{"record":{"id":"08bd0b2203b2f3ce","repo":"paperclipai/paperclip","slug":"plugin-sql-references-public-ref-table-which-i","errorCode":null,"errorMessage":"Plugin SQL references public.${ref.table}, which is not whitelisted","messagePattern":"Plugin SQL references public\\.(.+?), which is not whitelisted","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"server/src/services/plugin-database.ts","lineNumber":163,"sourceCode":"  for (const { pattern, ...mapping } of patterns) {\n    for (const match of statement.matchAll(pattern)) {\n      if (mapping.groups === \"keyword-schema-table\") {\n        refs.push({ keyword: match[1]!.toLowerCase(), schema: match[2]!, table: match[3]! });\n      } else {\n        refs.push({ keyword: mapping.keyword, schema: match[1]!, table: match[2]! });\n      }\n    }\n  }\n  return refs;\n}\n\nfunction assertAllowedPublicRead(\n  ref: SqlRef,\n  allowedCoreReadTables: ReadonlySet<string>,\n): void {\n  if (ref.schema !== \"public\") return;\n  if (!allowedCoreReadTables.has(ref.table)) {\n    throw new Error(`Plugin SQL references public.${ref.table}, which is not whitelisted`);\n  }\n  if (![\"from\", \"join\", \"references\"].includes(ref.keyword)) {\n    throw new Error(`Plugin SQL cannot mutate or define objects in public.${ref.table}`);\n  }\n}\n\nfunction assertNoBannedSql(statement: string): void {\n  const normalized = normaliseSql(statement);\n  const banned = [\n    /\\bcreate\\s+extension\\b/,\n    /\\bcreate\\s+(?:event\\s+)?trigger\\b/,\n    /\\bcreate\\s+(?:or\\s+replace\\s+)?function\\b/,\n    /\\bcreate\\s+language\\b/,\n    /\\bgrant\\b/,\n    /\\brevoke\\b/,\n    /\\bsecurity\\s+definer\\b/,\n    /\\bcopy\\b/,\n    /\\bcall\\b/,","sourceCodeStart":145,"sourceCodeEnd":181,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/server/src/services/plugin-database.ts#L145-L181","documentation":"Isolation guard in assertAllowedPublicRead: a plugin SQL statement references a table in the shared public schema that is not on the instance's coreReadTables whitelist. Plugins may only read the whitelisted core tables; the plugin statement naming the non-whitelisted table is at fault.","triggerScenarios":"Thrown at server/src/services/plugin-database.ts:163 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove the reference to the non-whitelisted public table, or request whitelisting of that table."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}