fix(cli): unblock app add RLS failures with pending onboarding apps by riderx · Pull Request #2737 · Cap-go/capgo.app

riderx · 2026-07-23T12:09:20Z

Summary (AI generated)

CLI app add / init creates apps through authorized POST /app (same path as the web console) instead of a direct PostgREST insert that hits RLS.
App icon upload is best-effort: storage failures no longer abort app creation.
Fixed images storage INSERT/UPDATE policies that compared against apps.name instead of the storage object path, and allow org.create_app for icon upserts on missing/pending-onboarding apps.
Pending onboarding completion via PUT /app/:id works for API keys with org.create_app even without app.update_settings, and the update reuses the advisory-lock Postgres session.
CLI app create/complete honors --supa-host / --supa-anon (and local self-host config) via shared resolveCapgoPublicApiHost.
Added backend + pgTAP coverage for the pending-onboarding create path.

Motivation (AI generated)

New signups that leave a pending web-onboarding app could not register a real app ID through the CLI: create failed with a row-level security error (HTTP 400). The CLI was writing through PostgREST under RLS while the web path used the service-backed API, and the images storage policy also blocked icon upserts for create-only keys.

Business Impact (AI generated)

Unblocks new-customer onboarding and CLI setup for orgs that already have a pending web-onboarding app, reducing support load and failed trials.

Test Plan (AI generated)

bun test:db / backend pgTAP includes images storage policy checks
Integration coverage for pending onboarding + create path
CI: backend, CLI, Cloudflare Workers, Playwright green
Manual: CLI app add with API key after pending web onboarding
Manual: CLI with --supa-host / --supa-anon targets {host}/functions/v1

Generated with AI

Summary by CodeRabbit

New Features
- App creation and onboarding reuse now go through the Capgo API for more consistent onboarding behavior.
- Initialization can safely complete pending onboarding apps when leftovers exist.
- Organization update requests now use the same Capgo API host resolution as other CLI actions.
Bug Fixes
- Improved onboarding completion authorization and safe completion handling.
- Storage image access now uses corrected path/RLS rules and better coverage in limited environments.
Tests
- Added integration coverage for creating and completing leftover pending onboarding apps.

Route CLI app create through the authorized /app API (same path as web), make icon upload best-effort, fix images storage INSERT/UPDATE RLS for app-icon create, and allow org.create_app keys to complete pending onboarding apps. Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

codspeed-hq · 2026-07-23T12:11:39Z

Merging this PR will not alter performance

✅ 43 untouched benchmarks
⏩ 2 skipped benchmarks¹

_{Comparing cursor/fix-app-add-rls-5c96 (09b50bb) with main (5955c70)}

2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

coderabbitai · 2026-07-23T12:14:26Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

The CLI now creates apps and completes onboarding through Capgo app APIs. Backend endpoints support restricted onboarding completion, storage RLS policies cover pending apps, and tests validate the updated flows. A queue cleanup migration now tolerates missing metadata tables.

Changes

App onboarding flow

Layer / File(s)	Summary
App API contracts and CLI integration `cli/src/api/app.ts`, `cli/src/app/add.ts`, `cli/src/init/command.ts`, `cli/src/organization/set.ts`, `cli/src/utils.ts`, `supabase/functions/_backend/public/app/post.ts`	CLI app creation and onboarding completion use HTTP APIs with API-key authentication, resolved hosts, formatted errors, and explicit onboarding-origin metadata.
Restricted onboarding completion `supabase/functions/_backend/public/app/put.ts`, `tests/app-create-pending-onboarding.test.ts`	The PUT endpoint authorizes and serializes pending-onboarding completion separately from settings updates, performs the database transition, releases locks, and preserves completion side effects; integration coverage validates POST and PUT behavior.
Icon storage authorization and validation `supabase/migrations/20260723120547_fix_app_create_storage_rls.sql`, `supabase/tests/62_test_images_storage_insert_policy.sql`	Images bucket INSERT and UPDATE policies cover app, logo, pending-onboarding, and user-owned paths, with SQL assertions checking path references and required permissions.

