pacnpal/thrilltrack-explorer
1
0
Fork 0
mirror of https://github.com/pacnpal/thrilltrack-explorer.git synced 2025-12-20 09:31:13 -05:00
Code Issues Packages Projects Releases Wiki Activity

Fix RLS policy for test data registry

Browse Source
This commit is contained in:
gpt-engineer-app[bot]
2025-11-04 16:30:33 +00:00
parent e1c7d5599f
commit 05acd49334
1 changed files with 31 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
supabase/migrations/20251104163017_0b5975ea-d452-45aa-8dd4-77b41c557351.sql Normal file
View File

@@ -0,0 +1,31 @@
-- Relax RLS on test_data_registry to not require MFA for management operations
-- Separate SELECT (viewing) from INSERT/UPDATE/DELETE (management)
-- Drop ALL existing policies on test_data_registry
DROP POLICY IF EXISTS "Moderators can manage test data registry" ON test_data_registry;
DROP POLICY IF EXISTS "Moderators can view test data registry" ON test_data_registry;
-- Keep MFA requirement for viewing (sensitive operation tracking)
CREATE POLICY "Moderators can view test data registry"
ON test_data_registry
FOR SELECT
TO authenticated
USING (
is_moderator(auth.uid())
AND (
(NOT EXISTS (
SELECT 1 FROM auth.mfa_factors
WHERE user_id = auth.uid() AND status = 'verified'
))
OR has_aal2()
)
);
-- Allow moderators to insert/update/delete without MFA requirement
-- Test data cleanup is a low-risk development operation
CREATE POLICY "Moderators can manage test data registry"
ON test_data_registry
FOR ALL
TO authenticated
USING (is_moderator(auth.uid()))
WITH CHECK (is_moderator(auth.uid()));