Skip to content

feat: setup supabase_realtime_admin - #1852

Merged
leandrocp merged 28 commits into
mainfrom
lp-revoke-supabase_realtime_admin
Jun 8, 2026
Merged

feat: setup supabase_realtime_admin#1852
leandrocp merged 28 commits into
mainfrom
lp-revoke-supabase_realtime_admin

Conversation

@leandrocp

@leandrocp leandrocp commented May 7, 2026

Copy link
Copy Markdown
Member

Part of project Migrations v2.

The main change is connecting tenants using supabase_realtime_admin instead of supabase_admin. Related to https://github.com/orgs/supabase/discussions/34270

TLDR:

  • PG 14 is mostly supported running as superuser, see README.md
  • PG 15 up to 15.14.1.015 requires superuser due to a missing supautil grant on realtime.subscription
  • PG >= supabase/postgres:15.14.1.129 can connect and work as supabase_realtime_admin with REPLICATION and supautils managing policies.

The complexity of this PR is because we need to handle existing tenants running with supabase_admin and new projects that should start with supabase_realtime_admin, running from PG14 to 17. This is done mostly by executing the migration setup_supabase_realtime_admin.ex that is gated behind the feature flag use_supabase_realtime_admin (disabled by default).

Review

Start on ## Postgres compatibility in README.md as it sets the expectations and limitations, then schema_test.exs along with changes in tests.yml and integration_tests.yml that shows what is expected to work on each PG version.

Tasks

Closes REAL-25
Closes REAL-377
Closes REAL-527
Closes REAL-630
Closes REAL-778
Closes REAL-781
Closes REAL-816
Closes SEC-562

@coveralls

coveralls commented May 7, 2026

Copy link
Copy Markdown

Coverage Status

Coverage is 91.573%lp-revoke-supabase_realtime_admin into main. No base build found for main.

@leandrocp
leandrocp force-pushed the lp-revoke-supabase_realtime_admin branch from d3573fe to 2b98f96 Compare May 12, 2026 12:41
@leandrocp leandrocp changed the title fix: restrict realtime schema feat: setup supabase_realtime_admin May 12, 2026
@leandrocp
leandrocp force-pushed the lp-revoke-supabase_realtime_admin branch 3 times, most recently from 72e61c1 to c3a692e Compare May 12, 2026 15:11

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Previous function required grant usage because of ::regclass casting, see test "subscription works when role lacks usage permission".

@leandrocp
leandrocp force-pushed the lp-revoke-supabase_realtime_admin branch from c3a692e to 9353942 Compare May 12, 2026 15:39
Comment thread priv/repo/dev_seeds.exs
_ -> raise "Running Migrations failed"
end

Tenants.Migrations.run_migrations(tenant)

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems redundant so I removed it but not sure about this change.

Comment thread test/realtime/extensions/cdc_rls/cdc_rls_test.exs

@leandrocp leandrocp May 12, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

New test module to verify permissions, ie: restrict what must be restricted without breaking the system.

Comment thread test/support/containers.ex
@blacksmith-sh

This comment has been minimized.

@edgurgel edgurgel left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great tests on schema_test.exs

@blacksmith-sh

This comment has been minimized.

Comment thread lib/realtime/tenants/migrations.ex Outdated

case Postgrex.query(conn, query, []) do
{:ok, _} -> Logger.debug("Partition #{partition_name} created")
alter_owner = "ALTER TABLE realtime.#{partition_name} OWNER TO supabase_realtime_admin"

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh so we always need to change this?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes and also new objects created through migrations (sorry I forgot to mention this). The reason is because we can't switch to supabase_realtime_admin on all projects, really only supabase/postgres >= 15.14.1.018 will work.

@blacksmith-sh

This comment has been minimized.

@leandrocp
leandrocp merged commit a1e19f0 into main Jun 8, 2026
44 of 47 checks passed
@leandrocp
leandrocp deleted the lp-revoke-supabase_realtime_admin branch June 8, 2026 21:29
@realtime-release-bot

Copy link
Copy Markdown

🎉 This PR is included in version 2.105.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants