davide/CRAPP
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

DD-011: make Google login the only way in

Browse Source 
Remove the free player selection from /benvenuto: without a Supabase session
no screen renders, and the VITE_AUTH_OBBLIGATORIA bridge flag is gone.
Admin rights now come only from user_roles, so the hardcoded name list in
crapp-data.ts is deleted along with its tests.

Add migration m4_solo_autenticati, which revokes anon access to the v1.0
tables. Apply it only once the whole team has linked an account.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
davide
2026-08-31 18:21:34 +02:00
co-authored by Claude Opus 5
parent f325c0485c
commit 1036eb860d
13 changed files with 78 additions and 143 deletions
Download Patch File Download Diff File Expand all files Collapse all files
supabase/migrations/20260831120000_m4_solo_autenticati.sql
+19
View File
@@ -0,0 +1,19 @@
-- M4 — Chiusura degli accessi anonimi alle tabelle v1.0 (DD-011).
--
-- Da applicare SOLO quando tutti hanno collegato l'account Google: da qui in poi il
-- ruolo `anon` non legge né scrive più nulla, quindi chi non ha fatto login vede l'app
-- vuota. Le route in `src/routes/api/public/` usano la service role e non sono toccate.
--
-- Le policy restano dichiarate `TO anon, authenticated`: senza GRANT il ruolo anon non
-- arriva comunque alla tabella, e le policy continuano a valere per gli autenticati.
REVOKE ALL ON public.turni_palloni FROM anon;
REVOKE ALL ON public.push_subscriptions FROM anon;
REVOKE ALL ON public.badge_social_voti FROM anon;
REVOKE ALL ON public.scout_sessioni FROM anon;
REVOKE ALL ON public.scout_live FROM anon;
REVOKE ALL ON public.mvp_voti FROM anon;
REVOKE ALL ON public.risposte_presenze FROM anon;
REVOKE ALL ON public.eventi_app FROM anon;
REVOKE ALL ON public.pagelle_voti FROM anon;
REVOKE ALL ON public.cacche_partita FROM anon;