Files
supabase/apps/studio/data/database/table-check-rls-mutation.ts
Joshen Lim 5f867e5f6c Feature Preview: RLS Tester (#45121)
## Context

Resolves FE-3077
Related discussion: https://github.com/orgs/supabase/discussions/45233

Verifying the correctness of your RLS policies set up has always been a
gap, as highlighted by a number of GitHub discussions like
[here](https://github.com/orgs/supabase/discussions/12269) and
[here](https://github.com/orgs/supabase/discussions/14401). As such,
we're piloting a dedicated UI for RLS testing (using role impersonation
as the base), in which you'll be able to
- Run a SQL query as a user (not logged in / logged in - this is the
role impersonation part)
- See which RLS policies are being evaluated as part of the query
- And hopefully be able to debug which policies are not set up correctly

Changes are currently set as a feature preview - and we'll iterate as we
get feedback from everyone 🙂 🙏

<img width="613" height="957" alt="image"
src="https://github.com/user-attachments/assets/83c37f8a-28fc-43b3-b0ff-e28571d8710c"
/>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* RLS Tester: run queries as anon or authenticated users, view inferred
SQL, per-table policy summaries, and data previews of accessible rows.
* UI preview: new RLS Tester preview card and modal with opt-in toggle;
RLS Tester sheet with role/user selector and query editor.
  * SQLEditor: “Explain” tab is always visible.

* **Chores**
* Added supporting API endpoints, background checks for table RLS
status, and a local-storage flag to persist the preview opt-in.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-04-28 15:02:49 +08:00

60 lines
1.6 KiB
TypeScript

import { getTablesRlsEnabledStatusSQL } from '@supabase/pg-meta'
import { useMutation } from '@tanstack/react-query'
import { toast } from 'sonner'
import { executeSql } from '../sql/execute-sql-query'
import { ResponseError, UseCustomMutationOptions } from '@/types'
type CheckTableRLSStatusVariables = {
projectRef?: string
connectionString?: string | null
tables: { schema: string; table: string }[]
}
export type CheckTableRLSStatusResponse = {
schema: string
table: string
rls_enabled: boolean
}
export async function checkTableRLSStatus({
projectRef,
connectionString,
tables,
}: CheckTableRLSStatusVariables) {
const sql = getTablesRlsEnabledStatusSQL({ tables })
const { result } = await executeSql({
projectRef,
connectionString,
sql,
queryKey: ['table-rls-status'],
})
return result as CheckTableRLSStatusResponse[]
}
type CheckTableRLSStatusData = Awaited<ReturnType<typeof checkTableRLSStatus>>
export const useCheckTableRLSStatusMutation = ({
onSuccess,
onError,
...options
}: Omit<
UseCustomMutationOptions<CheckTableRLSStatusData, ResponseError, CheckTableRLSStatusVariables>,
'mutationFn'
> = {}) => {
return useMutation<CheckTableRLSStatusData, ResponseError, CheckTableRLSStatusVariables>({
mutationFn: (vars) => checkTableRLSStatus(vars),
async onSuccess(data, variables, context) {
await onSuccess?.(data, variables, context)
},
async onError(data, variables, context) {
if (onError === undefined) {
toast.error(`Failed to retrieve table RLS statuses: ${data.message}`)
} else {
onError(data, variables, context)
}
},
...options,
})
}