fix: env to control tenant config visibility by fenos · Pull Request #989 · supabase/storage

fenos · 2026-04-07T08:30:20Z

What kind of change does this PR introduce?

Improvement

What is the current behavior?

tenant sensitive information are always returned from admin endpoints

What is the new behavior?

New environment variable to toggle returning tenant sensitive information

Copilot

Pull request overview

Adds a configuration toggle to control whether admin tenant endpoints return decrypted, sensitive tenant configuration values.

Changes:

Introduces ADMIN_RETURN_TENANT_SENSITIVE_DATA config flag (defaulting to enabled unless explicitly set to false).
Gates sensitive fields (anonKey, DB URLs, jwtSecret, jwks, serviceKey) in admin GET /tenants and GET /tenants/:tenantId responses behind the new flag.
Documents the new environment variable in .env.sample.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
`src/http/routes/admin/tenants.ts`	Conditionally includes decrypted tenant secrets in admin GET responses based on config flag.
`src/config.ts`	Adds `adminReturnTenantSensitiveData` to runtime config, sourced from env.
`.env.sample`	Documents `ADMIN_RETURN_TENANT_SENSITIVE_DATA` and its effect on tenant admin endpoints.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-07T08:33:49Z

src/http/routes/admin/tenants.ts

+        ...(adminReturnTenantSensitiveData
+          ? {
+              anonKey: decrypt(anon_key),
+              databaseUrl: decrypt(database_url),
+              databasePoolUrl: database_pool_url ? decrypt(database_pool_url) : undefined,
+              jwtSecret: decrypt(jwt_secret),
+              jwks,
+              serviceKey: decrypt(service_key),
+            }


New behavior is gated by adminReturnTenantSensitiveData, but there are no automated tests asserting that GET /tenants and GET /tenants/:tenantId omit decrypted secrets when the env var is set to false. Add a test case (e.g., in src/test/tenant.test.ts) that sets process.env.ADMIN_RETURN_TENANT_SENSITIVE_DATA='false', reloads config, and verifies the response does not include anonKey, databaseUrl, databasePoolUrl, jwtSecret, jwks, or serviceKey.

Copilot · 2026-04-07T08:33:49Z

.env.sample

 DATABASE_MULTITENANT_POOL_URL=postgresql://postgres:postgres@127.0.0.1:6454/postgres
 REQUEST_X_FORWARDED_HOST_REGEXP=^([a-z]{20}).local.(?:com|dev)$
 SERVER_ADMIN_API_KEYS=apikey
+# When set to false, GET /tenants endpoints omit decrypted secrets (database urls, jwt secret, service key, anon key, jwks). Defaults to true.


The sample env comment refers to "GET /tenants endpoints" but these routes are part of the admin API (served on the admin port / behind admin API keys). Consider clarifying the comment to avoid implying that the public API exposes this toggle.

Suggested change

# When set to false, GET /tenants endpoints omit decrypted secrets (database urls, jwt secret, service key, anon key, jwks). Defaults to true.

# When set to false, admin API GET /tenants endpoints omit decrypted secrets (database urls, jwt secret, service key, anon key, jwks). Defaults to true.

coveralls · 2026-04-07T08:40:12Z

Coverage Report for CI Build 24080150991

Coverage increased (+0.008%) to 80.672%

Details

Coverage increased (+0.008%) from the base build.
Patch coverage: 30 of 30 lines across 2 files are fully covered (100%).
No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

Coverage Stats


Relevant Lines:	37241
Covered Lines:	30226
Line Coverage:	81.16%
Relevant Branches:	4118
Covered Branches:	3139
Branch Coverage:	76.23%
Branches in Coverage %:	Yes
Coverage Strength:	316.17 hits per line

💛 - Coveralls

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-07T17:46:51Z

src/config.ts

      'REQUEST_ADMIN_TRACE_HEADER'
    ),
+    adminReturnTenantSensitiveData:
+      getOptionalConfigFromEnv('ADMIN_RETURN_TENANT_SENSITIVE_DATA') !== 'false',


The new flag is read only from ADMIN_RETURN_TENANT_SENSITIVE_DATA, but other admin-related settings in this config consistently use the SERVER_ADMIN_* prefix with a fallback (e.g. SERVER_ADMIN_PORT, SERVER_ADMIN_API_KEYS). To avoid configuration confusion and keep naming consistent, consider reading SERVER_ADMIN_RETURN_TENANT_SENSITIVE_DATA with a fallback to ADMIN_RETURN_TENANT_SENSITIVE_DATA (or rename the variable entirely and keep a backward-compatible fallback).

