Rls policy

Skill m-binimran/dev-pack/skills/rls-policy

Guardrails, skills, loops, hooks & review agents for database + website builders on Claude Code (Next.js + Supabase).

Install

npx -y skills add m-binimran/dev-pack --skill rls-policy

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Write and test Supabase/Postgres Row-Level Security policies so users can only access their own rows. Use when a table holds user data, when enabling RLS, or when auditing access control on Supabase.

SKILL.md

1.6 KB, as published. Nobody here has run it

rls-policy

On Supabase, RLS is the real authorization boundary. The anon/auth keys reach the DB directly, so a missing policy = open data.

Process

Enable RLS on the table: alter table X enable row level security; (denies all by default).
Write explicit policies per operation (select, insert, update, delete) — don't use one for all policy unless the rule is genuinely identical.

Scope by auth.uid() for owner-based access:

create policy "owners read" on profiles
  for select using (auth.uid() = user_id);
create policy "owners write" on profiles
  for insert with check (auth.uid() = user_id);

using filters existing rows; with check validates new/changed rows. Insert/update need with check.

Test both directions: the owner CAN, a different user CANNOT. State both tests.

Patterns

Public-read, owner-write: select using (true), write policies gated by auth.uid().
Team access: join through a membership table inside the using expression.
Service tasks: use the service-role key on the server only — it bypasses RLS, so never expose it client-side.

Guardrails

Never disable RLS to "make it work." Fix the policy.
with check is required on insert/update or users can write rows they can't read back.
The service-role key is a secret — server-side only (the secret-scan hook will catch it in client code).