2 Commits

Author	SHA1	Message	Date
belviskhoremk	aacb9dca12	fix: scope GRANT statements to match actual RLS-permitted access per role ... Replace the blanket select/insert/update/delete grant to anon/authenticated/ service_role with privilege-scoped grants: anon/authenticated get select-only on the public-read tables plus insert-only on bookings/inquiries; full CRUD is reserved for authenticated (narrowed to the admin UID by RLS) and service_role. Table grants are now a real second layer of defense instead of mirroring RLS. Updates two pgTAP assertions whose blocking mechanism moved from RLS-filtered-empty to grant-level permission-denied, and adds a new assertion proving anon cannot UPDATE bookings. Claude-Session: https://claude.ai/code/session_01NhxA4npAXAxmCDEJt6kxSH	2026-08-08 13:08:55 +00:00
belviskhoremk	5e3a77fc70	feat: add booked_slots sync trigger and pgTAP RLS/trigger tests ... Includes explicit GRANTs for anon/authenticated/service_role on all public tables: the Supabase CLI's current default no longer auto-exposes new tables, so RLS policies from the initial schema were unreachable without them (every request failed at the privilege check before RLS was evaluated).	2026-08-08 13:01:08 +00:00