Queue migration compatibility

Layer / File(s)	Summary
Conditional queue metadata cleanup `supabase/migrations/20260723113511_cleanup_queue_skip_missing_tables.sql`	The migration documents skipping `pgmq.meta` cleanup when the metadata table is absent.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CLI
  participant AppAPI
  participant Postgres
  CLI->>AppAPI: POST /app with app metadata
  AppAPI->>Postgres: Insert app
  Postgres-->>AppAPI: Return app_id
  AppAPI-->>CLI: Return creation response
  CLI->>AppAPI: PUT /app/{appId} with need_onboarding=false
  AppAPI->>Postgres: Authorize and update pending app
  Postgres-->>AppAPI: Return completion state
  AppAPI-->>CLI: Return updated app

Suggested labels: codex

Suggested reviewers: wcaleniewolny, dalanir

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description covers summary, motivation, impact, and test plan, but it omits the required Checklist section from the template.	Add the Checklist section from the template and mark each applicable item, plus note any docs or manual-testing status.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: fixing CLI app-add RLS failures for pending onboarding apps.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{Comment @coderabbitai help to get the list of available commands.}

Narrow the images INSERT policy pgTAP assertion, skip Cloudflare for the pending-onboarding edge path, and guard pgmq.meta cleanup when the table is absent in Tinbase/PGlite. Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

Avoid false negatives from Postgres policy formatting and false positives from matching unrelated apps.* columns next to foldername(name). Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

Inside EXISTS subqueries over public.apps, bare name bound to apps.name so foldername(name) compared the app display name instead of the storage object path. Use objects.name explicitly. Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

cursor · 2026-07-23T13:06:12Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_5edb83d6-925c-4cb6-bef0-b95c20b216c7)

cursor

Stale comment

Risk: medium. Cursor Bugbot did not complete (check skipped due to usage limit), so automated review is incomplete. Human review is needed for the RLS migration and CLI app-add changes; no approval from this agent.

_{Sent by Cursor Approval Agent: Pull Request Approver}

cursor

Stale comment

Risk: medium. Cursor Bugbot skipped (usage limit reached), so there is no clean automated review signal for this PR. Human review is needed for the RLS migration and app create/update path changes; assigned WcaleNieWolny and Dalanir.

_{Sent by Cursor Approval Agent: Pull Request Approver External}

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cli/src/api/app.ts`:
- Around line 114-116: Update the onboarding failure handling in the app API
flow to reuse the existing formatAppCreateError logic from app/add.ts,
extracting server-side details from FunctionsHttpError.context instead of
relying only on error.message. Preserve the appId context in the thrown error
while ensuring backend codes such as cannot_access_app are surfaced.

In `@supabase/migrations/20260723120547_fix_app_create_storage_rls.sql`:
- Around line 22-52: Update the INSERT policy permission logic to allow
org.create_app when the referenced app exists in a pending-onboarding state, not
only when no app row exists. Preserve app.update_settings for existing
non-pending apps, and apply the same pending-app condition to the existing-app
lookup in the policy.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: d1c7a6e6-0b38-46ac-90b4-fe82df8582c3

📥 Commits

Reviewing files that changed from the base of the PR and between e9b7256 and 13995ea.

📒 Files selected for processing (8)

cli/src/api/app.ts
cli/src/app/add.ts
supabase/functions/_backend/public/app/post.ts
supabase/functions/_backend/public/app/put.ts
supabase/migrations/20260723113511_cleanup_queue_skip_missing_tables.sql
supabase/migrations/20260723120547_fix_app_create_storage_rls.sql
supabase/tests/62_test_images_storage_insert_policy.sql
tests/app-create-pending-onboarding.test.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

Cap-go/capacitor-updater (manual)

Surface FunctionsHttpError details when completing pending onboarding, and allow org.create_app for images INSERT when the app is pending onboarding (icon upload after app row create). Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

cursor · 2026-07-23T13:15:18Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_54e342ab-4954-4bdd-bb0a-1caf918c41fb)

cursor

Stale comment

Risk: medium. Cursor Bugbot skipped (usage limit reached), so automated review is incomplete. Human review is needed for the RLS migration and app create/update path changes; reviewers are already assigned.

