2df3fe6983
Require session on APIs, scope KPIs/activos/simulate to the user tenant, strip real JWTs from .env.example, and add health/smoke/docs for 4Ventures ops. Co-authored-by: Cursor <cursoragent@cursor.com>
28 lines
997 B
SQL
28 lines
997 B
SQL
-- RLS checklist — run in Supabase SQL editor as postgres
|
|
-- Goal: prove tenant isolation (no cross-tenant reads)
|
|
|
|
-- 1) List tables missing RLS
|
|
select c.relname as table_name, c.relrowsecurity as rls_enabled
|
|
from pg_class c
|
|
join pg_namespace n on n.oid = c.relnamespace
|
|
where n.nspname = 'public' and c.relkind = 'r'
|
|
order by 1;
|
|
|
|
-- 2) Expected: tenants, users, leads, deals, ad_daily, documents,
|
|
-- document_chunks, agent_runs, targets, kpi_weekly (view) …
|
|
-- Each business table: ALTER TABLE … ENABLE ROW LEVEL SECURITY;
|
|
|
|
-- 3) Example policy pattern (adapt column names):
|
|
-- create policy tenant_select on public.leads
|
|
-- for select using (
|
|
-- tenant_id::text = coalesce(
|
|
-- auth.jwt() -> 'app_metadata' ->> 'tenant_id',
|
|
-- auth.jwt() -> 'user_metadata' ->> 'tenant_id'
|
|
-- )
|
|
-- );
|
|
|
|
-- 4) Negative test: login as client A, select count(*) from leads
|
|
-- where tenant_id = '<tenant_B>'; must be 0.
|
|
|
|
-- 5) Service role bypasses RLS — never expose to browser.
|