feat(migrations): create apify_scraper_runs ownership map (chat#1840)

[sweetmantech]

Part of recoupable/chat#1840 item 1 (account-scope the scrape-results endpoint). Hard dependency: this migration must merge + apply before the api PR that reads/writes the table. Contract: docs#262.

What

public.apify_scraper_runs — ownership map written at scrape start by POST /api/socials/{id}/scrape, read by the GET /api/apify/runs/{runId} validator:

column	type	notes
run_id	TEXT PK	Apify run id — natural key, one owner per run
account_id	UUID NOT NULL	account whose key started the run
social_id	UUID	scraped social profile (audit, denormalized)
created_at	timestamptz default now()

• Loose ids, no FKs — same rationale as email_send_log: an ownership log shouldn't cascade-delete with accounts; a dangling row just degrades that run to admin-only polling.
• Index on account_id for audits; reads are by PK.
• RLS enabled, no policies (service-role access only), matching neighboring service-written tables.

Why

Apify run ids carry no account scope, so the results endpoint is admin-only — agents can start scrapes they can never read (7/7 Forbidden polls in the issue's evidence). This table gives the endpoint an ownership chain to authorize against.

🤖 Generated with Claude Code

---

Summary by cubic

Create public.apify_scraper_runs to map Apify run IDs to the owning account, enabling account-scoped access for GET /api/apify/runs/{runId} (chat#1840). Must deploy before the API that reads/writes this table.

• Migration
  • New table: run_id TEXT PK, account_id UUID NOT NULL, social_id UUID, created_at timestamptz default now().
  • Index on account_id; reads by PK.
  • RLS enabled with no policies (service-role only). No FKs to avoid cascade deletes.

^{Written for commit c63f2db. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

@sweetmantech, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 39 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e566e95d-e0b7-4f78-808b-c9de25444585

📥 Commits

Reviewing files that changed from the base of the PR and between bdffa77 and c63f2db.

📒 Files selected for processing (1)

• supabase/migrations/20260703120000_create_apify_scraper_runs.sql

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/apify-scraper-runs-ownership

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[supabase]

Updates to Preview Branch (feat/apify-scraper-runs-ownership) ↗︎

Deployments	Status	Updated
Database	✅	Fri, 03 Jul 2026 18:54:04 UTC
Services	✅	Fri, 03 Jul 2026 18:54:04 UTC
APIs	✅	Fri, 03 Jul 2026 18:54:04 UTC

Tasks are run on every commit but only new migration files are pushed.
Close and reopen this PR if you want to apply changes from existing seed or migration files.

Tasks	Status	Updated
Configurations	✅	Fri, 03 Jul 2026 18:54:10 UTC
Migrations	✅	Fri, 03 Jul 2026 18:54:13 UTC
Seeding	✅	Fri, 03 Jul 2026 18:54:15 UTC
Edge Functions	✅	Fri, 03 Jul 2026 18:54:15 UTC

---

View logs for this Workflow Run ↗︎.
Learn more about Supabase for Git ↗︎.

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}

[sweetmantech]

Closing unmerged — design decision on chat#1840 (2026-07-03): scraper-run polling moves to the capability model (any valid API key / Bearer token can poll any run id; scrape datasets are public social content and run ids are unguessable), so no runId→account ownership map is needed. api#752 is reworked to a plain validateAuthContext swap with no database dependency.