fix(rbac): block preview public channels

[riderx]

Summary

• Require app.update_settings to create a public/default channel.
• Keep App Preview keys able to create private PR channels and atomically upload/promote their bundles.
• Enforce the same boundary for direct CLI table writes and the raw-SQL create-and-promote path.

RLS execution model

• Surface: public.channels INSERT WITH CHECK; it runs once per inserted channel row from the CLI/PostgREST path.
• Existing app.create_channel remains required for every new channel.
• A row with public = true additionally requires the existing, caller-scoped app.update_settings RBAC check on the row owner app. App Preview does not receive that permission.
• The policy adds no tables, joins, or new helper functions. It uses the existing RBAC request helper with the insert row indexed owner_org and app_id values.
• The endpoint atomic create-and-promote transaction uses a direct PostgreSQL client and therefore bypasses RLS; it performs the matching app.update_settings guard before inserting.

EXPLAIN and integration follow-up

• Local EXPLAIN (ANALYZE, BUFFERS) and the affected lifecycle integration test are pending: the local Supabase runtime cannot start because Docker/Dory is unavailable (Cannot connect to .../.dory/dory.sock).
• Before this leaves draft, collect policy-plan evidence for App Preview non-public insert, App Preview public insert denial, and an app-admin public insert. CI must also pass the isolated lifecycle test.

Validation

• bun lint
• bun lint:backend
• Focused ESLint for changed tests
• bun run typecheck:backend
• bunx vitest run tests/channel-post.unit.test.ts - 16 passed
• bun test:unit - 160 files / 1,065 tests passed

---

Note

Medium Risk
Tightens authorization on delivery-critical channel settings across API and RLS; behavior change for any caller that created public channels with only app.create_channel.

Overview
App Preview keys can no longer create or mark channels as public/default without app.update_settings, closing a gap where preview credentials could change app-wide delivery settings while still allowing private preview channels and upload/promote flows.

The channel POST handler now rejects requests with public: true when the caller lacks app.update_settings (after the usual create/update channel checks), for both new channels and toggling an existing channel public. Channels INSERT RLS is updated so rows with public = true require the same permission on direct CLI/PostgREST inserts (e.g. channel add --default); private inserts still need only app.create_channel.

Tests add unit coverage for the API guard and extend the CLI preview lifecycle integration test to assert default-channel CLI creation and public channel POST are blocked with no stray rows created.

^{Reviewed by Cursor Bugbot for commit cfe3ea5. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Bug Fixes

  • Public channel creation now requires both channel-creation and app-settings permissions.
  • Unauthorized public channel requests return clearer access errors with relevant app and channel details.
  • Preview channel creation now enforces restrictions against unauthorized or unsupported channel and bundle operations.

• Tests

  • Added coverage confirming permission checks, error responses, and prevention of improperly created preview channels.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 6ecc69d2-e696-4770-bfa4-9ac5d1332dc7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Public channel creation now requires settings-update permission in addition to channel-creation permission. The database insert policy and unit and lifecycle tests enforce and verify these authorization guards.

Changes

Public channel authorization

Layer / File(s)	Summary
Handler permission checks supabase/functions/_backend/public/channel/post.ts, tests/channel-post.unit.test.ts	Public channel creation checks app.update_settings after app.create_channel; the unit test verifies denial behavior and call order.
Database and preview lifecycle guards supabase/migrations/.../20260717133500_app_preview_public_channel_guard.sql, tests/cli-preview-lifecycle.test.ts	The channels insert policy adds conditional RBAC checks, and lifecycle tests verify blocked default and public preview channel creation.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• Cap-go/capgo.app#2698: Modifies channel creation authorization in the same endpoint.

Suggested labels: codex

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is concise and accurately summarizes the main RBAC change to block public preview channels.
Description check	✅ Passed	The description covers the summary and validation, but it is missing the template's explicit Test plan, Screenshots, and Checklist sections.

---

_{Comment @coderabbitai help to get the list of available commands.}

[codspeed-hq]

Merging this PR will not alter performance

✅ 43 untouched benchmarks
⏩ 2 skipped benchmarks¹

---

_{Comparing codex/guard-app-preview-public-channel (1ee7330) with main (cf9c869)}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_577ec601-13f5-4795-991d-aa88a224e618)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_fa0907f3-988c-4aab-8f1d-9a7834fd8632)

[cubic-dev-ai]

Review completed against the latest diff

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_ab96f4b2-26d5-4bc9-ba2d-e0ed44955c91)

[riderx]

@cubic-dev-ai review

[cubic-dev-ai]

@cubic-dev-ai review

@riderx I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 4 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud