mirror of
https://github.com/supabase/supabase.git
synced 2026-05-06 08:56:46 -04:00
Joshen Lim
5f867e5f6c
## Context Resolves FE-3077 Related discussion: https://github.com/orgs/supabase/discussions/45233 Verifying the correctness of your RLS policies set up has always been a gap, as highlighted by a number of GitHub discussions like [here](https://github.com/orgs/supabase/discussions/12269) and [here](https://github.com/orgs/supabase/discussions/14401). As such, we're piloting a dedicated UI for RLS testing (using role impersonation as the base), in which you'll be able to - Run a SQL query as a user (not logged in / logged in - this is the role impersonation part) - See which RLS policies are being evaluated as part of the query - And hopefully be able to debug which policies are not set up correctly Changes are currently set as a feature preview - and we'll iterate as we get feedback from everyone 🙂 🙏 <img width="613" height="957" alt="image" src="https://github.com/user-attachments/assets/83c37f8a-28fc-43b3-b0ff-e28571d8710c" /> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * RLS Tester: run queries as anon or authenticated users, view inferred SQL, per-table policy summaries, and data previews of accessible rows. * UI preview: new RLS Tester preview card and modal with opt-in toggle; RLS Tester sheet with role/user selector and query editor. * SQLEditor: “Explain” tab is always visible. * **Chores** * Added supporting API endpoints, background checks for table RLS status, and a local-storage flag to persist the preview opt-in. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
48 lines
1.1 KiB
TypeScript
48 lines
1.1 KiB
TypeScript
import type { NextRequest } from 'next/server'
|
|
|
|
import { IS_PLATFORM } from '@/lib/constants'
|
|
|
|
export const config = {
|
|
matcher: '/api/:function*',
|
|
}
|
|
|
|
// [Joshen] Return 404 for all next.js API endpoints EXCEPT the ones we use in hosted:
|
|
const HOSTED_SUPPORTED_API_URLS = [
|
|
'/ai/sql/generate-v4',
|
|
'/ai/sql/policy',
|
|
'/ai/feedback/rate',
|
|
'/ai/code/complete',
|
|
'/ai/sql/cron-v2',
|
|
'/ai/sql/title-v2',
|
|
'/ai/sql/filter-v1',
|
|
'/ai/onboarding/design',
|
|
'/ai/feedback/classify',
|
|
'/ai/docs',
|
|
'/ai/sql/parse-client-code',
|
|
'/get-ip-address',
|
|
'/get-utc-time',
|
|
'/get-deployment-commit',
|
|
'/check-cname',
|
|
'/edge-functions/test',
|
|
'/edge-functions/body',
|
|
'/generate-attachment-url',
|
|
'/incident-status',
|
|
'/incident-banner',
|
|
'/status-override',
|
|
'/api/integrations/stripe-sync',
|
|
'/content/graphql',
|
|
'/parse-query',
|
|
]
|
|
|
|
export function proxy(request: NextRequest) {
|
|
if (
|
|
IS_PLATFORM &&
|
|
!HOSTED_SUPPORTED_API_URLS.some((url) => request.nextUrl.pathname.endsWith(url))
|
|
) {
|
|
return Response.json(
|
|
{ success: false, message: 'Endpoint not supported on hosted' },
|
|
{ status: 404 }
|
|
)
|
|
}
|
|
}
|