Skip to content

Add functions to ban users (and fixes) #37

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
oskarrough merged 4 commits into from
Jan 21, 2026
Merged

Add functions to ban users (and fixes) #37

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1d60779
add migration to ban user; also a fix fixes
4www Jan 19, 2026
f185016
Add broadcast policy for banned users
oskarrough Jan 21, 2026
3608cb9
Remove unused ban_reason arg
oskarrough Jan 21, 2026
5c4dcbf
Make sure delete_user() deletes account
oskarrough Jan 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
149 changes: 149 additions & 0 deletions supabase/migrations/20260119090943_ban_user_nuke_content.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,149 @@
-- Shadow banning and hard-delete moderation

create or replace function public.is_banned()
returns boolean
language sql
stable
as $$
-- Access tokens are stateless; this makes bans effective immediately via RLS.
select exists (
select 1
from auth.users
where id = auth.uid()
and banned_until > now()
);
$$;

create policy "Deny banned users" on public.accounts
as restrictive for all
to authenticated
using (not public.is_banned())
with check (not public.is_banned());

create policy "Deny banned users" on public.channels
as restrictive for all
to authenticated
using (not public.is_banned())
with check (not public.is_banned());

create policy "Deny banned users" on public.tracks
as restrictive for all
to authenticated
using (not public.is_banned())
with check (not public.is_banned());

create policy "Deny banned users" on public.user_channel
as restrictive for all
to authenticated
using (not public.is_banned())
with check (not public.is_banned());

create policy "Deny banned users" on public.channel_track
as restrictive for all
to authenticated
using (not public.is_banned())
with check (not public.is_banned());

create policy "Deny banned users" on public.followers
as restrictive for all
to authenticated
using (not public.is_banned())
with check (not public.is_banned());

create policy "Deny banned users" on public.broadcast
as restrictive for all
to authenticated
using (not public.is_banned())
with check (not public.is_banned());

create or replace function public.ban_user(
target_user_id uuid,
ban_until timestamp with time zone default now() + interval '4000 years'
)
returns void
language plpgsql
security definer
set search_path = public
as $$
begin
if auth.role() <> 'service_role' then
raise exception 'not authorized';
end if;

-- This disables new logins; RLS blocks existing sessions immediately.
update auth.users
set banned_until = ban_until
where id = target_user_id;

with target_channels as (
select uc.channel_id
from public.user_channel uc
where uc.user_id = target_user_id
),
tracks_to_delete as (
select distinct ct.track_id
from public.channel_track ct
where ct.channel_id in (select channel_id from target_channels)
)
delete from public.tracks
where id in (select track_id from tracks_to_delete);

with target_channels as (
select uc.channel_id
from public.user_channel uc
where uc.user_id = target_user_id
)
delete from public.channels
where id in (select channel_id from target_channels);

delete from public.user_channel where user_id = target_user_id;
end;
$$;

create or replace function public.ban_user_by_channel_slug(
channel_slug text,
ban_until timestamp with time zone default now() + interval '4000 years'
)
returns void
language plpgsql
security definer
set search_path = public
as $$
declare
target_user_id uuid;
user_count int;
begin
if auth.role() <> 'service_role' then
raise exception 'not authorized';
end if;

select count(distinct uc.user_id)
into user_count
from public.channels c
join public.user_channel uc on uc.channel_id = c.id
where c.slug = channel_slug;

if user_count is null or user_count = 0 then
raise exception 'no owner found for channel slug %', channel_slug;
end if;

if user_count > 1 then
raise exception 'multiple owners found for channel slug %', channel_slug;
end if;

select uc.user_id
into target_user_id
from public.channels c
join public.user_channel uc on uc.channel_id = c.id
where c.slug = channel_slug
limit 1;

perform public.ban_user(target_user_id, ban_until);
end;
$$;

revoke execute on function public.ban_user(uuid, timestamp with time zone)
from anon, public, authenticated;

revoke execute on function public.ban_user_by_channel_slug(text, timestamp with time zone)
from anon, public, authenticated;
4 changes: 4 additions & 0 deletions supabase/migrations/20260119102953_prevent_track_reuse.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
-- Ensure a track can belong to only one channel.

alter table public.channel_track
add constraint channel_track_track_id_unique unique (track_id);
Comment thread
oskarrough marked this conversation as resolved.
33 changes: 33 additions & 0 deletions supabase/migrations/20260119105952_fix_delete_user_search_path.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
-- Harden delete_user() by pinning search_path.

create or replace function public.delete_user()
returns void
language sql
security definer
set search_path = public
as $$
with target_channels as (
select channel_id
from public.user_channel
where user_id = auth.uid()
),
tracks_to_delete as (
select distinct ct.track_id
from public.channel_track ct
where ct.channel_id in (select channel_id from target_channels)
)
delete from public.tracks
where id in (select track_id from tracks_to_delete);

with target_channels as (
select channel_id
from public.user_channel
where user_id = auth.uid()
)
delete from public.channels
where id in (select channel_id from target_channels);

delete from public.user_channel where user_id = auth.uid();
delete from public.accounts where id = auth.uid();
delete from auth.users where id = auth.uid();
$$;

@oskarrough oskarrough Jan 19, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We had three different delete_user supabase functions already. I don't really know which is the good one, but probably good idea to review them again :) The third version also tried to do the search path stuff.

first

CREATE or replace function delete_user()
	returns void
LANGUAGE SQL SECURITY DEFINER
AS $$
	-- delete from channels where user_id = auth.uid();
	delete from user_channel where user_id = auth.uid();
	delete from auth.users where id = auth.uid();
$$;

second

-- Overwrite the existing function with new functionality.
-- The two last lines ensure that any orphaned channels and tracks are also deleted.
CREATE or replace function delete_user()
	returns void
LANGUAGE SQL SECURITY DEFINER
AS $$
	-- Delete user's associations with channels
	delete from user_channel where user_id = auth.uid();

	-- Delete account and user
	delete from accounts where id = auth.uid();
	delete from auth.users where id = auth.uid();

	-- Delete any orphaned channels
	delete from channels where id not in (select channel_id from user_channel);

	-- Delete any orphaned tracks
	delete from tracks where id not in (select track_id from channel_track);
$$;

third version

-- Fix for mutable search path
CREATE or replace function delete_user()
	returns void
LANGUAGE SQL SECURITY DEFINER
SET search_path TO 'pg_catalog', 'public' -- Explicit search path for security
AS $$
	-- Delete user's associations with channels
	delete from user_channel where user_id = auth.uid();

	-- Delete account and user
	delete from accounts where id = auth.uid();
	delete from auth.users where id = auth.uid();

	-- Delete any orphaned channels
	delete from channels where id not in (select channel_id from user_channel);

	-- Delete any orphaned tracks
	delete from tracks where id not in (select track_id from channel_track);
$$;

fourth

(the one in this PR)