schedule configuration. Ensure the new migration
creates the job for environments that have already applied the baseline.
In `@supabase/migrations/20260715175642_repair_rbac_function_grants.sql`:
- Line 10: Wrap the long REVOKE/GRANT statements in the migration, including the
function signatures and role lists, to comply with SQLFluff LT05 line-length
limits. Update the statements at the referenced ranges while preserving their
existing functions, privileges, and roles.
---
Outside diff comments:
In `@supabase/functions/_backend/public/apikey/put.ts`:
- Around line 102-103: Move the app_preview deny-list gate before the org role
precheck in the PUT flow, specifically before
assertApiKeyManagerCanAssignBindings and its call to replaceApiKeyBindings.
Ensure app_preview requests are rejected before org.update_user_roles validation
can short-circuit the new gate.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
Push a commit to this branch (recommended)
Create a new PR with the fixes
ℹ️ Review info⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 098ef471-c4bc-4257-9873-2a1909e6bfc7
📥 Commits
Reviewing files that changed from the base of the PR and between d750a45 and 22a84f8.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Not approving: Cursor Bugbot did not complete (check skipped; usage limit reached), and this RBAC/API-key change exceeds the low-risk approval threshold. Dalanir and WcaleNieWolny are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Approver External
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving: Cursor Bugbot did not complete (check skipped; usage limit reached), so the automated review signal is incomplete for this RBAC/API-key change. Dalanir and WcaleNieWolny are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Not approving: Cursor Bugbot did not complete (check skipped; usage limit reached), and this RBAC/API-key change exceeds the low-risk approval threshold. Dalanir and WcaleNieWolny are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Approver External
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving: Cursor Bugbot did not complete (check skipped; usage limit reached), so the automated review signal is incomplete for this RBAC/API-key change. Dalanir and WcaleNieWolny are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: medium. Not approving: Cursor Bugbot did not complete (check skipped; usage limit reached), so the automated review signal is incomplete for this RBAC/API-key change. Dalanir and WcaleNieWolny are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Not approving: Cursor Bugbot did not complete (check skipped; usage limit reached), and this RBAC/API-key change exceeds the low-risk approval threshold. Dalanir and WcaleNieWolny are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Approver External
The reason will be displayed to describe this comment to others. Learn more.
Risk: medium. Not approving: Cursor Bugbot did not complete (check skipped; usage limit reached), so the automated review signal is incomplete for this RBAC/API-key change. Dalanir and WcaleNieWolny are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Approver
The reason will be displayed to describe this comment to others. Learn more.
Risk: high. Not approving: Cursor Bugbot did not complete (check skipped; usage limit reached), and this RBAC/API-key change exceeds the low-risk approval threshold. Dalanir and WcaleNieWolny are already assigned for human review.
Sent by Cursor Approval Agent: Pull Request Approver External
The reason will be displayed to describe this comment to others. Learn more.
1 issue found and verified against the latest diff
Confidence score: 5/5
In tests/rbac-permissions.test.ts, the awkward test description wording could slightly reduce readability and make intent less clear during future maintenance, but it does not affect runtime behavior; this PR is safe to merge, and you can optionally polish the phrasing in this PR or a quick follow-up.
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="tests/rbac-permissions.test.ts">
<violation number="1" location="tests/rbac-permissions.test.ts:349">
P3: Test description reads awkwardly — the preposition after "only" is missing. Consider: "allows an app preview key only for its deployment lifecycle" or "restricts an app preview key to its deployment lifecycle only" for clarity.</violation>
</file>
Reply with feedback, questions, or to request a fix.
The reason will be displayed to describe this comment to others. Learn more.
P3: Test description reads awkwardly — the preposition after "only" is missing. Consider: "allows an app preview key only for its deployment lifecycle" or "restricts an app preview key to its deployment lifecycle only" for clarity.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At tests/rbac-permissions.test.ts, line 349:
<comment>Test description reads awkwardly — the preposition after "only" is missing. Consider: "allows an app preview key only for its deployment lifecycle" or "restricts an app preview key to its deployment lifecycle only" for clarity.</comment>
<file context>
@@ -346,6 +346,111 @@ describe('rbac permission system', () => {
expect(result.rows[0].settings_allowed).toBe(false)
})
+ it('allows an app preview key only its deployment lifecycle', async () => {
+ const slug = randomUUID().slice(0, 8)
+ const orgId = randomUUID()
</file context>
Suggested change
it('allows an app preview key only its deployment lifecycle',async()=>{
it('allows an app preview key only for its deployment lifecycle',async()=>{
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
riderx
force-pushed
the
codex/app-preview-lifecycle-role
branch
from
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Summary
App Previewrole for preview bundle upload/promotion and channel lifecycleorg_id--delete-bundledenialSecurity boundary
The role grants only
app.read,app.read_bundles,app.upload_bundle,app.create_channel,channel.read,channel.promote_bundle, andchannel.deletefor selected apps. It excludes organization-wide access, app settings, user/role management, device controls, rollbacks, channel settings, and bundle deletion.Every selected-app binding retains the owning organization
org_id. “App-only” means no organization-wide RBAC role, not no organization association.Dynamic PR channels mean this is app-scoped, not PR-name scoped: the key can operate on any channel in its selected app. A hard PR-only boundary would need a separate channel ownership/prefix model.
Rollout
npx @capgo/cli@latest.channel delete --delete-bundlewith this role.Validation
bun lint:backend,bun test:unit(1,047 tests), andbun test:db(252 tests) passed locally3bfc8c850c0ce693ece4a8f0e150c9a809f3e80eVisual
Note
High Risk
Changes API key RBAC binding behavior, introduces a new privileged-but-scoped role, and alters database function grants—areas that directly affect authorization and production security posture.
Overview
Introduces the assignable
app_previewapp role for CI preview workflows (bundle upload/promote, channel create/delete on selected apps, without org-wide access or bundle delete), wired through migration/seed, channel permission defaults, and i18n.The API Keys UI gains “Limit this key to selected apps”: org pickers become an app filter only, org-level roles and org-create grants are hidden, and create/update sends app-scoped bindings only while listing logic treats legacy
apikey_org_readeras non-display org access.Backend API key create/update stops enriching app-only keys with the compatibility
apikey_org_readerorg binding and drops theallowSystemRoleescape hatch on role binding creation.createAiApiKeymember keys now require at least one app and no longer addorg_memberorg bindings.assertApiKeyManagerCanAssignBindingsruns for JWT key managers (not only API-key auth) and treatsapp_previewlike other sensitive assignable roles unless the caller hasorg.update_user_roles.The forward migration adds the role/permissions, deletes compatibility org-reader bindings, reasserts several RPC
EXECUTEgrants, and restores theprocess_all_cron_taskscron job. Coverage includes Playwright, CLI lifecycle, RBAC SQL, unit tests, and a visual-diff route for the create-key dialog.Reviewed by Cursor Bugbot for commit b0db1d7. Bugbot is set up for automated code reviews on this repo. Configure here.