sinapse-ai 7.7.10 → 8.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude/CLAUDE.md +10 -10
- package/.claude/rules/agent-authority.md +7 -7
- package/.claude/rules/agent-memory-imports.md +3 -1
- package/.claude/rules/coderabbit-integration.md +1 -0
- package/.claude/rules/mandatory-delegation.md +10 -10
- package/.claude/rules/mcp-usage.md +1 -1
- package/.claude/rules/security-data-protection.md +2 -2
- package/.claude/rules/security-scanning.md +10 -0
- package/.claude/rules/tool-response-filtering.md +1 -0
- package/.sinapse-ai/data/entity-registry.yaml +823 -877
- package/.sinapse-ai/data/registry-update-log.jsonl +36 -0
- package/.sinapse-ai/data/rls-security-patterns.md +384 -0
- package/.sinapse-ai/data/sinapse-kb.md +1 -1
- package/.sinapse-ai/development/agents/analyst.md +2 -2
- package/.sinapse-ai/development/agents/product-lead/MEMORY.md +1 -1
- package/.sinapse-ai/development/agents/product-lead.md +4 -4
- package/.sinapse-ai/development/agents/project-lead.md +2 -2
- package/.sinapse-ai/development/agents/sprint-lead.md +3 -3
- package/.sinapse-ai/development/tasks/analyze-project-structure.md +3 -3
- package/.sinapse-ai/development/tasks/create-service.md +1 -1
- package/.sinapse-ai/development/tasks/create-worktree.md +1 -1
- package/.sinapse-ai/development/tasks/environment-bootstrap.md +1 -1
- package/.sinapse-ai/development/tasks/execute-epic-plan.md +5 -5
- package/.sinapse-ai/development/tasks/extract-patterns.md +1 -1
- package/.sinapse-ai/development/tasks/ids-governor.md +1 -1
- package/.sinapse-ai/development/tasks/init-project-status.md +1 -1
- package/.sinapse-ai/development/tasks/list-worktrees.md +1 -1
- package/.sinapse-ai/development/tasks/next.md +1 -1
- package/.sinapse-ai/development/tasks/patterns.md +1 -1
- package/.sinapse-ai/development/tasks/plan-create-context.md +1 -1
- package/.sinapse-ai/development/tasks/plan-create-implementation.md +1 -1
- package/.sinapse-ai/development/tasks/plan-execute-subtask.md +1 -1
- package/.sinapse-ai/development/tasks/qa-fix-issues.md +1 -1
- package/.sinapse-ai/development/tasks/remove-worktree.md +1 -1
- package/.sinapse-ai/development/tasks/setup-github.md +1 -1
- package/.sinapse-ai/development/tasks/setup-llm-routing.md +1 -1
- package/.sinapse-ai/development/tasks/setup-mcp-docker.md +1 -1
- package/.sinapse-ai/development/tasks/spec-assess-complexity.md +1 -1
- package/.sinapse-ai/development/tasks/spec-critique.md +1 -1
- package/.sinapse-ai/development/tasks/spec-gather-requirements.md +1 -1
- package/.sinapse-ai/development/tasks/spec-research-dependencies.md +1 -1
- package/.sinapse-ai/development/tasks/spec-write-spec.md +1 -1
- package/.sinapse-ai/development/tasks/story-checkpoint.md +1 -1
- package/.sinapse-ai/development/tasks/update-sinapse.md +1 -1
- package/.sinapse-ai/development/tasks/validate-tech-preset.md +1 -1
- package/.sinapse-ai/development/tasks/verify-subtask.md +1 -1
- package/.sinapse-ai/infrastructure/scripts/validate-codex-delegation.js +1 -1
- package/.sinapse-ai/install-manifest.yaml +78 -74
- package/README.md +341 -215
- package/bin/utils/staged-secret-scan.js +5 -0
- package/docs/architecture-overview.md +239 -0
- package/docs/community.md +2 -2
- package/docs/feature-process.md +162 -0
- package/docs/getting-started.md +115 -231
- package/docs/guides/agent-reference.md +203 -0
- package/docs/guides/{MEMORY-INTEGRATION.md → memory-integration.md} +2 -2
- package/docs/guides/{MEMORY-INTELLIGENCE-SYSTEM.md → memory-intelligence-system.md} +3 -3
- package/docs/guides/workflows-overview.md +282 -0
- package/docs/guiding-principles.md +188 -0
- package/docs/legal/license-clarification.md +120 -15
- package/docs/legal/privacy.md +93 -80
- package/docs/legal/terms.md +90 -103
- package/docs/{ORQX-PLAN.md → orqx-plan.md} +15 -15
- package/docs/pt/FEATURE_PROCESS.md +2 -2
- package/docs/pt/GUIDING-PRINCIPLES.md +2 -2
- package/docs/pt/community.md +2 -2
- package/docs/pt/roadmap.md +2 -2
