fix(db): restore anon get_user_id for published CLI without oracle leak

[riderx]

Fixes #3197

Summary (AI generated)

• GRANT EXECUTE ON FUNCTION public.get_user_id(text) TO anon so published CLI 8.42.x can call rpc/get_user_id again.
• Leaves get_user_id(text, text), get_org_perm_for_apikey, get_org_perm_for_apikey_v2, and invite_user_to_org_rbac revoked for anon.
• Updates security/oracle/RBAC tests: anon may call get_user_id(text); org-perm/invite/two-arg overload stay denied.

Motivation (AI generated)

PR #3189 revoked anonymous execute on get_user_id, breaking channel add and bundle upload for published CLI releases that still call .rpc('get_user_id', { apikey }). Main-branch CLI already uses request_actor_user_id, but that is not in a released cli-* tag yet.

Business Impact (AI generated)

Unblocks API-key CLI channel creation and bundle upload for customers on 8.42.x without reopening the org-perm/invite oracle RPCs.

Test Plan (AI generated)

• get_user_id(text) succeeds for anon with a valid API key (published CLI pattern)
• get_user_id(text, text) remains permission denied for anon
• get_org_perm_for_apikey / v2 remain permission denied for anon
• invite_user_to_org_rbac remains permission denied for anon
• CI green

Generated with AI

  

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{On-demand reviews are free for the next 26 days. After that, they cost $0.25 per reviewed file.}

Or wait 37 seconds for your next included review.

View limit details

Limit details: You’ve used the included review currently available. Your 62 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: bb76300c-8b29-46ce-a34a-76fa5d72d043

📥 Commits

Reviewing files that changed from the base of the PR and between dc57849 and cefa2bc.

📒 Files selected for processing (4)

• supabase/migrations/20260825105544_restore_get_user_id_anon_cli_compat.sql
• tests/rbac-apikey-request-identity-rpc.test.ts
• tests/security-definer-execute-hardening.test.ts
• tests/security-oracle-rpc-hardening.test.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[codspeed]

Merging this PR will not alter performance

✅ 43 untouched benchmarks
⏩ 2 skipped benchmarks¹

---

_{Comparing cursor/fix-get-user-id-anon-compat-c09a (cefa2bc) with main (dc57849)}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud