Threads
Loading user profile...
Exactly right, and it's the same line the tool holds: better a loud "verify this" than a quiet false clean on an org\_id IS NOT NULL. Your "can't prove it scopes to the caller" bucket is basically the input list for a runtime run. Catch-on-the-page and catch-when-it-runs, two halves of one check. Happy to compare notes if you go deeper on the static side.
[ Removed by Reddit ]
u/Duck-Entire \- Following could be the solution that could help you out. [https://www.reddit.com/r/Supabase/comments/1uooxhp/i\_built\_a\_tool\_that\_generates\_pgtap\_rls\_tests/](https://www.reddit.com/r/Supabase/comments/1uooxhp/i_built_a_tool_that_generates_pgtap_rls_tests/)
"Enforced as written" isn't trivial in RLS. What's actually enforced is every permissive and restrictive policy combined, plus whether RLS is even on. You can write a clean per-user policy and still have a second permissive one quietly making every row readable. Reading your policies misses that; asserting the real behavior catches it. And hand-written tests don't prove much because they run against empty rows. This generates the data plus a real different-tenant user for the deny case, so the test can actually fail. That negative control is the smarter test you're asking for. No tool proves you wrote the policy you meant, but "does my DB actually enforce what I wrote" is where the leaks are.
Repo: [https://github.com/unitautogen/rlsautotest](https://github.com/unitautogen/rlsautotest) \- if it can't handle a policy on a real schema, reply here or open an issue. That's the feedback I'm after.
Does it create pgtap unit tests which supabase recommends for RLS testing?
Would it generate pgtap unit tests for RLS testing?
Best way to catch using(true), since "RLS enabled" won't: read the table as another user. In the Supabase SQL editor, no tooling: set local role authenticated; set local [request.jwt.claims](http://request.jwt.claims) = '{"sub":"<another-users-uuid>"}'; select \* from your\_table; Rows come back that aren't theirs? The policy is decorative. "RLS on" says a lock exists; reading as another identity says it's actually locked. The trap is the asymmetry: zero policies fails closed (safe), using(true) fails open (wide open), and both read as "RLS enabled." +1 on step 4. The service role key has BYPASSRLS, so any route holding it is outside RLS by design. Pass the user's JWT so policies apply, and keep the service key for server-only work. By hand this is fine for one table, brutal across a schema: every table, identity, and command, with seed rows that match each policy or you're testing against zero rows. Worth automating, and a few tools now generate exactly these checks. Happy to point you at what I use.