- package/docs/pt/security.md +215 -79
- package/docs/roadmap.md +2 -2
- package/docs/security/{PR_SECURITY_CHECKLIST.md → pr-security-checklist.md} +1 -1
- package/docs/security.md +215 -79
- package/package.json +1 -1
- package/packages/installer/src/manifest-signature.js +194 -0
- package/squads/claude-code-mastery/agents/config-engineer.md +7 -7
- package/squads/claude-code-mastery/agents/hooks-architect.md +4 -4
- package/squads/claude-code-mastery/agents/mcp-integrator.md +6 -6
- package/squads/claude-code-mastery/agents/project-integrator.md +8 -8
- package/squads/claude-code-mastery/agents/roadmap-sentinel.md +7 -7
- package/squads/claude-code-mastery/agents/skill-craftsman.md +10 -10
- package/squads/claude-code-mastery/agents/swarm-orqx.md +4 -4
- package/squads/squad-brand/agents/brand-creative-engineer.md +1 -1
- package/squads/squad-brand/agents/brand-motion-vfx.md +1 -1
- package/squads/squad-brand/agents/brand-sonic-designer.md +1 -1
- package/squads/squad-brand/agents/brand-system-architect.md +2 -2
- package/docs/FEATURE_PROCESS.md +0 -93
- package/docs/GUIDING-PRINCIPLES.md +0 -95
- /package/docs/{CHANGELOG.md → changelog.md} +0 -0
- /package/docs/guides/{IDS-CONCEITOS-EXPLICADOS.md → ids-conceitos-explicados.md} +0 -0
- /package/docs/guides/{MEMORY-SYSTEM.md → memory-system.md} +0 -0
- /package/docs/security/{MANIFEST_SIGNING.md → manifest-signing.md} +0 -0
- /package/docs/{SQUAD-COMMANDS-REFERENCE.md → squad-commands-reference.md} +0 -0
|
@@ -574,3 +574,39 @@
|
|
|
574
574
|
{"timestamp":"2026-04-03T02:10:30.505Z","action":"change","path":".sinapse-ai/core/health-check/checks/project/constitution-consistency.js","trigger":"watcher"}
|
|
575
575
|
{"timestamp":"2026-04-03T02:10:30.506Z","action":"change","path":".sinapse-ai/product/templates/ide-rules/claude-rules.md","trigger":"watcher"}
|
|
576
576
|
{"timestamp":"2026-04-03T03:23:08.944Z","action":"change","path":".sinapse-ai/development/agents/sinapse-orqx.md","trigger":"watcher"}
|
|
577
|
+
{"timestamp":"2026-04-03T07:21:28.300Z","action":"add","path":".sinapse-ai/data/rls-security-patterns.md","trigger":"watcher"}
|
|
578
|
+
{"timestamp":"2026-04-03T07:21:28.300Z","action":"change","path":".sinapse-ai/development/agents/analyst.md","trigger":"watcher"}
|
|
579
|
+
{"timestamp":"2026-04-03T07:21:28.301Z","action":"change","path":".sinapse-ai/development/agents/product-lead.md","trigger":"watcher"}
|
|
580
|
+
{"timestamp":"2026-04-03T07:21:28.301Z","action":"change","path":".sinapse-ai/development/agents/product-lead/MEMORY.md","trigger":"watcher"}
|
|
581
|
+
{"timestamp":"2026-04-03T07:21:28.302Z","action":"change","path":".sinapse-ai/development/agents/project-lead.md","trigger":"watcher"}
|
|
582
|
+
{"timestamp":"2026-04-03T07:21:28.302Z","action":"change","path":".sinapse-ai/development/agents/sprint-lead.md","trigger":"watcher"}
|
|
583
|
+
{"timestamp":"2026-04-03T15:12:00.693Z","action":"change","path":".sinapse-ai/development/tasks/analyze-project-structure.md","trigger":"watcher"}
|
|
584
|
+
{"timestamp":"2026-04-03T15:12:00.694Z","action":"change","path":".sinapse-ai/development/tasks/create-service.md","trigger":"watcher"}
|
|
585
|
+
{"timestamp":"2026-04-03T15:12:00.694Z","action":"change","path":".sinapse-ai/development/tasks/create-worktree.md","trigger":"watcher"}
|
|
586
|
+
{"timestamp":"2026-04-03T15:12:00.695Z","action":"change","path":".sinapse-ai/development/tasks/environment-bootstrap.md","trigger":"watcher"}
|
|
587
|
+
{"timestamp":"2026-04-03T15:12:00.695Z","action":"change","path":".sinapse-ai/development/tasks/execute-epic-plan.md","trigger":"watcher"}
|
|
588
|
+
{"timestamp":"2026-04-03T15:12:00.696Z","action":"change","path":".sinapse-ai/development/tasks/extract-patterns.md","trigger":"watcher"}
|
|
589
|
+
{"timestamp":"2026-04-03T15:12:00.696Z","action":"change","path":".sinapse-ai/development/tasks/ids-governor.md","trigger":"watcher"}
|
|
590
|
+
{"timestamp":"2026-04-03T15:12:00.696Z","action":"change","path":".sinapse-ai/development/tasks/init-project-status.md","trigger":"watcher"}
|
|
591
|
+
{"timestamp":"2026-04-03T15:12:00.696Z","action":"change","path":".sinapse-ai/development/tasks/list-worktrees.md","trigger":"watcher"}
|
|
592
|
+
{"timestamp":"2026-04-03T15:12:00.697Z","action":"change","path":".sinapse-ai/development/tasks/next.md","trigger":"watcher"}
|
|
593
|
+
{"timestamp":"2026-04-03T15:12:00.697Z","action":"change","path":".sinapse-ai/development/tasks/patterns.md","trigger":"watcher"}
|
|
594
|
+
{"timestamp":"2026-04-03T15:12:00.697Z","action":"change","path":".sinapse-ai/development/tasks/plan-create-context.md","trigger":"watcher"}
|
|
595
|
+
{"timestamp":"2026-04-03T15:12:00.698Z","action":"change","path":".sinapse-ai/development/tasks/plan-create-implementation.md","trigger":"watcher"}
|
|
596
|
+
{"timestamp":"2026-04-03T15:12:00.698Z","action":"change","path":".sinapse-ai/development/tasks/plan-execute-subtask.md","trigger":"watcher"}
|
|
597
|
+
{"timestamp":"2026-04-03T15:12:00.699Z","action":"change","path":".sinapse-ai/development/tasks/qa-fix-issues.md","trigger":"watcher"}
|
|
598
|
+
{"timestamp":"2026-04-03T15:12:00.699Z","action":"change","path":".sinapse-ai/development/tasks/remove-worktree.md","trigger":"watcher"}
|
|
599
|
+
{"timestamp":"2026-04-03T15:12:00.699Z","action":"change","path":".sinapse-ai/development/tasks/setup-github.md","trigger":"watcher"}
|
|
600
|
+
{"timestamp":"2026-04-03T15:12:00.700Z","action":"change","path":".sinapse-ai/development/tasks/setup-llm-routing.md","trigger":"watcher"}
|
|
601
|
+
{"timestamp":"2026-04-03T15:12:00.700Z","action":"change","path":".sinapse-ai/development/tasks/setup-mcp-docker.md","trigger":"watcher"}
|
|
602
|
+
{"timestamp":"2026-04-03T15:12:00.700Z","action":"change","path":".sinapse-ai/development/tasks/spec-assess-complexity.md","trigger":"watcher"}
|
|
603
|
+
{"timestamp":"2026-04-03T15:12:00.701Z","action":"change","path":".sinapse-ai/development/tasks/spec-critique.md","trigger":"watcher"}
|
|
604
|
+
{"timestamp":"2026-04-03T15:12:00.701Z","action":"change","path":".sinapse-ai/development/tasks/spec-gather-requirements.md","trigger":"watcher"}
|
|
605
|
+
{"timestamp":"2026-04-03T15:12:00.701Z","action":"change","path":".sinapse-ai/development/tasks/spec-research-dependencies.md","trigger":"watcher"}
|
|
606
|
+
{"timestamp":"2026-04-03T15:12:00.701Z","action":"change","path":".sinapse-ai/development/tasks/spec-write-spec.md","trigger":"watcher"}
|
|
607
|
+
{"timestamp":"2026-04-03T15:12:00.702Z","action":"change","path":".sinapse-ai/development/tasks/story-checkpoint.md","trigger":"watcher"}
|
|
608
|
+
{"timestamp":"2026-04-03T15:12:00.702Z","action":"change","path":".sinapse-ai/development/tasks/update-sinapse.md","trigger":"watcher"}
|
|
609
|
+
{"timestamp":"2026-04-03T15:12:00.702Z","action":"change","path":".sinapse-ai/development/tasks/validate-tech-preset.md","trigger":"watcher"}
|
|
610
|
+
{"timestamp":"2026-04-03T15:12:00.702Z","action":"change","path":".sinapse-ai/development/tasks/verify-subtask.md","trigger":"watcher"}
|
|
611
|
+
{"timestamp":"2026-04-03T15:13:09.088Z","action":"change","path":".sinapse-ai/data/sinapse-kb.md","trigger":"watcher"}
|
|
612
|
+
{"timestamp":"2026-04-03T17:07:46.494Z","action":"change","path":".sinapse-ai/infrastructure/scripts/validate-codex-delegation.js","trigger":"watcher"}
|
|
@@ -0,0 +1,384 @@
|
|
|
1
|
+
# RLS Security Patterns Reference
|
|
2
|
+
|
|
3
|
+
> Standalone reference for @data-engineer (Tensor)
|
|
4
|
+
> Constitution Article X -- Security and Data Protection
|
|
5
|
+
|
|
6
|
+
---
|
|
7
|
+
|
|
8
|
+
## What is RLS
|
|
9
|
+
|
|
10
|
+
Row Level Security (RLS) is a database feature that restricts which rows a user can access in a table. In Supabase and PostgreSQL, RLS policies are the primary mechanism for data isolation between users, organizations, and roles.
|
|
11
|
+
|
|
12
|
+
**Rule:** Every table that stores user data MUST have RLS enabled. No exceptions.
|
|
13
|
+
|
|
14
|
+
---
|
|
15
|
+
|
|
16
|
+
## Pattern 1: Basic User Isolation
|
|
17
|
+
|
|
18
|
+
The most common pattern. Each user can only see and modify their own data.
|
|
19
|
+
|
|
20
|
+
```sql
|
|
21
|
+
-- Enable RLS on the table
|
|
22
|
+
ALTER TABLE user_profiles ENABLE ROW LEVEL SECURITY;
|
|
23
|
+
|
|
24
|
+
-- Policy: users can only read their own rows
|
|
25
|
+
CREATE POLICY "users_read_own_data"
|
|
26
|
+
ON user_profiles
|
|
27
|
+
FOR SELECT
|
|
28
|
+
USING (auth.uid() = user_id);
|
|
29
|
+
|
|
30
|
+
-- Policy: users can only insert rows with their own user_id
|
|
31
|
+
CREATE POLICY "users_insert_own_data"
|
|
32
|
+
ON user_profiles
|
|
33
|
+
FOR INSERT
|
|
34
|
+
WITH CHECK (auth.uid() = user_id);
|
|
35
|
+
|
|
36
|
+
-- Policy: users can only update their own rows
|
|
37
|
+
CREATE POLICY "users_update_own_data"
|
|
38
|
+
ON user_profiles
|
|
39
|
+
FOR UPDATE
|
|
40
|
+
USING (auth.uid() = user_id)
|
|
41
|
+
WITH CHECK (auth.uid() = user_id);
|
|
42
|
+
|
|
43
|
+
-- Policy: users can only delete their own rows
|
|
44
|
+
CREATE POLICY "users_delete_own_data"
|
|
45
|
+
ON user_profiles
|
|
46
|
+
FOR DELETE
|
|
47
|
+
USING (auth.uid() = user_id);
|
|
48
|
+
```
|
|
49
|
+
|
|
50
|
+
**When to use:** Personal data, user settings, individual records.
|
|
51
|
+
|
|
52
|
+
**Key point:** Always include both `USING` (which rows to read) and `WITH CHECK` (which rows to write) on UPDATE policies.
|
|
53
|
+
|
|
54
|
+
---
|
|
55
|
+
|
|
56
|
+
## Pattern 2: Organization-Based Access
|
|
57
|
+
|
|
58
|
+
Users belong to organizations and can see all data within their organization.
|
|
59
|
+
|
|
60
|
+
```sql
|
|
61
|
+
ALTER TABLE projects ENABLE ROW LEVEL SECURITY;
|
|
62
|
+
|
|
63
|
+
-- Policy: users can see projects in their organization
|
|
64
|
+
CREATE POLICY "org_members_read_projects"
|
|
65
|
+
ON projects
|
|
66
|
+
FOR SELECT
|
|
67
|
+
USING (
|
|
68
|
+
organization_id IN (
|
|
69
|
+
SELECT org_id FROM organization_members
|
|
70
|
+
WHERE member_user_id = auth.uid()
|
|
71
|
+
)
|
|
72
|
+
);
|
|
73
|
+
|
|
74
|
+
-- Policy: users can create projects in their organization
|
|
75
|
+
CREATE POLICY "org_members_create_projects"
|
|
76
|
+
ON projects
|
|
77
|
+
FOR INSERT
|
|
78
|
+
WITH CHECK (
|
|
79
|
+
organization_id IN (
|
|
80
|
+
SELECT org_id FROM organization_members
|
|
81
|
+
WHERE member_user_id = auth.uid()
|
|
82
|
+
)
|
|
83
|
+
);
|
|
84
|
+
```
|
|
85
|
+
|
|
86
|
+
**Performance tip:** Use a security definer function to avoid repeated subqueries:
|
|
87
|
+
|
|
88
|
+
```sql
|
|
89
|
+
-- Helper function (runs with elevated privileges)
|
|
90
|
+
CREATE OR REPLACE FUNCTION auth.user_org_ids()
|
|
91
|
+
RETURNS SETOF uuid
|
|
92
|
+
LANGUAGE sql
|
|
93
|
+
SECURITY DEFINER
|
|
94
|
+
STABLE
|
|
95
|
+
AS $$
|
|
96
|
+
SELECT org_id FROM organization_members
|
|
97
|
+
WHERE member_user_id = auth.uid()
|
|
98
|
+
$$;
|
|
99
|
+
|
|
100
|
+
-- Simplified policy using the helper
|
|
101
|
+
CREATE POLICY "org_members_read_projects"
|
|
102
|
+
ON projects
|
|
103
|
+
FOR SELECT
|
|
104
|
+
USING (organization_id IN (SELECT auth.user_org_ids()));
|
|
105
|
+
```
|
|
106
|
+
|
|
107
|
+
**When to use:** Multi-tenant applications, team workspaces, shared resources.
|
|
108
|
+
|
|
109
|
+
---
|
|
110
|
+
|
|
111
|
+
## Pattern 3: Role-Based Access
|
|
112
|
+
|
|
113
|
+
Different roles within an organization have different access levels.
|
|
114
|
+
|
|
115
|
+
```sql
|
|
116
|
+
ALTER TABLE documents ENABLE ROW LEVEL SECURITY;
|
|
117
|
+
|
|
118
|
+
-- Admins can do everything
|
|
119
|
+
CREATE POLICY "admins_full_access"
|
|
120
|
+
ON documents
|
|
121
|
+
FOR ALL
|
|
122
|
+
USING (
|
|
123
|
+
EXISTS (
|
|
124
|
+
SELECT 1 FROM organization_members
|
|
125
|
+
WHERE member_user_id = auth.uid()
|
|
126
|
+
AND org_id = documents.organization_id
|
|
127
|
+
AND role = 'admin'
|
|
128
|
+
)
|
|
129
|
+
);
|
|
130
|
+
|
|
131
|
+
-- Editors can read and update, but not delete
|
|
132
|
+
CREATE POLICY "editors_read_update"
|
|
133
|
+
ON documents
|
|
134
|
+
FOR SELECT
|
|
135
|
+
USING (
|
|
136
|
+
EXISTS (
|
|
137
|
+
SELECT 1 FROM organization_members
|
|
138
|
+
WHERE member_user_id = auth.uid()
|
|
139
|
+
AND org_id = documents.organization_id
|
|
140
|
+
AND role IN ('admin', 'editor')
|
|
141
|
+
)
|
|
142
|
+
);
|
|
143
|
+
|
|
144
|
+
CREATE POLICY "editors_update"
|
|
145
|
+
ON documents
|
|
146
|
+
FOR UPDATE
|
|
147
|
+
USING (
|
|
148
|
+
EXISTS (
|
|
149
|
+
SELECT 1 FROM organization_members
|
|
150
|
+
WHERE member_user_id = auth.uid()
|
|
151
|
+
AND org_id = documents.organization_id
|
|
152
|
+
AND role IN ('admin', 'editor')
|
|
153
|
+
)
|
|
154
|
+
);
|
|
155
|
+
|
|
156
|
+
-- Viewers can only read
|
|
157
|
+
CREATE POLICY "viewers_read"
|
|
158
|
+
ON documents
|
|
159
|
+
FOR SELECT
|
|
160
|
+
USING (
|
|
161
|
+
EXISTS (
|
|
162
|
+
SELECT 1 FROM organization_members
|
|
163
|
+
WHERE member_user_id = auth.uid()
|
|
164
|
+
AND org_id = documents.organization_id
|
|
165
|
+
AND role IN ('admin', 'editor', 'viewer')
|
|
166
|
+
)
|
|
167
|
+
);
|
|
168
|
+
```
|
|
169
|
+
|
|
170
|
+
**When to use:** Applications with distinct permission levels (admin, editor, viewer).
|
|
171
|
+
|
|
172
|
+
**Key point:** Define policies from most restrictive to least restrictive. Each policy is OR-ed -- if any policy grants access, access is granted.
|
|
173
|
+
|
|
174
|
+
---
|
|
175
|
+
|
|
176
|
+
## Pattern 4: Public and Private Data
|
|
177
|
+
|
|
178
|
+
Some data is public (visible to all), while other data is private.
|
|
179
|
+
|
|
180
|
+
```sql
|
|
181
|
+
ALTER TABLE posts ENABLE ROW LEVEL SECURITY;
|
|
182
|
+
|
|
183
|
+
-- Anyone can read published posts (including anonymous users)
|
|
184
|
+
CREATE POLICY "public_posts_readable"
|
|
185
|
+
ON posts
|
|
186
|
+
FOR SELECT
|
|
187
|
+
USING (status = 'published');
|
|
188
|
+
|
|
189
|
+
-- Authors can read their own drafts
|
|
190
|
+
CREATE POLICY "authors_read_own_drafts"
|
|
191
|
+
ON posts
|
|
192
|
+
FOR SELECT
|
|
193
|
+
USING (author_id = auth.uid());
|
|
194
|
+
|
|
195
|
+
-- Authors can update their own posts
|
|
196
|
+
CREATE POLICY "authors_update_own"
|
|
197
|
+
ON posts
|
|
198
|
+
FOR UPDATE
|
|
199
|
+
USING (author_id = auth.uid())
|
|
200
|
+
WITH CHECK (author_id = auth.uid());
|
|
201
|
+
```
|
|
202
|
+
|
|
203
|
+
**When to use:** Blogs, content platforms, marketplaces with public listings.
|
|
204
|
+
|
|
205
|
+
---
|
|
206
|
+
|
|
207
|
+
## Service Role Usage Guidelines
|
|
208
|
+
|
|
209
|
+
### What is service_role
|
|
210
|
+
|
|
211
|
+
The `service_role` key bypasses all RLS policies. It has full, unrestricted access to every row in every table.
|
|
212
|
+
|
|
213
|
+
### Rules
|
|
214
|
+
|
|
215
|
+
| Rule | Severity |
|
|
216
|
+
|------|----------|
|
|
217
|
+
| NEVER use service_role in frontend code | ABSOLUTE BLOCKER |
|
|
218
|
+
| NEVER expose service_role in client-side bundles | ABSOLUTE BLOCKER |
|
|
219
|
+
| Use service_role ONLY in server-side code | REQUIRED |
|
|
220
|
+
| Use service_role ONLY for admin operations | REQUIRED |
|
|
221
|
+
| Prefer anon key + RLS for all user-facing queries | REQUIRED |
|
|
222
|
+
|
|
223
|
+
### Appropriate Uses
|
|
224
|
+
|
|
225
|
+
```javascript
|
|
226
|
+
// SERVER-SIDE ONLY (Edge Functions, API routes, cron jobs)
|
|
227
|
+
|
|
228
|
+
// Admin dashboard: list all users (requires service_role)
|
|
229
|
+
const { data } = await supabaseAdmin
|
|
230
|
+
.from('user_profiles')
|
|
231
|
+
.select('id, email, created_at');
|
|
232
|
+
|
|
233
|
+
// System operations: clean up expired sessions
|
|
234
|
+
const { error } = await supabaseAdmin
|
|
235
|
+
.from('sessions')
|
|
236
|
+
.delete()
|
|
237
|
+
.lt('expires_at', new Date().toISOString());
|
|
238
|
+
```
|
|
239
|
+
|
|
240
|
+
### Inappropriate Uses (BLOCKED)
|
|
241
|
+
|
|
242
|
+
```javascript
|
|
243
|
+
// FRONTEND CODE -- NEVER DO THIS
|
|
244
|
+
import { createClient } from '@supabase/supabase-js';
|
|
245
|
+
|
|
246
|
+
// This exposes service_role to every user
|
|
247
|
+
const supabase = createClient(url, process.env.SUPABASE_SERVICE_ROLE_KEY);
|
|
248
|
+
```
|
|
249
|
+
|
|
250
|
+
---
|
|
251
|
+
|
|
252
|
+
## Common RLS Anti-Patterns
|
|
253
|
+
|
|
254
|
+
### 1. Forgetting to Enable RLS
|
|
255
|
+
|
|
256
|
+
```sql
|
|
257
|
+
-- Table created without RLS -- ALL data is public by default
|
|
258
|
+
CREATE TABLE sensitive_data (
|
|
259
|
+
id uuid PRIMARY KEY,
|
|
260
|
+
user_id uuid REFERENCES auth.users(id),
|
|
261
|
+
secret_info text
|
|
262
|
+
);
|
|
263
|
+
-- Missing: ALTER TABLE sensitive_data ENABLE ROW LEVEL SECURITY;
|
|
264
|
+
```
|
|
265
|
+
|
|
266
|
+
**Fix:** Always enable RLS immediately after CREATE TABLE.
|
|
267
|
+
|
|
268
|
+
### 2. Overly Permissive Policies
|
|
269
|
+
|
|
270
|
+
```sql
|
|
271
|
+
-- BAD: Allows any authenticated user to read ALL rows
|
|
272
|
+
CREATE POLICY "bad_policy"
|
|
273
|
+
ON user_data
|
|
274
|
+
FOR SELECT
|
|
275
|
+
USING (auth.uid() IS NOT NULL);
|
|
276
|
+
```
|
|
277
|
+
|
|
278
|
+
**Fix:** Always filter by user_id, org_id, or role.
|
|
279
|
+
|
|
280
|
+
### 3. Missing WITH CHECK on Write Policies
|
|
281
|
+
|
|
282
|
+
```sql
|
|
283
|
+
-- BAD: User can read own rows but insert rows for OTHER users
|
|
284
|
+
CREATE POLICY "incomplete_insert"
|
|
285
|
+
ON user_data
|
|
286
|
+
FOR INSERT
|
|
287
|
+
WITH CHECK (true); -- No restriction on who can insert what
|
|
288
|
+
```
|
|
289
|
+
|
|
290
|
+
**Fix:** Always include `WITH CHECK (auth.uid() = user_id)` on INSERT/UPDATE.
|
|
291
|
+
|
|
292
|
+
### 4. Using FOR ALL Without Thinking
|
|
293
|
+
|
|
294
|
+
```sql
|
|
295
|
+
-- DANGEROUS: Grants read + write + delete to everyone matching
|
|
296
|
+
CREATE POLICY "too_broad"
|
|
297
|
+
ON orders
|
|
298
|
+
FOR ALL
|
|
299
|
+
USING (customer_id = auth.uid());
|
|
300
|
+
```
|
|
301
|
+
|
|
302
|
+
**Concern:** Users can delete their own orders, which may not be desired.
|
|
303
|
+
|
|
304
|
+
**Fix:** Create separate policies for SELECT, INSERT, UPDATE, and DELETE.
|
|
305
|
+
|
|
306
|
+
### 5. N+1 Subquery Performance
|
|
307
|
+
|
|
308
|
+
```sql
|
|
309
|
+
-- SLOW: Runs a subquery for EVERY row
|
|
310
|
+
CREATE POLICY "slow_policy"
|
|
311
|
+
ON documents
|
|
312
|
+
FOR SELECT
|
|
313
|
+
USING (
|
|
314
|
+
organization_id IN (
|
|
315
|
+
SELECT org_id FROM org_members WHERE user_id = auth.uid()
|
|
316
|
+
)
|
|
317
|
+
);
|
|
318
|
+
```
|
|
319
|
+
|
|
320
|
+
**Fix:** Use a SECURITY DEFINER helper function (see Pattern 2) or a materialized view for complex access patterns.
|
|
321
|
+
|
|
322
|
+
---
|
|
323
|
+
|
|
324
|
+
## Testing RLS Policies
|
|
325
|
+
|
|
326
|
+
### Manual Testing with Role Switching
|
|
327
|
+
|
|
328
|
+
```sql
|
|
329
|
+
-- Test as a specific user
|
|
330
|
+
SET request.jwt.claim.sub = 'user-uuid-here';
|
|
331
|
+
SET role = 'authenticated';
|
|
332
|
+
|
|
333
|
+
-- Run a query -- should only return rows for that user
|
|
334
|
+
SELECT * FROM user_profiles;
|
|
335
|
+
|
|
336
|
+
-- Reset
|
|
337
|
+
RESET role;
|
|
338
|
+
RESET request.jwt.claim.sub;
|
|
339
|
+
```
|
|
340
|
+
|
|
341
|
+
### Automated Testing Approach
|
|
342
|
+
|
|
343
|
+
```javascript
|
|
344
|
+
// In Jest tests with Supabase client
|
|
345
|
+
describe('RLS Policies', () => {
|
|
346
|
+
it('user can only see own profile', async () => {
|
|
347
|
+
// Create client as User A
|
|
348
|
+
const clientA = createClient(url, anonKey, {
|
|
349
|
+
global: { headers: { Authorization: `Bearer ${tokenA}` } }
|
|
350
|
+
});
|
|
351
|
+
|
|
352
|
+
// Insert profile for User A
|
|
353
|
+
await clientA.from('profiles').insert({ user_id: userAId, name: 'A' });
|
|
354
|
+
|
|
355
|
+
// Create client as User B
|
|
356
|
+
const clientB = createClient(url, anonKey, {
|
|
357
|
+
global: { headers: { Authorization: `Bearer ${tokenB}` } }
|
|
358
|
+
});
|
|
359
|
+
|
|
360
|
+
// User B should NOT see User A's profile
|
|
361
|
+
const { data } = await clientB
|
|
362
|
+
.from('profiles')
|
|
363
|
+
.select('*')
|
|
364
|
+
.eq('user_id', userAId);
|
|
365
|
+
|
|
366
|
+
expect(data).toHaveLength(0);
|
|
367
|
+
});
|
|
368
|
+
});
|
|
369
|
+
```
|
|
370
|
+
|
|
371
|
+
### Verification Checklist
|
|
372
|
+
|
|
373
|
+
- [ ] Every table with user data has RLS enabled
|
|
374
|
+
- [ ] SELECT policies filter by user_id, org_id, or role
|
|
375
|
+
- [ ] INSERT policies use WITH CHECK to validate ownership
|
|
376
|
+
- [ ] UPDATE policies use both USING and WITH CHECK
|
|
377
|
+
- [ ] DELETE policies are intentionally scoped (not too broad)
|
|
378
|
+
- [ ] service_role is NOT referenced in any frontend file
|
|
379
|
+
- [ ] Helper functions use SECURITY DEFINER where needed
|
|
380
|
+
- [ ] Policies are tested with multiple user contexts
|
|
381
|
+
|
|
382
|
+
---
|
|
383
|
+
|
|
384
|
+
*Last updated: 2026-04-03*
|
|
@@ -838,7 +838,7 @@ For full details, see `CONTRIBUTING.md`. Key points:
|
|
|
838
838
|
- Atomic commits - one logical change per commit
|
|
839
839
|
- Must align with guiding principles
|
|
840
840
|
|
|
841
|
-
**Core Principles** (from docs/
|
|
841
|
+
**Core Principles** (from docs/guiding-principles.md):
|
|
842
842
|
|
|
843
843
|
- **Dev Agents Must Be Lean**: Minimize dependencies, save context for code
|
|
844
844
|
- **Natural Language First**: Everything in markdown, no code in core
|
|
@@ -224,7 +224,7 @@ Type `*help` to see all commands, or `*yolo` to skip confirmations.
