feat: add RLS policies to organizations table #1522

devin-ai-integration · 2025-04-25T12:36:46Z

Add RLS policies to organizations table

Description

This PR implements Row Level Security (RLS) policies for the organizations table according to the ADR on applying RLS to all tables with organization-based policies.

Changes

Enable RLS on the organizations table
Add policies for authenticated users (SELECT, INSERT, UPDATE, DELETE)
Add policies for service_role to allow backend operations

Related Issues

ADR: Apply RLS to All Tables with Organization-based Policies

Link to Devin run

https://app.devin.ai/sessions/dc858d720b6746b49b672101a932e353

Requested by

noritaka.ikeda@route06.co.jp

Co-Authored-By: noritaka.ikeda@route06.co.jp <noritaka.ikeda@route06.co.jp>

vercel · 2025-04-25T12:36:49Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
liam-app	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	May 1, 2025 8:20am
liam-docs	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	May 1, 2025 8:20am
liam-erd-sample	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	May 1, 2025 8:20am

changeset-bot · 2025-04-25T12:36:49Z

⚠️ No Changeset found

Latest commit: 286923a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

devin-ai-integration · 2025-04-25T12:36:53Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment and CI monitoring

supabase · 2025-04-25T12:36:56Z

Updates to Preview Branch (devin/1745584509-add-rls-to-organizations-table) ↗︎

Deployments	Status	Updated
Database	✅	Thu, 01 May 2025 08:16:34 UTC
Services	✅	Thu, 01 May 2025 08:16:34 UTC
APIs	✅	Thu, 01 May 2025 08:16:34 UTC

Tasks are run on every commit but only new migration files are pushed.
Close and reopen this PR if you want to apply changes from existing seed or migration files.

Tasks	Status	Updated
Configurations	✅	Thu, 01 May 2025 08:16:38 UTC
Migrations	⚠️	Thu, 01 May 2025 08:16:38 UTC
Seeding	✅	Thu, 01 May 2025 08:16:38 UTC
Edge Functions	✅	Thu, 01 May 2025 08:16:38 UTC

⚠️ Warning — Applied out-of-order migrations: [frontend/packages/db/supabase/migrations/20250424000000_add_organization_id_to_review_feedback_knowledge_suggestion_mappings.sql frontend/packages/db/supabase/migrations/20250424113759_add_organization_id_to_project_repository_mappings.sql frontend/packages/db/supabase/migrations/20250424113807_add_organization_id_to_migrations.sql frontend/packages/db/supabase/migrations/20250424113811_add_organization_id_to_github_pull_requests.sql frontend/packages/db/supabase/migrations/20250424113905_add_organization_id_to_schema_file_paths.sql frontend/packages/db/supabase/migrations/20250424123000_add_organization_id_to_migration_pull_request_mappings.sql frontend/packages/db/supabase/migrations/20250424124724_add_organization_id_to_github_pull_request_comments.sql frontend/packages/db/supabase/migrations/20250425090250_add_token_to_invite_organization_member.sql frontend/packages/db/supabase/migrations/20250425122500_add_organization_id_to_knowledge_suggestion_doc_mappings.sql frontend/packages/db/supabase/migrations/20250425122820_add_organization_id_to_doc_file_paths.sql frontend/packages/db/supabase/migrations/20250425122828_add_organization_id_to_overall_reviews.sql frontend/packages/db/supabase/migrations/20250425123357_add_rls_to_github_repositories.sql frontend/packages/db/supabase/migrations/20250425123413_add_rls_to_invitations.sql]

View logs for this Workflow Run ↗︎.
Learn more about Supabase for Git ↗︎.

qodo-merge-for-open-source · 2025-04-25T12:41:14Z

CI Feedback 🧐

(Feedback updated until commit `d2c1b05`)

A test triggered by this PR failed. Here is an AI-generated analysis of the failure:

Action: frontend-ci
Failed stage: Run pnpm test:turbo [❌]
Failure summary: The action failed during the build process of the `@liam-hq/db` package. The TypeScript compiler encountered errors in the file `src/index.ts` with multiple instances of the same error: Error TS2306: File '/home/runner/work/liam/liam/frontend/packages/db/supabase/database.types.ts' is not a module. This error appears on lines 6, 13, 14 in src/index.ts and line 2 in src/types/supabase-overrides/index.ts. The build command failed with exit code 2, causing the entire workflow to fail.
Relevant error logs: 1: ##[group]Operating System 2: Ubuntu ... 155: ##[group]Run pnpm install --frozen-lockfile --prefer-offline 156: �[36;1mpnpm install --frozen-lockfile --prefer-offline�[0m 157: shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0} 158: env: 159: PNPM_HOME: /home/runner/setup-pnpm/node_modules/.bin 160: ##[endgroup] 161: Scope: all 17 workspace projects 162: Lockfile is up to date, resolution step is skipped 163: Progress: resolved 1, reused 0, downloaded 0, added 0 164: Packages: +1566 165: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 166: Progress: resolved 1566, reused 1303, downloaded 0, added 0 167: Progress: resolved 1566, reused 1561, downloaded 0, added 553 168: Progress: resolved 1566, reused 1561, downloaded 0, added 1437 169: Progress: resolved 1566, reused 1561, downloaded 0, added 1566, done 170: WARN Failed to create bin at /home/runner/work/liam/liam/frontend/apps/erd-sample/node_modules/.bin/liam. ENOENT: no such file or directory, open '/home/runner/work/liam/liam/frontend/packages/cli/dist-cli/bin/cli.js' 171: devDependencies: ... 184: │ │ 185: │ Ignored build scripts: @biomejs/biome, @bundled-es-modules/glob, │ 186: │ @depot/cli, @prisma/client, @prisma/engines, @sentry/cli, core-js-pure, │ 187: │ esbuild, protobufjs, sharp, style-dictionary. │ 188: │ Run "pnpm approve-builds" to pick which dependencies should be allowed │ 189: │ to run scripts. │ 190: │ │ 191: ╰──────────────────────────────────────────────────────────────────────────────╯ 192: frontend/packages/jobs postinstall$ cp ../db-structure/node_modules/@ruby/prism/src/prism.wasm prism.wasm 193: frontend/apps/docs postinstall$ fumadocs-mdx 194: frontend/packages/jobs postinstall: Done 195: frontend/apps/docs postinstall: [MDX] types generated 196: frontend/apps/docs postinstall: Done 197: frontend/apps/app postinstall$ cp ../../packages/db-structure/node_modules/@ruby/prism/src/prism.wasm prism.wasm 198: frontend/apps/app postinstall: Done 199: WARN Failed to create bin at /home/runner/work/liam/liam/frontend/apps/erd-sample/node_modules/.bin/liam. ENOENT: no such file or directory, open '/home/runner/work/liam/liam/frontend/apps/erd-sample/node_modules/@liam-hq/cli/dist-cli/bin/cli.js' 200: Done in 5.7s using pnpm v10.8.1 ... 639: 4f4fb700ef54: Verifying Checksum 640: 4f4fb700ef54: Download complete 641: 9ced58d1ef15: Verifying Checksum 642: 9ced58d1ef15: Download complete 643: 6bbeea27f58c: Verifying Checksum 644: 6bbeea27f58c: Download complete 645: d261077062b2: Pull complete 646: 2babd04ec7b1: Pull complete 647: 6bbeea27f58c: Pull complete 648: 2b092e92b1a0: Pull complete 649: 9ced58d1ef15: Pull complete 650: 4f4fb700ef54: Pull complete 651: Digest: sha256:4bc04aca94a44f04b427a490f346e7397ef7ce61fe589d718f744f7d92cb5c80 652: Status: Downloaded newer image for public.ecr.aws/supabase/vector:0.28.1-alpine 653: 2.8.1: Pulling from supabase/kong 654: failed to display json stream: toomanyrequests: Rate exceeded 655: Retrying after 4s: public.ecr.aws/supabase/kong:2.8.1 ... 927: [css] Wrote /home/runner/work/liam/liam/frontend/packages/ui/src/components/IconButton/IconButton.module.css.d.ts 928: [css] Wrote /home/runner/work/liam/liam/frontend/packages/ui/src/components/DropdownMenu/DropdownMenu.module.css.d.ts 929: [css] Wrote /home/runner/work/liam/liam/frontend/packages/ui/src/components/GridTable/GridTable.module.css.d.ts 930: [css] Wrote /home/runner/work/liam/liam/frontend/packages/ui/src/components/CookieConsent/CookieConsent.module.css.d.ts 931: [css] Wrote /home/runner/work/liam/liam/frontend/packages/ui/src/components/Drawer/Drawer.module.css.d.ts 932: [css] Wrote /home/runner/work/liam/liam/frontend/packages/ui/src/components/Callout/Callout.module.css.d.ts 933: [css] Wrote /home/runner/work/liam/liam/frontend/packages/ui/src/components/Button/Button.module.css.d.ts 934: [css] Wrote /home/runner/work/liam/liam/frontend/packages/ui/src/components/Avatar/Avatar.module.css.d.ts 935: [css] Wrote /home/runner/work/liam/liam/frontend/packages/ui/src/styles/globals.css.d.ts 936: [css] pnpm run gen:css exited with code 0 937: ##[endgroup] 938: �[;31m@liam-hq/db:build�[;0m 939: cache miss, executing 527bceaa04b715d6 940: > @liam-hq/db@0.0.0 build /home/runner/work/liam/liam/frontend/packages/db 941: > tsc 942: ##[error]src/index.ts(6,31): error TS2306: File '/home/runner/work/liam/liam/frontend/packages/db/supabase/database.types.ts' is not a module. 943: ##[error]src/index.ts(13,31): error TS2306: File '/home/runner/work/liam/liam/frontend/packages/db/supabase/database.types.ts' is not a module. 944: ##[error]src/index.ts(14,29): error TS2306: File '/home/runner/work/liam/liam/frontend/packages/db/supabase/database.types.ts' is not a module. 945: ##[error]src/types/supabase-overrides/index.ts(2,52): error TS2306: File '/home/runner/work/liam/liam/frontend/packages/db/supabase/database.types.ts' is not a module. 946: ELIFECYCLE Command failed with exit code 2. 947: [ERROR] command finished with error: command (/home/runner/work/liam/liam/frontend/packages/db) /home/runner/setup-pnpm/node_modules/.bin/pnpm run build exited (2) 948: ##[group]@liam-hq/erd-core:gen ... 953: ##[group]@liam-hq/db-structure:test 954: cache miss, executing 857612c915dfe7d4 955: > @liam-hq/db-structure@0.0.19 test /home/runner/work/liam/liam/frontend/packages/db-structure 956: > vitest --watch=false 957: ##[endgroup] 958: ##[group]@liam-hq/db-structure:build 959: cache miss, executing 66d8ac31d7030990 960: > @liam-hq/db-structure@0.0.19 build /home/runner/work/liam/liam/frontend/packages/db-structure 961: > tsc && pnpm run cp:prism 962: ##[endgroup] 963: ##[group]@liam-hq/github:build 964: cache miss, executing 4ab10ec8291930b4 965: > @liam-hq/github@0.1.0 build /home/runner/work/liam/liam/frontend/packages/github 966: > tsc 967: ##[endgroup] 968: ##[error]@liam-hq/db#build: command (/home/runner/work/liam/liam/frontend/packages/db) /home/runner/setup-pnpm/node_modules/.bin/pnpm run build exited (2) 969: Tasks: 3 successful, 8 total 970: Cached: 0 cached, 8 total 971: Time: 4.358s 972: Failed: @liam-hq/db#build 973: ERROR run failed: command exited (2) 974: ELIFECYCLE Command failed with exit code 2. 975: ##[error]Process completed with exit code 2. 976: Post job cleanup.

Co-Authored-By: noritaka.ikeda@route06.co.jp <noritaka.ikeda@route06.co.jp>

…gration

liam-migration-preview · 2025-04-28T08:18:37Z

This migration adds comprehensive RLS policies on the organizations table, including SELECT, INSERT, UPDATE, and DELETE for authenticated users and service_role. The most significant concern is the overly permissive INSERT policy with WITH CHECK (true) and potential performance issues from subqueries. Overall, the migration is well structured with proper transaction wrapping and consistent naming, but clarifications on business rules and performance benchmarks would further improve its safety.

Migration URL: https://liam-app-git-staging-route-06-core.vercel.app/app/projects/9d777f64-400a-42f3-a60e-98a59fc97279/ref/devin%2F1745584509-add-rls-to-organizations-table/migrations/a7f02648-947a-4af8-bef9-6b9f5552bba1

ER Diagram:

View ERD for frontend/packages/db/schema/schema.sql: https://liam-app-git-staging-route-06-core.vercel.app/app/projects/9d777f64-400a-42f3-a60e-98a59fc97279/ref/devin%2F1745584509-add-rls-to-organizations-table/schema/frontend/packages/db/schema/schema.sql

NoritakaIkeda · 2025-04-28T08:19:33Z

frontend/packages/db/supabase/migrations/20250425123516_add_rls_to_organizations_table.sql

+
+ALTER TABLE "public"."organizations" ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "authenticated_users_can_select_org_organizations" 


Authenticated users can view and update only organizations they are members of, and they can create new organizations without restriction.

No service role policies are defined for this table yet.
If you're curious where this table is used, try grepping for .from('organizations') in the codebase.

qodo-merge-for-open-source · 2025-04-28T08:19:56Z

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪
🧪 No relevant tests
🔒 No security concerns identified
⚡ Recommended focus areas for review Missing DELETE Policy The migration adds SELECT, INSERT, and UPDATE policies for the organizations table but doesn't include a DELETE policy. This could prevent users from deleting organizations they own. BEGIN; ALTER TABLE "public"."organizations" ENABLE ROW LEVEL SECURITY; CREATE POLICY "authenticated_users_can_select_org_organizations" ON "public"."organizations" FOR SELECT TO "authenticated" USING ((id IN ( SELECT "organization_members"."organization_id" FROM "public"."organization_members" WHERE ("organization_members"."user_id" = "auth"."uid"()) ))); COMMENT ON POLICY "authenticated_users_can_select_org_organizations" ON "public"."organizations" IS 'Authenticated users can only view organizations they are members of'; CREATE POLICY "authenticated_users_can_insert_organizations" ON "public"."organizations" FOR INSERT TO "authenticated" WITH CHECK (true); COMMENT ON POLICY "authenticated_users_can_insert_organizations" ON "public"."organizations" IS 'Authenticated users can create any organization'; CREATE POLICY "authenticated_users_can_update_org_organizations" ON "public"."organizations" FOR UPDATE TO "authenticated" USING ((id IN ( SELECT "organization_members"."organization_id" FROM "public"."organization_members" WHERE ("organization_members"."user_id" = "auth"."uid"()) ))); COMMENT ON POLICY "authenticated_users_can_update_org_organizations" ON "public"."organizations" IS 'Authenticated users can only update organizations they are members of'; COMMIT; Missing Service Role Policy The PR description mentions adding policies for service_role to allow backend operations, but no such policies are implemented in the changes. This could restrict backend functionality. ALTER TABLE "public"."organizations" ENABLE ROW LEVEL SECURITY;

