Skip to content

fix(cli): skip reserved-role parameter grants in role dump (CLI-2843) - #7320

Open
7ttp wants to merge 7 commits into
developfrom
7ttp/cli-2843-db-dump-role-only-keeps-grant-on-parameter-to-reserved-roles
Open

7ttp wants to merge 7 commits into
developfrom
7ttp/cli-2843-db-dump-role-only-keeps-grant-on-parameter-to-reserved-roles

Conversation

@7ttp

@7ttp 7ttp commented Oct 24, 2026

Copy link
Copy Markdown
Member

TL;DR

fixes restoring a supabase db dump --role-only file as postgres failing on a parameter grant to a reserved role

whats improved/fixed?

supabase db dump --role-only already comments out create, alter and membership grant lines for reserved roles, but parameter grants like GRANT SET ON PARAMETER "log_min_messages" TO "supabase_realtime_admin"; passed through

linked and local projects whose realtime setup grants this get that line in roles.sql, so restoring it as postgres aborted with permission denied for parameter log_min_messages

how?

a new rule anchored to the start of the line comments out parameter grants to reserved roles, in both the dump script and the in-process filter the local stack uses

grants to other roles and grant text inside role setting values stay as they are

ref:

@7ttp 7ttp self-assigned this Oct 24, 2026
@7ttp
7ttp requested a review from a team as a code owner October 24, 2026 11:09

@github-actions github-actions Bot left a comment •

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Superseded by a newer AI review

🤖 AI Review

Both independent reviews were available. Confirmed Claude’s single non-blocking test-coverage nit. The TypeScript and shell filters implement equivalent parameter-grant matching; no functional defects or additional findings were identified.

Findings

Severity Location Category Sources Claim
⚪ NIT apps/cli/src/command-internal/pg-dump.run.integration.test.ts:70 test-coverage claude The new parameter-grant cases exercise only the TypeScript filter, leaving the corresponding shell sed rule without regression coverage. An escaping or matching regression in dumpRoleScript would not fail these tests.

Stats

Claude findings: 1 · Codex findings: 0 · Confirmed: 1 · Refuted: 0 · Uncertain: 0


Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.

Comment thread apps/cli/src/command-internal/pg-dump.run.integration.test.ts Outdated
Comment thread apps/cli/src/command-internal/pg-dump.run.ts
Comment thread apps/cli/src/command-internal/pg-dump.scripts.ts
@7ttp

7ttp commented Oct 24, 2026

Copy link
Copy Markdown
Member Author

/ai-review

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 AI Review

Both independent reviews completed with no findings. Reading the changed filters and surrounding code revealed no actionable issues or fundamental conflicts with pending next-branch work. Eight targeted Bash checks passed, covering dry-run expansion, multiline quoting, long settings, and byte preservation. The TypeScript integration suite was not run because dependencies are absent.

Findings

No issues found.

Stats

Claude findings: 0 · Codex findings: 0 · Confirmed: 0 · Refuted: 0 · Uncertain: 0


Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: manual · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

db dump --role-only keeps GRANT ... ON PARAMETER to reserved roles (e.g. supabase_realtime_admin), so restoring as postgres fails

1 participant