_{Sent by Cursor Approval Agent: Pull Request Approver}

cursor

Stale comment

Risk: medium. Cursor Bugbot skipped (usage limit reached), so there is no clean automated review signal for this RLS migration and app create/update changes. Human review is still needed; reviewers are already assigned.

_{Sent by Cursor Approval Agent: Pull Request Approver External}

cursor

Stale comment

Risk: medium. Cursor Bugbot skipped (usage limit reached), so automated review did not complete. Human review is still needed for the RLS migration and app onboarding changes; reviewers are already assigned.

_{Sent by Cursor Approval Agent: Pull Request Approver External}

cursor

Stale comment

Risk: medium. Cursor Bugbot skipped (usage limit reached), so automated review did not complete and I am not approving. Human review is still needed for the RLS migration and app onboarding changes; reviewers are already assigned.

_{Sent by Cursor Approval Agent: Pull Request Approver}

cubic-dev-ai

All reported issues were addressed

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

cubic-dev-ai

No issues found across 10 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Re-trigger cubic}

Main commit 404fb50 accidentally deleted the submodule pointer while editing an unrelated script, which broke Builder onboarding TUI preview checkout (private/cli-mcp-tests missing). Restore the previous gitlink. Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

cursor · 2026-07-25T08:25:49Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_69008c55-88eb-48c7-aec0-e5cedd15d6a0)

cursor

Stale comment

Risk: medium. Cursor Bugbot skipped (usage limit reached), so automated review did not complete and I am not approving. Human review is still needed for the RLS migration and app onboarding changes; reviewers are already assigned.

_{Sent by Cursor Approval Agent: Pull Request Approver External}

cursor

Stale comment

Risk: medium. Cursor Bugbot skipped (usage limit reached), so automated review did not complete and I am not approving. Human review is still needed for the RLS migration and app onboarding changes; reviewers are already assigned.

_{Sent by Cursor Approval Agent: Pull Request Approver}

Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

cursor · 2026-07-25T08:26:31Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_dacdebb6-f1d9-434e-9adf-e5e8b7960fae)

cursor · 2026-07-25T08:26:37Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_92ec98a7-633b-4166-93b9-199fe7fd13e7)

cursor

Risk: medium. Cursor Bugbot skipped (usage limit reached), so automated review did not complete and I am not approving. Human review is still needed for the RLS migration and app onboarding changes; reviewers are already assigned.

_{Sent by Cursor Approval Agent: Pull Request Approver}

cursor

Risk: medium. Cursor Bugbot skipped (usage limit reached), so automated review did not complete and I am not approving. Human review is still needed for the RLS migration and app onboarding changes; reviewers are already assigned.

_{Sent by Cursor Approval Agent: Pull Request Approver External}

sonarqubecloud · 2026-07-25T08:33:35Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

riderx temporarily deployed to deepsec-pr July 23, 2026 12:09 — with GitHub Actions Inactive

cursor Bot temporarily deployed to deepsec-pr July 23, 2026 12:20 Inactive

fix(test): correct images insert policy pgTAP assertion

dac18ab

Avoid false negatives from Postgres policy formatting and false positives from matching unrelated apps.* columns next to foldername(name). Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

