Skip to content

security(supabase): add RLS enablement and policies for users, goals,… - #3255

Open
Nareshkumawat-star wants to merge 1 commit into
Priyanshu-byte-coder:mainfrom
Nareshkumawat-star:security/supabase-rls-policies
Open

security(supabase): add RLS enablement and policies for users, goals,…#3255
Nareshkumawat-star wants to merge 1 commit into
Priyanshu-byte-coder:mainfrom
Nareshkumawat-star:security/supabase-rls-policies

Conversation

@Nareshkumawat-star

Copy link
Copy Markdown

Summary

Audited database tables and added explicit Supabase Row Level Security (RLS) policies for users, goals, and streak_freezes tables in supabase/schema.sql. Also added documentation in DEVELOPMENT.md explaining RLS policies and how to verify active policies in the Supabase Dashboard.

Closes #3250


Type of Change

  • 🐛 Bug fix (non-breaking change that fixes an issue)
  • ✨ New feature (non-breaking change that adds functionality)
  • 💥 Breaking change (fix or feature that changes existing behavior)
  • 📝 Documentation update
  • ♻️ Refactor / code cleanup (no functional change)
  • ⚡ Performance improvement
  • 🔒 Security fix
  • 🧪 Tests only

What Changed

  • supabase/schema.sql:
    • Enabled RLS on users, goals, and streak_freezes tables.
    • Added policies restricting user access to their own rows (auth.uid()::text).
  • DEVELOPMENT.md:
    • Added documentation on RLS defense-in-depth and dashboard verification instructions.

How to Test

  1. Execute supabase/schema.sql in the Supabase SQL Editor.
  2. In the Supabase Dashboard, open AuthenticationPolicies or Table Editor.
  3. Verify that users, goals, and streak_freezes display the RLS Enabled badge and list their user-scoped policies (user_id = auth.uid()::text).

Checklist

  • Linked the related issue above
  • Self-reviewed my own diff
  • No unnecessary console.log or debug code
  • Updated documentation / comments

@github-actions github-actions Bot added gssoc26 GSSoC 2026 contribution type:devops GSSoC type bonus: devops (+15 pts) type:docs GSSoC type bonus: documentation (+5 pts) type:feature GSSoC type bonus: new feature type:security GSSoC type bonus: security (+20 pts) labels Jul 28, 2026
@github-actions

Copy link
Copy Markdown

GSSoC Label Checklist 🏷️

@Priyanshu-byte-coder — please apply the appropriate labels before merging:

Difficulty (pick one):

  • level:beginner — 20 pts
  • level:intermediate — 35 pts
  • level:advanced — 55 pts
  • level:critical — 80 pts

Quality (optional):

  • quality:clean — ×1.2 multiplier
  • quality:exceptional — ×1.5 multiplier

Validation (required to score):

  • gssoc:approved — counts for points
  • gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus

@Nareshkumawat-star

Copy link
Copy Markdown
Author

Hi @Priyanshu-byte-coder kindly review and merge it

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

gssoc26 GSSoC 2026 contribution type:devops GSSoC type bonus: devops (+15 pts) type:docs GSSoC type bonus: documentation (+5 pts) type:feature GSSoC type bonus: new feature type:security GSSoC type bonus: security (+20 pts)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[FEAT] Add Supabase Row Level Security (RLS) policy audit — ensure no user can read another user's goals or streak data

1 participant