debug-rls

# debug-rls Systematic methodology for debugging Row-Level Security issues in Butterbase. Uses role simulation (`as_role`/`as_user` parameters) to verify policy behavior without needing real user sessions. --- ## 1. Overview Row-Level Security (RLS) in Butterbase controls which rows each database role can see or modify. When RLS is misconfigured, users may see no data, too much data, or get unexpected errors on insert. This skill walks through a repeatable four-step process to identify and fix the root cause. Key principle: **MCP tools default to the service key (`bb_sk_...`), which bypasses all RLS**. Always use `as_role`/`as_user` to simulate the role your frontend actually uses. --- ## 2. Quick Diagnosis Match the symptom your user reports to the most likely cause before diving into the full protocol. | Symptom | Likely cause | |---------|-------------| | User sees no rows | RLS enabled but no policy for `butterbase_user` role | | User sees ALL rows | RLS not enabled on the table, or request uses service key (`bb_sk_`) | | Insert fails with `AUTH_RLS_POLICY_VIOLATION` | No INSERT policy, or `user_column` not auto-populated | | User sees other users' data | Policy USING expression is wrong, or user isolation not set up | | Anonymous user gets 403 | No policy for `butterbase_anon` role | | Works in MCP tools but not from frontend | MCP uses service key (bypasses RLS); frontend uses end-user JWT | --- ## 3. The Three Roles Butterbase automatically assigns a databa...