Skip to content

fix(rbac): enforce API key expiration policy in permission checks #2130

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
teixr12 wants to merge 6 commits into
base: main
Choose a base branch
from
Open

fix(rbac): enforce API key expiration policy in permission checks #2130

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
c0ac762
fix(rbac): enforce apikey expiration policy in permission checks
teixr12 May 11, 2026
9af6165
fix(rbac): enforce max api key expiration policy
teixr12 May 11, 2026
b28b487
docs(rbac): clarify api key policy lookup
teixr12 May 11, 2026
2c3dc12
fix: enforce org max api key age in TS policy helper
teixr12 May 11, 2026
1604f91
chore: refresh rbac expiration migration timestamp
teixr12 May 11, 2026
7f7523f
fix: anchor max key age checks to creation time
teixr12 May 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions supabase/functions/_backend/utils/supabase.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -311,15 +311,17 @@ export async function apikeyHasOrgRightWithPolicy(
c: Context,
key: Database['public']['Tables']['apikeys']['Row'],
orgId: string,
supabase: SupabaseClient<Database>,
_supabase: SupabaseClient<Database>,
): Promise<{ valid: boolean, error?: string }> {
// First check basic org access
if (!apikeyHasOrgRight(key, orgId)) {
return { valid: false, error: 'invalid_org_id' }
}

// Then check if org requires expiring keys
const policyCheck = await checkApikeyMeetsOrgPolicy(c, key, orgId, supabase)
// Then check if org requires expiring keys. The scope check above proves the
// key is org-scoped; use service role for the policy lookup so runtime
// permission denials for non-expiring keys do not hide the policy row.
const policyCheck = await checkApikeyMeetsOrgPolicy(c, key, orgId, supabaseAdmin(c))
if (!policyCheck.valid) {
return policyCheck
}
Expand Down
Loading
Loading