David/kanban-dev-webapp
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kanban-dev-webapp/pocketbase/pb_migrations
History
Dave 2a8d6f2505 fix(security): lock the users collection against privilege escalation 
The users collection kept PocketBase's defaults because the Plan 1a rules
migration covered eight collections and missed this one:

  createRule ""                      -> anyone could sign up
  updateRule "id = @request.auth.id"  -> anyone could edit their own record

`role` is an ordinary field here, so both were escalations. Verified
exploitable against the live instance: an anonymous request created an
account with role "owner", and a client manager promoted themselves to
owner by patching their own record. Either route yields read and write
access to every client's board.

Create, update and delete are now superuser-only; list and view are
owner-or-self. Adds four integration tests so a regression fails loudly.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-16 11:18:13 +02:00
..
1789600100_created_clients.js feat(schema): all collections + role-scoped API rules on remote PB 2026-09-16 09:41:20 +02:00
1789600200_created_projects.js feat(schema): all collections + role-scoped API rules on remote PB 2026-09-16 09:41:20 +02:00
1789600300_extended_users.js feat(schema): all collections + role-scoped API rules on remote PB 2026-09-16 09:41:20 +02:00
1789600400_created_columns.js feat(schema): all collections + role-scoped API rules on remote PB 2026-09-16 09:41:20 +02:00
1789600500_created_cards.js feat(schema): all collections + role-scoped API rules on remote PB 2026-09-16 09:41:20 +02:00
1789600600_created_subtasks_comments.js feat(schema): all collections + role-scoped API rules on remote PB 2026-09-16 09:41:20 +02:00
1789600700_created_activity.js feat(schema): all collections + role-scoped API rules on remote PB 2026-09-16 09:41:20 +02:00
1789600800_created_settings.js feat(schema): all collections + role-scoped API rules on remote PB 2026-09-16 09:41:20 +02:00
1789600900_applied_api_rules.js feat(schema): all collections + role-scoped API rules on remote PB 2026-09-16 09:41:20 +02:00
1789601000_locked_user_rules.js fix(security): lock the users collection against privilege escalation 2026-09-16 11:18:13 +02:00
README.md docs: Coolify-only setup, and mark pb_migrations as non-executing 2026-09-16 10:32:26 +02:00

README.md

These migrations never run

PocketBase applies files in pb_migrations/ when its own server starts. This project does not start a PocketBase server — it uses one hosted instance on Coolify, and the schema is applied to it over the admin API by scripts/setup-remote.ts.

So every file in this directory is reference only. Editing one changes nothing, anywhere.

To change the schema, edit scripts/setup-remote.ts and run npm run setup-remote.

These files are kept because they are the most readable statement of the schema and its reasoning, and because they are what you would mount into the container if this project ever moves to PocketBase's native migration flow. If you update setup-remote.ts, update these too — but understand that doing so is documentation, not deployment.