fix(supabase): address database security advisor warnings

[chiptus]

Fixes mutable search_path on 6 functions, tightens always-true RLS policies on artist_music_genres, dedupes a redundant public-listing storage policy on festival-assets, and revokes unnecessary SECURITY DEFINER execute grants (bootstrap_super_admin, check_username_exists, duplicate_set_with_votes for anon).

Verification

• Review the migration SQL for correctness against current function/policy signatures.
• After applying: core team can still create/edit/delete artist music genres; other authenticated users cannot.
• Festival assets still load via their public URLs (single remaining SELECT policy).
• bootstrap_super_admin and check_username_exists RPCs are no longer callable by anon/authenticated clients.
• Run supabase db advisors (or MCP get_advisors) after deploy to confirm the warnings are cleared.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
upline	Ready	Preview	Aug 14, 2026 2:06pm

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[github-actions]

Deploy → staging — workflow run
Last updated: 2026-08-14 14:06:35 UTC

• ❌ DB migrations failed
• ⏭️ Edge functions skipped (no changes)

⚠️ Migration failed on staging. This often means migration history drift — another PR applied migrations that aren't in this branch. To recover, you may need to reset and re-seed staging:

supabase link --project-ref <STAGING_PROJECT_REF>
supabase db reset --linked    # wipes staging data
pnpm run db:sync:staging      # re-sync anonymized prod data

Then re-run this workflow.

[chiptus]

The migrate / Push migrations (staging) failure isn't caused by this PR's diff — it's pre-existing staging migration drift. The linker reports remote migration versions 20260814140000 and 20260814150000 applied on staging that don't exist in this repo's git history at all (not on main, not on any branch). This PR only adds 20260814120000_fix_security_advisor_warnings.sql.

Resolving the drift (repairing migration history / resetting+reseeding staging) needs someone with access to the staging project and is out of scope for this PR — flagging for a human to handle via supabase migration repair or the reset+reseed steps the bot suggested.

---

Generated by Claude Code

[Copilot]

Pull request overview

This PR introduces a Supabase migration aimed at clearing database security advisor warnings by hardening function execution contexts, tightening RLS mutation rules, and reducing overly-broad permissions in storage/function execution.

Changes:

• Pins search_path on several functions previously lacking an immutable search_path.
• Replaces always-true artist_music_genres mutation RLS policies with can_edit_artists(auth.uid()) gating.
• Removes a redundant public SELECT policy on storage.objects for the festival-assets bucket and revokes EXECUTE on certain SECURITY DEFINER functions.

Suppressed comments (1)

supabase/migrations/20260814120000_fix_security_advisor_warnings.sql:121

• Revoking EXECUTE from anon, authenticated does not prevent access if the function still has the default EXECUTE privilege granted to PUBLIC (which both roles inherit). To fully remove direct client access, revoke from PUBLIC as well.

REVOKE EXECUTE ON FUNCTION public.check_username_exists(text, uuid) FROM anon, authenticated;

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Playwright test results

 50 passed

Details

 50 tests across 14 suites
 1 minute, 8 seconds
 5607d57