supabase

package
v1.4.15 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 19, 2026 License: MIT Imports: 21 Imported by: 0

Documentation

Overview

Package supabase registers the Supabase importer. Purpose: snapshot a Supabase project (direct database connection), its auth users with their bcrypt hashes and its storage objects into a portable bundle; row level security policies become Hasura permissions where they match `auth.uid() = <column>` and are reported otherwise. Inputs: --db-url-env, --api-url or --project-ref, --service-key-env (all secrets by variable name). Outputs: bundle and detection. Constraints: no URL, password or key in errors or reports.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func CheckForeignTriggers

func CheckForeignTriggers(schemaSQL string) error

CheckForeignTriggers refuses a schema whose triggers call functions of Supabase-owned schemas (for example database webhooks: supabase_functions.http_request).

Types

type Compat

type Compat struct {
	SQL        string
	Shims      []string
	Exemptions []portable.Exemption
}

Compat is the generated shim file and what it covers.

func BuildCompat

func BuildCompat(schemaSQL string) Compat

BuildCompat scans the schema dump. SQL is empty when nothing is referenced.

type Policy

type Policy struct {
	Schema, Table, Name string
	Permissive          bool
	Roles               []string
	Cmd                 string // SELECT | INSERT | UPDATE | DELETE | ALL
	Using, Check        string
}

Policy is one pg_policies row. Using and Check are "" when the policy has none.

type Result

type Result struct {
	// Doc is the export_metadata subset (nil when no policy translated).
	Doc          []byte
	Tables       int
	Permissions  int
	Untranslated []importer.Policy
	Exemptions   []portable.Exemption
}

Result is the outcome of translating every table.

func Plan

func Plan(tables []Table) (Result, error)

Plan translates every table's policies. Every policy is either part of a permission or in Untranslated, and each one is stripped from the restore, so it also gets an exemption.

type Source

type Source struct{}

func (Source) Detect

func (Source) Extract

func (Source) Extract(ctx context.Context, in importer.Input, stage string) (importer.Extracted, error)

func (Source) Flags

func (Source) Flags() []importer.FlagSpec

func (Source) Name

func (Source) Name() string

type Table

type Table struct {
	Schema, Name string
	Columns      []string
	Policies     []Policy
	// Granted lists the permission kinds (select, insert, update, delete) the Supabase role
	// `authenticated` holds on the table. A policy for a kind without the grant gives no access in
	// Postgres, so it is not translated. A nil map means every kind (unit tests).
	Granted map[string]bool
}

Table is one dumped table with its columns and policies.

type Translation

type Translation struct {
	Column string
	Kinds  []string // select | insert | update | delete
}

Translation is the Hasura form of one policy: the owner column and the permission kinds it covers.

func Translate

func Translate(p Policy, columns map[string]bool) (Translation, string)

Translate maps one policy. columns is the set of the table's columns. A non-empty reason means the policy is untranslated and the Translation is unusable.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL