fix(rbac): block preview public channels

[riderx]

Summary

• Require app.update_settings to create a public/default channel.
• Keep App Preview keys able to create private PR channels and atomically upload/promote their bundles.
• Enforce the same boundary for direct CLI table writes and the raw-SQL create-and-promote path.

RLS execution model

• Surface: public.channels INSERT WITH CHECK; it runs once per inserted channel row from the CLI/PostgREST path.
• Existing app.create_channel remains required for every new channel.
• A row with public = true additionally requires the existing, caller-scoped app.update_settings RBAC check on the row owner app. App Preview does not receive that permission.
• The policy adds no tables, joins, or new helper functions. It uses the existing RBAC request helper with the insert row indexed owner_org and app_id values.
• The endpoint atomic create-and-promote transaction uses a direct PostgreSQL client and therefore bypasses RLS; it performs the matching app.update_settings guard before inserting.

EXPLAIN and integration follow-up

• Local EXPLAIN (ANALYZE, BUFFERS) and the affected lifecycle integration test are pending: the local Supabase runtime cannot start because Docker/Dory is unavailable (Cannot connect to .../.dory/dory.sock).
• Before this leaves draft, collect policy-plan evidence for App Preview non-public insert, App Preview public insert denial, and an app-admin public insert. CI must also pass the isolated lifecycle test.

Validation

• bun lint
• bun lint:backend
• Focused ESLint for changed tests
• bun run typecheck:backend
• bunx vitest run tests/channel-post.unit.test.ts - 16 passed
• bun test:unit - 160 files / 1,065 tests passed

---

Note

High Risk
Authorization boundary changes on channel creation and public flag updates affect delivery configuration; mistakes could block legitimate admins or leave a bypass path if API and RLS diverge.

Overview
App Preview keys can no longer create or mark channels as public/default, which would change app-wide delivery settings. That now requires app.update_settings in addition to the existing create/update channel permissions.

The POST /channel handler rejects public: true when the caller lacks app.update_settings (same cannot_access_app error). public.channels RLS INSERT/UPDATE policies mirror the rule so CLI/PostgREST direct writes cannot bypass the API.

Unit tests cover create vs. update public-channel denials; the CLI preview lifecycle integration test asserts default-channel CLI creation and public channel POST are blocked and no public rows are persisted.

^{Reviewed by Cursor Bugbot for commit 1ee7330. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Bug Fixes

  • Public channel creation now requires both channel-creation and app-settings permissions.
  • Unauthorized public channel requests return clearer access errors with relevant app and channel details.
  • Preview channel creation now enforces restrictions against unauthorized or unsupported channel and bundle operations.

• Tests

  • Added coverage confirming permission checks, error responses, and prevention of improperly created preview channels.

[coderabbitai]

📝 Walkthrough

Walkthrough

Public channel creation now requires settings-update permission in addition to channel-creation permission. The database insert policy and unit and lifecycle tests enforce and verify these authorization guards.

Changes

Public channel authorization

Layer / File(s)	Summary
Handler permission checks supabase/functions/_backend/public/channel/post.ts, tests/channel-post.unit.test.ts	Public channel creation checks app.update_settings after app.create_channel; the unit test verifies denial behavior and call order.
Database and preview lifecycle guards supabase/migrations/.../20260717133500_app_preview_public_channel_guard.sql, tests/cli-preview-lifecycle.test.ts	The channels insert policy adds conditional RBAC checks, and lifecycle tests verify blocked default and public preview channel creation.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• Cap-go/capgo.app#2698: Modifies channel creation authorization in the same endpoint.

Suggested labels: codex

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main RBAC change that blocks preview public channels.
Description check	✅ Passed	The description explains the change, implementation, validation, and pending integration checks; it omits the exact Test plan heading and completed checklist selections.

---

_{Comment @coderabbitai help to get the list of available commands.}

[codspeed-hq]

Merging this PR will not alter performance

✅ 43 untouched benchmarks
⏩ 2 skipped benchmarks¹

---

_{Comparing codex/guard-app-preview-public-channel (1ee7330) with main (cf9c869)}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_577ec601-13f5-4795-991d-aa88a224e618)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_fa0907f3-988c-4aab-8f1d-9a7834fd8632)

[cubic-dev-ai]

Review completed against the latest diff

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_ab96f4b2-26d5-4bc9-ba2d-e0ed44955c91)

[riderx]

@cubic-dev-ai review

[cubic-dev-ai]

@cubic-dev-ai review

@riderx I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 4 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_68f59008-fe23-4ba5-9dba-bae8401d1f42)