supabase / cli / 32144633196
62%
develop: 62%

LAST BUILD BRANCH: gh-readonly-queue/develop/pr-6275-dc97151e51eca112de94c5b9bfe102ee798b7caf
DEFAULT BRANCH: develop
Ran
Jobs 1
Files 95
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 62.406%. Remained the same
32144633196

push

github

web-flow 
fix(cli): restore postgres after role reverts (CLI-2205) (#6246)

## TL;DR

Passwordless `db push --linked` breaks on any migration containing
`reset role`:
the login role path relies on a session level `SET SESSION ROLE
postgres` that the migration itself undoes.
File runners now re-assert the step-down immediately after each
role-reverting statement, at the end of each file, and before every CLI
owned ledger write, so the whole file behaves the same on both auth
paths.

## whats biting?

The passwordless path connects as a temp `cli_login_*` role and steps
down to `postgres` once at connect. A migration's `reset role` reverts
the session to the login role, so:

- the appended history insert fails with `permission denied for schema
supabase_migrations (SQLSTATE 42501)` and rolls the migration back, even
though every user statement succeeded
- authored transaction and pg-delta no-transaction files commit their
statements but never record, so the next push re-applies them
- statements between the `reset role` and the end of the same file run
as the login role, so `granted by current_user` cleanup silently no-ops
while the push exits 0 (reproduced on staging: the stale
`pg_auth_members` grant survives)
- later files and the `seed_files` upsert run as the login role too

## fixed now by:

- `LegacyDbSession.restoreRoleSql` (set only when the step-down ran) is
injected by every file runner right after each top-level role revert
(`RESET ROLE`, `SET [SESSION] ROLE [TO|=] NONE|DEFAULT` including a
case-sensitively quoted `'none'`, `RESET SESSION AUTHORIZATION`, `SET
SESSION AUTHORIZATION DEFAULT`, `DISCARD ALL`), and again at end of file
and before the history insert and both `seed_files` upserts, so
`current_user` matches a password session for the whole file
- injected restores never shift `At statement: N` and are never recorded
in the history row; deliberate `set role <x>` choreography is untouched,
and password, local and plain `--db-url` sessions see a... (continued)

5571 of 8927 relevant lines covered (62.41%)

6.65 hits per line

Jobs
ID Job ID Ran Files Coverage
1 32144633196.1 95
62.41
 GitHub Action Run
Source Files on build 32144633196