From 4d6ffa84579c2750f9d4131183901bcf6b45fa35 Mon Sep 17 00:00:00 2001 From: Garry Tan Date: Sat, 4 Apr 2026 21:18:27 -0700 Subject: [PATCH] fix: telemetry-ingest uses anon key instead of service role key MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cherry-pick PR #750 by @Gonzih. The service role key bypasses RLS and grants unrestricted database access — anon key + RLS is the right model for a public telemetry endpoint. Co-Authored-By: Gonzih Co-Authored-By: Claude Opus 4.6 (1M context) --- supabase/functions/telemetry-ingest/index.ts | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/supabase/functions/telemetry-ingest/index.ts b/supabase/functions/telemetry-ingest/index.ts index 07d65d36..125f69f6 100644 --- a/supabase/functions/telemetry-ingest/index.ts +++ b/supabase/functions/telemetry-ingest/index.ts @@ -43,9 +43,15 @@ Deno.serve(async (req) => { return new Response(`Batch too large (max ${MAX_BATCH_SIZE})`, { status: 400 }); } + // Use the anon key, not the service role key. + // The service role key bypasses Row Level Security (RLS) and grants full + // unrestricted database access — wildly over-privileged for a public + // telemetry endpoint that only needs INSERT on two tables. + // The anon key + properly configured RLS INSERT policies is correct. + // See: https://supabase.com/docs/guides/database/postgres/row-level-security const supabase = createClient( Deno.env.get("SUPABASE_URL") ?? "", - Deno.env.get("SUPABASE_SERVICE_ROLE_KEY") ?? "" + Deno.env.get("SUPABASE_ANON_KEY") ?? "" ); // Validate and transform events