feat: revoke supabase_{auth|storage}_admin from postgres

[soedirgo]

Context

Restricts privileges for postgres on auth and storage schemas to prevent unintentional breakage. realtime will be handled out of band because the privileges are set up in the supabase/realtime repo.

Tested on local infra:

pause & restore (15.8.1.079 to 15.8.1.079-roles-1):

• create project on 15.8.1.079
• run q1, it should succeed
• pause & restore into 15.8.1.079-roles-1
• run all statements in q1 one by one, each must fail
• run q2, it must succeed
• run all statements in q3 one by one, each must fail

queries

q1

-- create custom table in auth schema
create table auth.custom_table();

-- create custom function in auth schema
create function auth.hello_world_function()
returns trigger as 'begin return new; end' LANGUAGE plpgsql;

-- create custom table in storage schema
create table storage.custom_table();

-- create custom function in storage schema
create function storage.hello_world_function()
returns trigger as 'begin return new; end' LANGUAGE plpgsql;

q2

-- create trigger on internal auth table
create trigger hello_world_trigger
after insert on auth.users
for each row
execute function auth.hello_world_function();

-- drop trigger on internal auth table
drop trigger hello_world_trigger on auth.users;

-- create fkey referencing internal auth table
create table public.t (
  id int8 generated by default as identity primary key,
  user_id uuid references auth.users(id)
);
drop table public.t;

-- create trigger on internal storage table
create trigger hello_world_trigger
after insert on storage.objects
for each row
execute function storage.hello_world_function();

-- drop trigger on internal storage table
drop trigger hello_world_trigger on storage.objects;

-- create fkey referencing internal storage table
create table public.t (
  id int8 generated by default as identity primary key,
  object_id uuid references storage.objects(id)
);
drop table public.t;

q3

insert into auth.schema_migrations default values;
delete from auth.schema_migrations;
truncate auth.schema_migrations;
drop table auth.schema_migrations;
insert into storage.migrations default values;
delete from storage.migrations;
truncate storage.migrations;
drop table storage.migrations;

[steve-chavez]

The revoke all privileges on the migrations tables are not covered by tests. We should add those to ensure no regressions.

[steve-chavez]

We need some covering tests as mentioned above.

[steve-chavez]

Merged #1577 to help with the testing. Now this PR would just need a rebase.

[soedirgo]

Rebased the PR

[steve-chavez]

Tests need to be adjusted, see logs (do ctrl+f "regression.diffs").

Looks like these lines have to be removed:

postgres/nix/tests/expected/auth.out

Lines 135 to 148 in 24f17a3

	auth | schema_migrations | dashboard_user | DELETE | f
	auth | schema_migrations | dashboard_user | INSERT | f
	auth | schema_migrations | dashboard_user | REFERENCES | f
	auth | schema_migrations | dashboard_user | SELECT | f
	auth | schema_migrations | dashboard_user | TRIGGER | f
	auth | schema_migrations | dashboard_user | TRUNCATE | f
	auth | schema_migrations | dashboard_user | UPDATE | f
	auth | schema_migrations | postgres | DELETE | f
	auth | schema_migrations | postgres | INSERT | f
	auth | schema_migrations | postgres | REFERENCES | f
	auth | schema_migrations | postgres | SELECT | f
	auth | schema_migrations | postgres | TRIGGER | f
	auth | schema_migrations | postgres | TRUNCATE | f
	auth | schema_migrations | postgres | UPDATE | f

[soedirgo]

Thanks, all fixed now