[rickypid]

What does it do?

Third release candidate of 2.0.0 (2.0.0-rc.3): fixes the findings of a security audit of the package, adds the GitHub Actions pipeline and cleans up template leftovers in the docs.

Security fixes (SQL scripts, Edge Function, Dart client, example app):

• The media cleanup queue only accepts a chats_assets object in the deleted message's own room folder, not referenced by another message; cleanup-media re-checks every row, retries failing objects and leaves aside the ones that keep failing. Before, a message source could make the function delete any Storage object of the project with the service role.
• httpSupabaseHeadersFor(url) sends the access token to this project's Storage only; httpSupabaseHeaders (sent to any URL, including avatars and message sources other users choose) is deprecated. Example and docs updated.
• Column privileges on rooms, room_members, users; role changes for real group admins only. A direct-room member could add third parties to a 1-to-1 conversation.
• Unique message ids (chats.message_ids), RPCs bound to the row they authorized, server-assigned createdAt (a far-future value blocked partition maintenance), server-owned status/reactions/pin, edit = content only, forward origin attested by the database.
• Realtime: only the database sends on chats:room:<id> (members could forge message events), typing on chats:room:<id>:typing, room/membership changes on a private chats:user:<uid> channel instead of Postgres Changes (DELETE events leaked memberships), private presence, removed members disconnected.
• chats_assets objects are overwritten by their uploader, deleted by their uploader or a group admin.
• The partman-run-maintenance cron job always failed (shared transaction block): split in two jobs, plus an event trigger securing new partitions.
• Example app: sanitized download names, confirmation before opening (documents and media only).

CI: format/analyze/unit tests/pana on Flutter 3.35.0 (the minimum, package only) and stable, pgTAP + integration tests on a local Supabase stack, docs build; Pages via actions/deploy-pages; publish to pub.dev on v* tags behind the pub.dev environment approval; Dependabot.

SDK: minimum raised to Dart 3.9 / Flutter 3.35 (supabase_flutter >= 2.16 requires it); the example app requires Dart 3.11 (file_saver 0.4).

Docs: Realtime, security, usage and triggers guides, MIGRATION.md section for release candidate users, Docusaurus/CONTRIBUTING/issue template placeholders fixed, LICENSE copyright line for InsideApp.

Why is it needed?

The audit found two high-severity issues (arbitrary Storage deletion through cleanup-media, session token sent to attacker-chosen URLs) and several medium/low ones; they must be fixed before 2.0.0.

How to test it?

supabase start
bash tool/local_db.sh
supabase test db                          # 95 pgTAP tests (28 new regression tests)
bash tool/test_integration.sh --no-reset  # 29 integration tests (2 new)
flutter test --exclude-tags integration   # 36 unit tests

All of them pass locally; the v1 → v2 migration (V1_REF=v1.6.2 tool/v1_fixture.sh && tool/local_db.sh --no-reset) and tool/test_storage_migration.sh pass too.

Upgrade note: the database and the Realtime protocol change together: re-run the SQL scripts and update the package at the same time (see MIGRATION.md).

Repository settings needed after merge:

• Settings > Pages > Source: "GitHub Actions".
• Settings > Environments: create pub.dev with required reviewers.
• pub.dev > Admin > Automated publishing: enable GitHub Actions for this repository, tag pattern v{{version}}, environment pub.dev.

Related issues/PRs

Follows #41 (2.0.0-rc.2).

🤖 Generated with Claude Code