cursor Bot had a problem deploying to deepsec-pr July 23, 2026 12:27 Error

fix(test): match quoted apps.app_id in images policy pgTAP

a91956d

Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

cursor Bot temporarily deployed to deepsec-pr July 23, 2026 12:27 Inactive

fix(test): diagnose images insert storage policy pgTAP mismatch

f66d5f0

Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

cursor Bot temporarily deployed to deepsec-pr July 23, 2026 12:35 Inactive

cursor Bot temporarily deployed to deepsec-pr July 23, 2026 12:49 Inactive

chore(ci): retrigger backend tests after port bind flake

13995ea

Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

cursor Bot temporarily deployed to deepsec-pr July 23, 2026 12:57 Inactive

cursor Bot marked this pull request as ready for review July 23, 2026 13:06

cursor Bot reviewed Jul 23, 2026

View reviewed changes

cursor Bot requested review from Dalanir, Pitiakova and WcaleNieWolny July 23, 2026 13:06

cursor Bot reviewed Jul 23, 2026

View reviewed changes

coderabbitai Bot added the codex label Jul 23, 2026

coderabbitai Bot requested changes Jul 23, 2026

View reviewed changes

Comment thread cli/src/api/app.ts Outdated

Comment thread supabase/migrations/20260723120547_fix_app_create_storage_rls.sql

cursor Bot temporarily deployed to deepsec-pr July 23, 2026 13:15 Inactive

cursor Bot reviewed Jul 23, 2026

View reviewed changes

cursor Bot reviewed Jul 24, 2026

View reviewed changes

cubic-dev-ai Bot reviewed Jul 24, 2026

View reviewed changes

Comment thread supabase/migrations/20260723120547_fix_app_create_storage_rls.sql

cubic-dev-ai Bot reviewed Jul 24, 2026

View reviewed changes

cursor Bot marked this pull request as draft July 25, 2026 08:10

cursor Bot temporarily deployed to deepsec-pr July 25, 2026 08:10 Inactive

chore(ci): retrigger tests after flaky Cloudflare shard failure

356a414

Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

cursor Bot temporarily deployed to deepsec-pr July 25, 2026 08:18 Inactive

cursor Bot marked this pull request as ready for review July 25, 2026 08:25

cursor Bot reviewed Jul 25, 2026

View reviewed changes

fix(db): limit org.create_app image RLS to icon path

f26bdde

Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

cursor Bot had a problem deploying to deepsec-pr July 25, 2026 08:26 Error

test(db): assert icon-only org.create_app image update policy

09b50bb

Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

cursor Bot temporarily deployed to deepsec-pr July 25, 2026 08:26 Inactive

cursor Bot reviewed Jul 25, 2026

View reviewed changes

riderx merged commit 084a30a into main Jul 25, 2026
56 of 76 checks passed

riderx deleted the cursor/fix-app-add-rls-5c96 branch July 25, 2026 11:16

This was referenced Jul 27, 2026

refactor(types): tighten common any/unknown usages with shared helpers #2766

Merged

refactor(api): migrate functions.invoke to Cloudflare API #2785

Merged

This was referenced Aug 7, 2026

fix(cli): recover missing onboarding package managers #2916

Merged

feat(cli): track CLI version headers and admin usage analytics #2906

Merged

fix(cli): make CLI usage analytics PR pass CI #2945

Closed

coderabbitai Bot mentioned this pull request Aug 15, 2026

feat(cli): add browser-assisted init login #3068

Merged

Uh oh!

Uh oh!

Conversation

riderx commented Jul 23, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary (AI generated)

Motivation (AI generated)

Business Impact (AI generated)

Test Plan (AI generated)

Summary by CodeRabbit

Uh oh!

codspeed-hq Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

coderabbitai Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

cursor Bot commented Jul 23, 2026

Bugbot couldn't run - usage limit reached

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cursor Bot commented Jul 23, 2026

Bugbot couldn't run - usage limit reached

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot commented Jul 25, 2026

Bugbot couldn't run - usage limit reached

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot commented Jul 25, 2026

Bugbot couldn't run - usage limit reached

riderx commented Jul 23, 2026 •

edited by coderabbitai Bot

Loading

codspeed-hq Bot commented Jul 23, 2026 •

edited

Loading

coderabbitai Bot commented Jul 23, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading