supabase

Supabase Standards

Supabase is Postgres underneath, so this domain co-loads with database (generic Postgres) and the auth / security concerns. It owns only the platform contract: RLS, the key boundary, Postgres/Edge function security, and the CLI migration workflow. Generic Postgres rules (types, constraints, indexing-in-general, expand-contract, N+1, transactions) live in database; auth flows (JWT verification, OAuth, password reset) live in global/refs/auth.md — this domain links to them rather than restating them.

Priority: P0 — Row-Level Security

• RLS is OFF by default. Every table reachable through the API/PostgREST must ENABLE ROW LEVEL SECURITY in the same migration that creates it. A table left unguarded behind a public anon key is a full data leak. Signal: a create table in supabase/migrations with no matching alter table … enable row level security.
• RLS-on denies by default — write an explicit policy per operation (select/insert/update/delete). Don't rely on one for all policy where operations need different predicates. Signal: a table with RLS enabled and no policy, or a blanket for all using (true).
• Pair every UPDATE/DELETE policy with a SELECT policy. Postgres must read the existing row to evaluate the USING clause; without SELECT the row is invisible and the write silently affects nothing. Signal: an update/delete policy on a table with no select policy.
• Use WITH CHECK on INSERT/UPDATE so a user can't write a row they couldn't own or read (e.g. inserting someone else's user_id). Signal: an insert/update policy with using but no with check.
• Wrap auth calls as (select auth.uid()) / (select auth.jwt()) in policy predicates so the planner caches the result per-statement instead of re-evaluating per row. Signal: a bare auth.uid() in a policy on a table that gets scanned.
• Never base a policy on auth.jwt() -> 'user_metadata' — user_metadata is editable by the authenticated user. Use app_metadata (server-controlled) or a roles table joined via a security definer helper. Signal: a policy reading user_metadata for an authorization decision.
• Index every column referenced in an RLS predicate (user_id, tenant_id, …). RLS turns these into per-query filters; an unindexed predicate column is a full scan on every request. (Sharpens the database indexing rule.) Signal: an RLS predicate column absent from any index.