chore(supabase): stop publishing unused Capgo cloud edge functions - #2781
chore(supabase): stop publishing unused Capgo cloud edge functions#2781riderx wants to merge 3 commits into
Conversation
Capgo cloud traffic already runs on Cloudflare Workers; only `triggers` must stay on Supabase for pg_net queue_consumer. Keep full deploy for self-hosting. Co-authored-by: Cursor <cursoragent@cursor.com>
📝 WalkthroughWalkthroughThe change introduces a Capgo Cloud Supabase function allowlist, adds utilities and tests for generating deployment targets, updates production and preproduction scripts and CI deployment behavior, and documents Cloud versus self-hosted deployment behavior. ChangesSupabase Cloud Function Deployment
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant DeploymentWorkflow
participant SupabaseCloudFunctionsCLI
participant SupabaseCLI
participant SupabaseEdgeFunctions
DeploymentWorkflow->>SupabaseCloudFunctionsCLI: list or generate deployment arguments
SupabaseCloudFunctionsCLI-->>DeploymentWorkflow: return allowlisted function names
DeploymentWorkflow->>SupabaseCLI: deploy selected functions
SupabaseCLI->>SupabaseEdgeFunctions: publish allowlisted functions
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
Comment |
Merging this PR will not alter performance
Comparing 
Footnotes
|
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_c7f2866d-dd59-4a7c-b8ff-8c074b1c20ba) |
|
@coderabbitai review |
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@README.md`:
- Around line 459-463: Update the README cloud deployment example to use the
allowlisted Supabase functions from scripts/supabase-cloud-functions.ts,
specifically the current triggers function, instead of the all-functions
supabase functions deploy command. Clarify that this applies to Capgo Cloud
deployments across production, preprod, and alpha, while preserving the existing
all-functions command for self-hosted installations.
In `@tests/supabase-cloud-functions.unit.test.ts`:
- Around line 9-30: Extend the supabase cloud function allowlist tests around
buildCapgoCloudSupabaseDeployArgs to cover an empty explicit target list and
multiple explicit targets. Assert that an empty list preserves the required
default deployment behavior and that multiple targets are handled according to
the allowlist contract, protecting the empty-list guard and future allowlist
expansion.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 31d3ebda-33f4-4210-91ce-090f2d312e04
📒 Files selected for processing (5)
.github/workflows/build_and_deploy.ymlREADME.mdpackage.jsonscripts/supabase-cloud-functions.tstests/supabase-cloud-functions.unit.test.ts
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
Cap-go/capacitor-updater(manual)
Address review feedback: show allowlisted Capgo Cloud deploy commands and cover empty/multi-target allowlist deploy arg cases. Co-authored-by: Cursor <cursoragent@cursor.com>
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_421d6a36-1eda-4ed2-b4d9-c2dbe562211b) |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
2 issues found and verified against the latest diff
Confidence score: 2/5
- In
.github/workflows/build_and_deploy.yml, a failure path can leaveFUNCTIONSempty and causesupabase functions deployto deploy every function, which can accidentally ship unapproved code to production—add an explicit empty-array guard and fail fast before deploy. - In
scripts/supabase-cloud-functions.ts, the optional deploy-argument input can emit arbitrary function names, so a future caller could bypass the intended cloud allowlist through this helper—restrict the parameter type/validation to allowlisted function identifiers only.
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="scripts/supabase-cloud-functions.ts">
<violation number="1" location="scripts/supabase-cloud-functions.ts:37">
P2: The deploy-argument helper can emit arbitrary function names when a caller supplies its optional argument, so a future caller can bypass the cloud allowlist while still using the allowlist-named API. Typing this parameter as `readonly CapgoCloudSupabaseFunction[]` keeps the helper aligned with its security boundary.</violation>
</file>
<file name=".github/workflows/build_and_deploy.yml">
<violation number="1" location=".github/workflows/build_and_deploy.yml:98">
P1: If the script fails, FUNCTIONS will be empty and `supabase functions deploy` will silently deploy ALL functions, defeating the allowlist. Add a guard: `if [ ${#FUNCTIONS[@]} -eq 0 ]; then ... exit 1; fi`</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| # Capgo cloud only publishes functions still needed on Supabase (pg_net entry). | ||
| # Self-hosting keeps deploying all functions via `supabase functions deploy`. | ||
| run: | | ||
| mapfile -t FUNCTIONS < <(bun scripts/supabase-cloud-functions.ts list) |
There was a problem hiding this comment.
P1: If the script fails, FUNCTIONS will be empty and supabase functions deploy will silently deploy ALL functions, defeating the allowlist. Add a guard: if [ ${#FUNCTIONS[@]} -eq 0 ]; then ... exit 1; fi
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/build_and_deploy.yml, line 98:
<comment>If the script fails, FUNCTIONS will be empty and `supabase functions deploy` will silently deploy ALL functions, defeating the allowlist. Add a guard: `if [ ${#FUNCTIONS[@]} -eq 0 ]; then ... exit 1; fi`</comment>
<file context>
@@ -92,7 +92,11 @@ jobs:
+ # Capgo cloud only publishes functions still needed on Supabase (pg_net entry).
