digital-boardgame-framework 0.8.1 → 0.8.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "digital-boardgame-framework",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "Foundation library for turn-based digital boardgames: deterministic engine plumbing, async multiplayer, agent-friendly bug triage.",
   "keywords": ["boardgame", "board-game", "multiplayer", "async-multiplayer", "turn-based", "game-framework", "supabase", "cloudflare-pages"],
   "author": "John Champaign",

package/supabase/schema.sql

@@ -59,9 +59,16 @@ create index if not exists dbf_reports_category on dbf_reports(category);
 create index if not exists dbf_reports_unresolved on dbf_reports(report_id) where resolution is null;
 create index if not exists dbf_reports_game on dbf_reports(game_id);
 
--- Row-level security: this library does its own auth via per-player tokens
--- looked up in dbf_games.tokens. Disable RLS or allow the service role only.
--- Do NOT expose these tables directly via PostgREST/anon-key — go through
--- your application's server-side endpoints (Cloudflare Pages Functions,
--- Supabase Edge Functions, etc.) which instantiate GameServer with the
--- service-role key.
+-- Row-level security — REQUIRED, not optional.
+-- These tables hold secrets (dbf_games.tokens), unredacted game state
+-- (dbf_snapshots.state — hidden hands!), and chat. All access goes through your
+-- server endpoints using the SERVICE-ROLE key, which BYPASSES RLS. Enabling RLS
+-- with NO policies therefore denies the public anon key everything (which is
+-- now in client bundles for Realtime) while the server keeps full access.
+-- Realtime *broadcast* doesn't touch these tables, so it's unaffected.
+-- WITHOUT this, anyone with the project URL + anon key can read tokens and
+-- everyone's hidden state. (Supabase flags it as rls_disabled_in_public.)
+alter table dbf_games     enable row level security;
+alter table dbf_snapshots enable row level security;
+alter table dbf_messages  enable row level security;
+alter table dbf_reports   enable row level security;