qodo-merge-for-open-source · 2025-04-28T08:20:21Z

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Security	Restrict organization creation permissions The current policy allows any authenticated user to create organizations without restrictions. Consider adding a more restrictive check to limit organization creation based on business rules or user roles. frontend/packages/db/schema/schema.sql [1033] -CREATE POLICY "authenticated_users_can_insert_organizations" ON "public"."organizations" FOR INSERT TO "authenticated" WITH CHECK (true); +CREATE POLICY "authenticated_users_can_insert_organizations" ON "public"."organizations" FOR INSERT TO "authenticated" WITH CHECK (auth.jwt()->>'role' = 'admin' OR auth.jwt()->>'is_organization_creator' = 'true'); Apply this suggestion Suggestion importance[1-10]: 8 __ Why: The suggestion correctly identifies that the policy `WITH CHECK (true)` allows any authenticated user to create organizations, which might be overly permissive. Proposing role-based or specific attribute checks is a valid security enhancement.	Medium
Security	Limit organization update permissions The current policy allows any organization member to update organization details. Consider adding role-based checks to ensure only organization admins or owners can modify organization information. frontend/packages/db/schema/schema.sql [1103-1105] CREATE POLICY "authenticated_users_can_update_org_organizations" ON "public"."organizations" FOR UPDATE TO "authenticated" USING (("id" IN ( SELECT "organization_members"."organization_id" FROM "public"."organization_members" - WHERE ("organization_members"."user_id" = "auth"."uid"())))); + WHERE ("organization_members"."user_id" = "auth"."uid"() AND "organization_members"."role" IN ('admin', 'owner'))))); Apply this suggestion Suggestion importance[1-10]: 8 __ Why: The suggestion accurately points out that the current policy allows any member of an organization to update its details. Recommending role-based checks (e.g., 'admin', 'owner') within the `USING` clause is a standard and often necessary security practice to enforce proper authorization.	Medium
Update

- Add service_role policies for SELECT, INSERT, UPDATE, DELETE operations - Add missing DELETE policy for authenticated users - Addresses PR feedback from NoritakaIkeda Co-Authored-By: noritaka.ikeda@route06.co.jp <noritaka.ikeda@route06.co.jp>

hoshinotsuyoshi

👍

MH4GF

I'm not sure if it will work properly since organization_members is not running in the same transaction, but it looks good for once!

feat: add RLS policies to organizations table

db14fb2

Co-Authored-By: noritaka.ikeda@route06.co.jp <noritaka.ikeda@route06.co.jp>

NoritakaIkeda self-assigned this Apr 25, 2025

chore: update schema.sql and database.types.ts with RLS policies

d2c1b05

Co-Authored-By: noritaka.ikeda@route06.co.jp <noritaka.ikeda@route06.co.jp>

vercel bot deployed to Preview – liam-erd-sample April 25, 2025 12:45 View deployment

vercel bot had a problem deploying to Preview – liam-app April 25, 2025 12:55 Failure

NoritakaIkeda added 2 commits April 28, 2025 17:17

refactor: remove unnecessary RLS policies from organizations table mi…

9e4cbc6

…gration

refactor: remove unused pgsodium extension from schema.sql

6b07976

NoritakaIkeda reviewed Apr 28, 2025

View reviewed changes

NoritakaIkeda marked this pull request as ready for review April 28, 2025 08:19

NoritakaIkeda requested a review from a team as a code owner April 28, 2025 08:19

