Unable to test RLS from JWT custom claims (RBAC & multi tenancy on local development)
RLSCLIPostgRESTauthIntro
I found this good guide to properly develop on Supabase (local development first)
https://supabase.com/blog/the-vibe-coders-guide-to-supabase-environments
We started to develop using migrations that they apply on
stagingprodThis is were this approach started to make dev experience tought when adding features for our applicacion based on official supabase documentation.
Implementing RBAC or Tenant Awareness
https://supabase.com/docs/guides/database/postgres/custom-claims-and-role-based-access-control-rbac#accessing-custom-claims-in-rls-policies
I.E.: You want JWT based multi tenancy using RLS
-- 1. Restrictive Tenant Guard
An authenticated user has
organization_idcustom_access_token_hookThis safe RLS is applied on the table as an AND op so the authenticated user can only interact with rows on the table with the same
organization_idSo, the problem is if you impersonate a user on supabase dashboard, those RLS that evaluates
auth.jwt()select auth.jwt()custom_acess_token_hookBut Custom Claims are available on the API.
How is the right approach to follow supabase documentation and being able to properly test your features on local development before pushing to staging or production?
I find very misleading to follow documentation and get an uneven dead end like this in terms of dev experience.