Suggested change

getOptionalConfigFromEnv('ADMIN_RETURN_TENANT_SENSITIVE_DATA') !== 'false',

getOptionalConfigFromEnv(

'SERVER_ADMIN_RETURN_TENANT_SENSITIVE_DATA',

'ADMIN_RETURN_TENANT_SENSITIVE_DATA'

) !== 'false',

Copilot · 2026-04-07T17:46:52Z

.env.sample

+# When set to false, GET /tenants endpoints omit decrypted secrets (database urls, jwt secret, service key, anon key, jwks). Defaults to true.
+# ADMIN_RETURN_TENANT_SENSITIVE_DATA=true


The sample env var name here (ADMIN_RETURN_TENANT_SENSITIVE_DATA) doesn’t match the SERVER_ADMIN_* naming used for other admin settings in this file (e.g. SERVER_ADMIN_API_KEYS, SERVER_ADMIN_PORT). Aligning the name (or documenting both with a clear precedence) would reduce operator confusion.

Suggested change

# When set to false, GET /tenants endpoints omit decrypted secrets (database urls, jwt secret, service key, anon key, jwks). Defaults to true.

# ADMIN_RETURN_TENANT_SENSITIVE_DATA=true

# When set to false, GET /tenants endpoints omit decrypted secrets (database urls, jwt secret, service key, anon key, jwks). Defaults to true.

# Uses the legacy/current env var name below; `SERVER_ADMIN_RETURN_TENANT_SENSITIVE_DATA` is the convention-aligned equivalent for admin settings.

# ADMIN_RETURN_TENANT_SENSITIVE_DATA=true

# SERVER_ADMIN_RETURN_TENANT_SENSITIVE_DATA=true

fenos requested a review from a team as a code owner April 7, 2026 08:30

Copilot AI review requested due to automatic review settings April 7, 2026 08:30

Copilot started reviewing on behalf of fenos April 7, 2026 08:31 View session

Copilot AI reviewed Apr 7, 2026

View reviewed changes

ferhatelmas approved these changes Apr 7, 2026

View reviewed changes

fix: env to control tenant config visibility

c6ed793

fenos force-pushed the tenant/env-for-tenant-sensible-info branch from 6fadb26 to c6ed793 Compare April 7, 2026 11:58

ferhatelmas requested a review from Copilot April 7, 2026 17:43

Copilot started reviewing on behalf of ferhatelmas April 7, 2026 17:44 View session

Copilot AI reviewed Apr 7, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: env to control tenant config visibility#989

fix: env to control tenant config visibility#989
fenos wants to merge 1 commit intomasterfrom
tenant/env-for-tenant-sensible-info

fenos commented Apr 7, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 7, 2026

Uh oh!

Copilot AI Apr 7, 2026

Uh oh!

coveralls commented Apr 7, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 7, 2026

Uh oh!

Copilot AI Apr 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	# When set to false, GET /tenants endpoints omit decrypted secrets (database urls, jwt secret, service key, anon key, jwks). Defaults to true.
	# When set to false, admin API GET /tenants endpoints omit decrypted secrets (database urls, jwt secret, service key, anon key, jwks). Defaults to true.

		# When set to false, GET /tenants endpoints omit decrypted secrets (database urls, jwt secret, service key, anon key, jwks). Defaults to true.
		# ADMIN_RETURN_TENANT_SENSITIVE_DATA=true

Uh oh!

Conversation

fenos commented Apr 7, 2026

What kind of change does this PR introduce?

What is the current behavior?

What is the new behavior?

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

coveralls commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report for CI Build 24080150991

Coverage increased (+0.008%) to 80.672%

Details

Uncovered Changes

Coverage Regressions

Coverage Stats

💛 - Coveralls

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

coveralls commented Apr 7, 2026 •

edited

Loading