chore(db): drop unused global RBAC flag

[riderx]

Summary (AI generated)

• Drop public.is_rbac_enabled_globally() and delete the CAPGO_RBAC_ENABLED Vault secret
• Stop seeding the unused flag locally
• Remove generated RPC types and leftover capgo.rbac_enabled test GUC setup
• Assert the function stays deleted in pgTAP and execute-hardening tests

Motivation (AI generated)

RBAC is already always on. The global flag was unused: no checkers, RLS policies, or app code called it. It only added a Vault lookup helper and dead test config.

Business Impact (AI generated)

Removes a dormant kill switch that could have been mistaken for a real RBAC control. Authorization stays RBAC-only with one less secret and function to operate.

Test Plan (AI generated)

• bunx supabase migration up (or bun run supabase:db:reset) applies remove_rbac_global_flag
• SELECT public.is_rbac_enabled_globally(); fails with undefined function
• SELECT name FROM vault.secrets WHERE name = 'CAPGO_RBAC_ENABLED'; returns no rows
• bun run supabase:with-env -- bunx vitest run tests/security-definer-execute-hardening.test.ts tests/rbac-permissions.test.ts
• pgTAP 26_test_rls_policies.sql still passes, including the deleted-helpers assertion

Generated with AI

Made with Cursor

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Bug Fixes

  • Removed the obsolete global RBAC feature flag and its associated database function.
  • Stopped initializing the retired RBAC secret during database setup.

• Tests

  • Updated security and database validation checks to confirm the legacy RBAC helper is absent.
  • Simplified RBAC permission testing to validate permissions directly through the RBAC system.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 051de40e-af00-40da-b39f-8a0ff66aa20a

📥 Commits

Reviewing files that changed from the base of the PR and between 7975039 and 7e04b7c.

📒 Files selected for processing (9)

• cli/src/types/supabase.types.ts
• src/types/supabase.types.ts
• supabase/functions/_backend/plugin_runtime/utils/supabase.types.ts
• supabase/functions/_backend/utils/supabase.types.ts
• supabase/migrations/20260820090539_remove_rbac_global_flag.sql
• supabase/seed.sql
• supabase/tests/26_test_rls_policies.sql
• tests/rbac-permissions.test.ts
• tests/security-definer-execute-hardening.test.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• Cap-go/capacitor-updater (manual)

💤 Files with no reviewable changes (5)

• cli/src/types/supabase.types.ts
• src/types/supabase.types.ts
• supabase/functions/_backend/plugin_runtime/utils/supabase.types.ts
• supabase/seed.sql
• supabase/functions/_backend/utils/supabase.types.ts

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

---

📝 Walkthrough

Walkthrough

The change removes the global RBAC function and Vault flag, updates generated database types, and adjusts seed data and tests to verify the removal.

Changes

Global RBAC flag removal

Layer / File(s)	Summary
Remove the database function and secret supabase/migrations/..., supabase/seed.sql	The migration drops public.is_rbac_enabled_globally() and deletes CAPGO_RBAC_ENABLED. Seed data no longer creates the secret.
Update types and validation cli/src/types/supabase.types.ts, supabase/functions/_backend/..., supabase/tests/26_test_rls_policies.sql, tests/*	Generated types remove the function declaration. Tests verify that the function is absent and no longer toggle the global RBAC flag.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: 🔵 Low · up to 7e04b

This PR removes an unused RBAC database function and related configuration. It is mergeable with owner confirmation that no clients or exposed RPC contract depend on the function; otherwise consumers could lose compatibility unexpectedly.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: removing the unused global RBAC flag from the database.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

Warning

Review ran into problems

🔥 Problems

Repository analysis: Couldn't refresh Cap-go/capgo.app clone - clone failed: Clone operation failed: Stream initialization permanently failed: 14 UNAVAILABLE: read ECONNRESET

---

_{Comment @coderabbitai help to get the list of available commands.}

[codspeed-hq]

Merging this PR will not alter performance

✅ 43 untouched benchmarks
⏩ 2 skipped benchmarks¹

---

_{Comparing chore/remove-rbac-global-flag (7e04b7c) with main (7975039)}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[cubic-dev-ai]

No issues found across 9 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}