Close the anonymous write path into client_error_log

[YurMil]

The problem

client_error_log granted INSERT to anon so the browser could post its own crashes (migration). What made that look bounded — a ten-per-page-load cap and dedupe by message — lives in src/lib/errorReporting.ts, on the reporting side of the network. The anon key ships inside the JS bundle, so anything could POST straight to PostgREST and write unbounded rows of nearly 8 KB each; the client-side caps would never see the traffic.

The change

Reports go through a new report-client-error Edge Function, which runs under the service role and calls record_client_error(). anon and authenticated lose INSERT entirely.

The quota lives in the database, not the function. The slot is claimed by the same statement that increments it, so two concurrent reports cannot both read a stale count, and the limit survives a function redeploy.

Two limits, not one. 30 reports per address per hour, and 2000 rows per hour across the whole table. The second is not symmetry: the address header can be forged, which spreads a flood across quota buckets, and the global ceiling does not depend on that value.

The quota table is separate from the log on purpose. client_error_log stores no identity and that stays true — the quota holds only a salted SHA-256 of the address, nothing keys the two tables together, and rows are pruned once their window is spent.

Also: the user agent now comes from the request headers rather than the request body, and the function answers identically whether a report was stored, throttled or malformed, so the limit cannot be calibrated against.

Verification

Both migrations applied to a throwaway Postgres 17:

• migration is idempotent (re-applied cleanly);
• anon retains neither table-level nor column-level INSERT, and no INSERT policy remains;
• EXECUTE on record_client_error is granted to service_role only;
• 35 reports from one address store exactly 30 and drop 5; a second address is unaffected;
• an expired window resets the counter to 1 and the next report is accepted;
• with 2000 rows in the last hour, a report from a fresh address is refused;
• fields truncate to the column limits; an empty source falls back to /; empty optional fields store NULL;
• a malformed hash and a blank message are both rejected.

pnpm typecheck, eslint on the changed file, and a six-locale pnpm build all pass.

Deploy order

Matters here, or reports are silently dropped in the gap:

1. supabase functions deploy report-client-error
2. deploy the site
3. apply the migration

Optional: set an ERROR_LOG_IP_SALT secret. Without it the salt falls back to the service role key, so forgetting it is not a weakness.

Not included

client_error_log still has no retention policy — the flood is bounded now, but the table grows without limit under normal traffic. Automatic deletion of stored data is a decision worth making on its own rather than attaching it to a security fix.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cadautoscript-com	Ready	Preview	Aug 16, 2026 10:19am

[supabase]

Updates to Preview Branch (security/client-error-log-edge-function) ↗︎

Deployments	Status	Updated
Database	✅	Sun, 16 Aug 2026 10:13:14 UTC
Services	✅	Sun, 16 Aug 2026 10:13:14 UTC
APIs	✅	Sun, 16 Aug 2026 10:13:14 UTC

Tasks are run on every commit but only new migration files are pushed.
Close and reopen this PR if you want to apply changes from existing seed or migration files.

Tasks	Status	Updated
Configurations	✅	Sun, 16 Aug 2026 10:13:21 UTC
Migrations	❌	Sun, 16 Aug 2026 10:13:25 UTC
Seeding	⏸️	Sun, 16 Aug 2026 10:12:58 UTC
Edge Functions	⏸️	Sun, 16 Aug 2026 10:12:58 UTC

---

❌ Branch Error • Sun, 16 Aug 2026 10:13:26 UTC

ERROR: function public.is_admin() does not exist (SQLSTATE 42883)
At statement: 5
create policy "Admins can read audit log"
  on public.admin_audit_log
  for select
  to authenticated
  using (public.is_admin())

---

View logs for this Workflow Run ↗︎.
Learn more about Supabase for Git ↗︎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ece1f104a7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".