NoritakaIkeda requested review from hoshinotsuyoshi, FunamaYukina, junkisai, MH4GF and NoritakaIkeda and removed request for a team April 28, 2025 08:19

qodo-merge-for-open-source bot added the Review effort 2/5 label Apr 28, 2025

vercel bot deployed to Preview – liam-erd-sample April 28, 2025 08:21 View deployment

vercel bot deployed to Preview – liam-app April 28, 2025 08:23 View deployment

vercel bot deployed to Preview – liam-erd-sample April 28, 2025 08:28 View deployment

vercel bot deployed to Preview – liam-app April 28, 2025 08:30 View deployment

hoshinotsuyoshi approved these changes Apr 28, 2025

View reviewed changes

MH4GF approved these changes Apr 28, 2025

View reviewed changes

Merge branch 'main' into devin/1745584509-add-rls-to-organizations-table

286923a

vercel bot deployed to Preview – liam-erd-sample May 1, 2025 08:16 View deployment

vercel bot deployed to Preview – liam-docs May 1, 2025 08:18 View deployment

vercel bot deployed to Preview – liam-app May 1, 2025 08:20 View deployment

NoritakaIkeda added this pull request to the merge queue May 1, 2025

Merged via the queue into main with commit 4196a88 May 1, 2025
20 checks passed

NoritakaIkeda deleted the devin/1745584509-add-rls-to-organizations-table branch May 1, 2025 08:58

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: add RLS policies to organizations table #1522

feat: add RLS policies to organizations table #1522

Uh oh!

devin-ai-integration bot commented Apr 25, 2025

Uh oh!

vercel bot commented Apr 25, 2025 •

edited

Loading

Uh oh!

changeset-bot bot commented Apr 25, 2025 •

edited

Loading

Uh oh!

devin-ai-integration bot commented Apr 25, 2025

Uh oh!

supabase bot commented Apr 25, 2025 •

edited

Loading

Uh oh!

qodo-merge-for-open-source bot commented Apr 25, 2025 •

edited

Loading

Uh oh!

liam-migration-preview bot commented Apr 28, 2025 •

edited

Loading

Uh oh!

NoritakaIkeda Apr 28, 2025

Uh oh!

qodo-merge-for-open-source bot commented Apr 28, 2025

Uh oh!

qodo-merge-for-open-source bot commented Apr 28, 2025 •

edited

Loading

Uh oh!

hoshinotsuyoshi left a comment

Uh oh!

MH4GF left a comment

Uh oh!

Uh oh!

Uh oh!


		ALTER TABLE "public"."organizations" ENABLE ROW LEVEL SECURITY;

		CREATE POLICY "authenticated_users_can_select_org_organizations"

feat: add RLS policies to organizations table #1522

feat: add RLS policies to organizations table #1522

Uh oh!

Conversation

devin-ai-integration bot commented Apr 25, 2025

Add RLS policies to organizations table

Description

Changes

Related Issues

Link to Devin run

Requested by

Uh oh!

vercel bot commented Apr 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot bot commented Apr 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

devin-ai-integration bot commented Apr 25, 2025

🤖 Devin AI Engineer

Uh oh!

supabase bot commented Apr 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qodo-merge-for-open-source bot commented Apr 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI Feedback 🧐

(Feedback updated until commit d2c1b05)

Uh oh!

liam-migration-preview bot commented Apr 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NoritakaIkeda Apr 28, 2025

Choose a reason for hiding this comment

Uh oh!

qodo-merge-for-open-source bot commented Apr 28, 2025

PR Reviewer Guide 🔍

Uh oh!

qodo-merge-for-open-source bot commented Apr 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Code Suggestions ✨

Uh oh!

hoshinotsuyoshi left a comment

Choose a reason for hiding this comment

Uh oh!

MH4GF left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

vercel bot commented Apr 25, 2025 •

edited

Loading

changeset-bot bot commented Apr 25, 2025 •

edited

Loading

supabase bot commented Apr 25, 2025 •

edited

Loading

qodo-merge-for-open-source bot commented Apr 25, 2025 •

edited

Loading

(Feedback updated until commit `d2c1b05`)

liam-migration-preview bot commented Apr 28, 2025 •

edited

Loading

qodo-merge-for-open-source bot commented Apr 28, 2025 •

edited

Loading