mirror of
https://github.com/supabase/supabase.git
synced 2026-05-08 18:00:20 -04:00
5f867e5f6c
## Context Resolves FE-3077 Related discussion: https://github.com/orgs/supabase/discussions/45233 Verifying the correctness of your RLS policies set up has always been a gap, as highlighted by a number of GitHub discussions like [here](https://github.com/orgs/supabase/discussions/12269) and [here](https://github.com/orgs/supabase/discussions/14401). As such, we're piloting a dedicated UI for RLS testing (using role impersonation as the base), in which you'll be able to - Run a SQL query as a user (not logged in / logged in - this is the role impersonation part) - See which RLS policies are being evaluated as part of the query - And hopefully be able to debug which policies are not set up correctly Changes are currently set as a feature preview - and we'll iterate as we get feedback from everyone 🙂 🙏 <img width="613" height="957" alt="image" src="https://github.com/user-attachments/assets/83c37f8a-28fc-43b3-b0ff-e28571d8710c" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * RLS Tester: run queries as anon or authenticated users, view inferred SQL, per-table policy summaries, and data previews of accessible rows. * UI preview: new RLS Tester preview card and modal with opt-in toggle; RLS Tester sheet with role/user selector and query editor. * SQLEditor: “Explain” tab is always visible. * **Chores** * Added supporting API endpoints, background checks for table RLS status, and a local-storage flag to persist the preview opt-in. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
25 lines
782 B
TypeScript
25 lines
782 B
TypeScript
import { NextApiRequest, NextApiResponse } from 'next'
|
|
|
|
const CONTENT_API_URL = process.env.NEXT_PUBLIC_CONTENT_API_URL!
|
|
|
|
export default async function handler(req: NextApiRequest, res: NextApiResponse) {
|
|
if (req.method !== 'POST') {
|
|
res.setHeader('Allow', ['POST'])
|
|
return res.status(405).json({ error: `Method ${req.method} Not Allowed` })
|
|
}
|
|
|
|
try {
|
|
const response = await fetch(CONTENT_API_URL, {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify(req.body),
|
|
})
|
|
|
|
const data = await response.json()
|
|
return res.status(response.status).json(data)
|
|
} catch (error) {
|
|
console.error('Content API proxy error:', error)
|
|
return res.status(500).json({ error: 'Failed to reach Content API' })
|
|
}
|
|
}
|