security: use GitHub Secrets for keepalive workflow and harden SQL RLS policies

Author: zzdree

.github/workflows/keepalive.yml

@@ -16,8 +16,8 @@ jobs:
     steps:
       - name: Ping Supabase Database
         env:
-          DEFAULT_URL: "https://lnxprlvmyhqxkzarrzac.supabase.co"
-          DEFAULT_KEY: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImxueHBybHZteWhxeGt6YXJyemFjIiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODc0MDAwMDIsImV4cCI6MjEwMjk3NjAwMn0.fb4njNTFQZMcZPuvHE96i8zfX7CXCTGVN10A6wYDZUs"
+          DEFAULT_URL: ${{ secrets.SUPABASE_URL }}
+          DEFAULT_KEY: ${{ secrets.SUPABASE_KEY }}
           PROJECTS: ${{ secrets.SUPABASE_PROJECTS }}
         run: |
           if [ -n "$PROJECTS" ]; then

schema.sql

@@ -44,17 +44,23 @@ $$;
 -- Berikan izin akses RPC ke role anon (web client) & authenticated
 GRANT EXECUTE ON FUNCTION next_order_no() TO anon, authenticated;
 
--- Aktifkan Row Level Security (RLS) & Policy Akses Publik
+-- Aktifkan Row Level Security (RLS) & Policy Akses
 ALTER TABLE transaksi ENABLE ROW LEVEL SECURITY;
 
+DROP POLICY IF EXISTS "Allow public read transaksi" ON transaksi;
 CREATE POLICY "Allow public read transaksi"
   ON transaksi FOR SELECT
   USING (true);
 
+DROP POLICY IF EXISTS "Allow public insert transaksi" ON transaksi;
 CREATE POLICY "Allow public insert transaksi"
   ON transaksi FOR INSERT
   WITH CHECK (true);
 
+DROP POLICY IF EXISTS "Allow public update transaksi" ON transaksi;
 CREATE POLICY "Allow public update transaksi"
   ON transaksi FOR UPDATE
-  USING (true);
+  USING (true)
+  WITH CHECK (true);
+
+-- Catatan: Operasi DELETE sengaja TIDAK diberi policy publik (hanya bisa via service_role/admin) untuk mencegah penghapusan data transaksi.