Enable Row-Level Security on public tables in Supabase at startup

MANUAL_TESTING.md

@@ -164,6 +164,9 @@ Checklist before giving the URL to real users:
 - [ ] `CCR_COOKIE_SECURE=1` (HTTPS only)
 - [ ] `CCR_DATA_DIR` on a persistent volume (default /tmp is ephemeral)
 - [ ] `CCR_ANON_TTL_HOURS=24` (default in the image)
+- [ ] Supabase: RLS shows enabled on all public tables (the app enables it
+      automatically at startup; the Supabase dashboard linter should report
+      zero `rls_disabled_in_public` issues)
 - [ ] Smoke test: sections 2, 4, 6, 7 above
 
 ## 12. Admin page (/admin)

backend/app/db.py

@@ -92,6 +92,35 @@ def _default_literal(value, dialect_name: str) -> str:
     return "'" + str(value).replace("'", "''") + "'"
 
 
+def lock_down_public_schema(target_engine, metadata) -> list[str]:
+    """Enable Row-Level Security on every app table (Postgres only).
+
+    Supabase auto-exposes the public schema through its REST API (PostgREST):
+    any table WITHOUT RLS is readable AND writable by anyone holding the
+    project URL + anon key - which for this app would mean users (password
+    hashes), corpora, jobs, everything. This app never uses that REST API:
+    the backend talks to Postgres directly as the table owner, and owners
+    bypass RLS. So RLS-with-no-policies cleanly closes the public door
+    without touching app behavior (Supabase linter: rls_disabled_in_public).
+
+    Runs at every startup AFTER create_all, so tables added later are locked
+    down the day they appear, not when someone remembers. Idempotent.
+    """
+    import logging
+
+    from sqlalchemy import text
+
+    if target_engine.dialect.name != "postgresql":
+        return []  # SQLite has no exposed REST surface (and no RLS)
+    locked = []
+    with target_engine.begin() as conn:
+        for table in metadata.sorted_tables:
+            conn.execute(text(f'ALTER TABLE "{table.name}" ENABLE ROW LEVEL SECURITY'))
+            locked.append(table.name)
+    logging.getLogger("ccr.db").info("RLS enabled on: %s", ", ".join(locked))
+    return locked
+
+
 def auto_migrate_sqlite(target_engine, metadata) -> list[str]:
     """Add ORM columns missing from existing tables (additive only).
 

backend/app/main.py

@@ -30,7 +30,15 @@ from . import registry
 from .ccr import FAKE_MODEL_NAME
 from .construct_files import parse_construct_file
 from .construct_lib import sync_library
-from .db import DATA_DIR, Base, SessionLocal, auto_migrate_sqlite, engine, get_db
+from .db import (
+    DATA_DIR,
+    Base,
+    SessionLocal,
+    auto_migrate_sqlite,
+    engine,
+    get_db,
+    lock_down_public_schema,
+)
 from .ingest import IngestError, load_corpus, max_rows as corpus_max_rows, suggest_text_column
 from .models import AdminAudit, Construct, Corpus, Invite, Job, Project, RoleAssignment, User
 from .reproducibility import (
@@ -104,6 +112,7 @@ async def lifespan(_: FastAPI):
     """Create tables and sync the construct library (YAML source of truth) at startup."""
     Base.metadata.create_all(engine)
     auto_migrate_sqlite(engine, Base.metadata)  # additive column adds for existing dev DBs
+    lock_down_public_schema(engine, Base.metadata)  # Supabase: RLS on, REST surface closed
     registry.list_models()  # fail fast on an invalid models.yaml
     db = SessionLocal()
     try: