From https://gitter.im/begriffs/postgrest?at=6302565ef4d7a323de64aa37

I have found that upserting {id: 42, comment: 'foo'} into

create table mytable (
  id bigserial primary key,
  comment text);

generates this following [pseudo]query

insert into mytable (id, comment) values (request.id, request.comment)
on conflict (id) do update id=excluded.id, comment=excluded.comment;

the do update id=excluded.id part is causing issues for me as i wanted to disallow updating the id once inserted so i through simple

GRANT select, insert(id, comment), update(comment) on mytable to api

would work.
With the above permissions and set up i can do INSERT followed by UPDATE as expected, but it turns out that i am getting 403 for upsert.

I tend to think this is a bug, as there is no real reason to include the do update id=excluded.id if the id is the default constraint. Or am i missing something?