Skip to content

urBackend v0.4.0 — RLS Rollout & Auth Hardening

Choose a tag to compare

View all tags
@yash-pouranik yash-pouranik released this 29 Mar 10:02
· 1070 commits to main since this release
v0.4.0
ded19c3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.4.0

Highlights

  • ✅ Row Level Security (RLS) for collection writes (owner-write-only)
  • ✅ Publishable-key write guardrails (pk_live writes require RLS + user JWT)
  • ✅ Automatic owner injection on create when owner field is missing
  • ✅ users collection protection on generic data API (/api/data/users* blocked)
  • ✅ Auth schema validation hardening for users (email + password required string fields)

Security Improvements

  • Added robust owner mismatch blocking for write operations
  • Added schema key normalization hardening (including hidden/BOM character edge cases)
  • Added safer users schema sanitation for mongoose subdocuments
  • Prevented public generic access to users via data routes

Dashboard & UX Improvements

  • RLS controls moved to cleaner modal/dialog flow
  • Better owner field guidance in UI
  • Users schema setup UX improved with auth-focused preset path
  • Reduced false-positive warnings in auth setup flow

Documentation Updates

  • Updated docs for pk_live behavior under RLS
  • Clarified users should be managed via /api/userAuth/*
  • Added quick RLS verification/testing guidance

Validation Summary

  • Build passed
  • Web dashboard lint passed
  • Public API test suite passed (including RLS write authorization coverage)

Breaking / Behavioral Notes

  • pk_live write behavior is now policy-driven and stricter by default.
  • User-management requests should use /api/userAuth/*; direct /api/data/users* is intentionally blocked.
Assets 2
Loading