+ # Self-hosting keeps deploying all functions via `supabase functions deploy`.
+ run: |
+ mapfile -t FUNCTIONS < <(bun scripts/supabase-cloud-functions.ts list)
+ supabase functions deploy "${FUNCTIONS[@]}"
</file context>
| } | ||
|
|
||
| export function buildCapgoCloudSupabaseDeployArgs( | ||
| functions: readonly string[] = CAPGO_CLOUD_SUPABASE_FUNCTIONS, |
There was a problem hiding this comment.
P2: The deploy-argument helper can emit arbitrary function names when a caller supplies its optional argument, so a future caller can bypass the cloud allowlist while still using the allowlist-named API. Typing this parameter as readonly CapgoCloudSupabaseFunction[] keeps the helper aligned with its security boundary.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At scripts/supabase-cloud-functions.ts, line 37:
<comment>The deploy-argument helper can emit arbitrary function names when a caller supplies its optional argument, so a future caller can bypass the cloud allowlist while still using the allowlist-named API. Typing this parameter as `readonly CapgoCloudSupabaseFunction[]` keeps the helper aligned with its security boundary.</comment>
<file context>
@@ -0,0 +1,62 @@
+}
+
+export function buildCapgoCloudSupabaseDeployArgs(
+ functions: readonly string[] = CAPGO_CLOUD_SUPABASE_FUNCTIONS,
+): string[] {
+ if (functions.length === 0)
</file context>
supabase.functions.invoke always uses SUPABASE_URL, so console/CLI still need private, apikey, app, bundle, channel, files, organization, statistics, and webhooks published alongside triggers. Co-authored-by: Cursor <cursoragent@cursor.com>
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_f938cc36-40c2-45e4-9a02-699c82347328) |
|
|
Superseded by #2785 (invoke → Cloudflare + updated allowlist/deprecation). Closing in favor of that PR. |
|
Superseded by #2785 |
1 participant
Summary (AI generated)
scripts/supabase-cloud-functions.ts.pg_net(triggers) and every function still reached by console/CLIsupabase.functions.invoke(SDK always usesSUPABASE_URL/sb.capgo.app, not Cloudflare).supabase functions deploystill deploys every function.Motivation (AI generated)
Plugin hot paths and unused Capgo cloud Supabase endpoints can still be hit on
sb.capgo.appand stress primary infra. Stopping Capgo cloud publish for those unused ones reduces that risk without breaking console/CLI invoke traffic or self-hosters.Business Impact (AI generated)
Cuts abuse surface on unused Supabase plugin/ops endpoints while keeping Capgo console and CLI working through
functions.invoke.Manual prod cleanup (AI generated)
Deploy does not delete existing functions. After merge/release, delete these from Capgo prod (
xvwzpoazmxkqosrdewyv) if desired:Keep published on Capgo cloud Supabase:
apikeyappbundlechannelfilesorganizationprivatestatisticstriggers(pg_net →/functions/v1/triggers/queue_consumer/sync)webhooksDelete (not used via
functions.invoke/ pg_net on Capgo cloud):buildchannel_selfcheck_cpu_usagedevicenotificationsokplugin_regionsqueue_healthreplicationstatsupdatesupdates_debugstripe_failed_payment_audit(orphan in prod, not in repo)Test Plan (AI generated)
bunx vitest run tests/supabase-cloud-functions.unit.test.tssupabase functions deployfunctions.invokepaths (private/apikey/app/webhooks/statistics) and CLI bundle/channel/files upload_link againstsb.capgo.appplugin.*.capgo.app)Generated with AI
Note
Medium Risk
Wrong allowlist would break console/CLI
functions.invokeor Postgrespg_netontriggers; mitigated by explicit list and unit tests, but prod smoke of invoke paths is still important.Overview
Capgo cloud Supabase deploys no longer run a blanket
supabase functions deploy. CI (build_and_deploy.yml) anddeploy:supabase:prod/preprodnow deploy only the allowlist fromscripts/supabase-cloud-functions.ts(10 functions:triggersforpg_net, plus console/CLIfunctions.invoketargets likeprivate,apikey,bundle, etc.). Plugin paths (updates,stats, …) and other ops endpoints are omitted from cloud publish.A new script exposes
list,deploy-args, andskip-listCLI modes; unit tests lock the allowlist and skipped set against local function dirs. README splits Capgo cloud vs self-hosted deploy instructions; self-hosting still uses fullsupabase functions deploy.Note: This change stops re-publishing skipped functions; it does not remove already-deployed functions from prod (manual delete per release notes).
Reviewed by Cursor Bugbot for commit 62b13d7. Bugbot is set up for automated code reviews on this repo. Configure here.