|
|
|
224
224
|
**I collaborate with:**
|
|
225
225
|
|
|
226
226
|
- **@project-lead (Beacon):** Provides research and analysis to support PRD creation
|
|
227
|
-
- **@product-lead (
|
|
227
|
+
- **@product-lead (Axis):** Provides market insights and competitive analysis
|
|
228
228
|
|
|
229
229
|
**When to use others:**
|
|
230
230
|
|
|
@@ -266,6 +266,6 @@ Type `*help` to see all commands, or `*yolo` to skip confirmations.
|
|
|
266
266
|
### Related Agents
|
|
267
267
|
|
|
268
268
|
- **@project-lead (Beacon)** - Primary consumer of research
|
|
269
|
-
- **@product-lead (
|
|
269
|
+
- **@product-lead (Axis)** - May request market insights
|
|
270
270
|
|
|
271
271
|
---
|
|
@@ -51,7 +51,7 @@ activation-instructions:
|
|
|
51
51
|
- STAY IN CHARACTER!
|
|
52
52
|
- CRITICAL: On activation, ONLY greet user and then HALT to await user requested assistance or given commands. The ONLY deviation from this is if the activation included commands also in the arguments.
|
|
53
53
|
agent:
|
|
54
|
-
name:
|
|
54
|
+
name: Axis
|
|
55
55
|
id: product-lead
|
|
56
56
|
title: Product Owner
|
|
57
57
|
icon: 🎯
|
|
@@ -77,10 +77,10 @@ persona_profile:
|
|
|
77
77
|
|
|
78
78
|
greeting_levels:
|
|
79
79
|
minimal: '🎯 po Agent ready'
|
|
80
|
-
named: "🎯
|
|
81
|
-
archetypal: '🎯
|
|
80
|
+
named: "🎯 Axis (Balancer) ready. Let's prioritize together!"
|
|
81
|
+
archetypal: '🎯 Axis the Balancer ready to balance!'
|
|
82
82
|
|
|
83
|
-
signature_closing: '—
|
|
83
|
+
signature_closing: '— Axis, equilibrando prioridades 🎯'
|
|
84
84
|
|
|
85
85
|
persona:
|
|
86
86
|
role: Technical Product Owner & Process Steward
|
|
@@ -298,7 +298,7 @@ Type `*help` to see all commands, or `*yolo` to skip confirmations.
|
|
|
298
298
|
|
|
299
299
|
**I collaborate with:**
|
|
300
300
|
|
|
301
|
-
- **@product-lead (
|
|
301
|
+
- **@product-lead (Axis):** Provides PRDs and strategic direction to
|
|
302
302
|
- **@sprint-lead (Sync):** Coordinates on sprint planning and story breakdown
|
|
303
303
|
- **@architect (Stratum):** Works with on technical architecture decisions
|
|
304
304
|
|
|
@@ -369,7 +369,7 @@ Type `*help` to see all commands, or `*yolo` to skip confirmations.
|
|
|
369
369
|
### Related Agents
|
|
370
370
|
|
|
371
371
|
- **@analyst (Scope)** - Provides research and insights
|
|
372
|
-
- **@product-lead (
|
|
372
|
+
- **@product-lead (Axis)** - Receives PRDs and manages backlog
|
|
373
373
|
- **@architect (Stratum)** - Collaborates on technical decisions
|
|
374
374
|
|
|
375
375
|
---
|
|
@@ -207,7 +207,7 @@ Type `*help` to see all commands.
|
|
|
207
207
|
**I collaborate with:**
|
|
208
208
|
|
|
209
209
|
- **@developer (Pixel):** Assigns stories to, receives completion status from
|
|
210
|
-
- **@product-lead (
|
|
210
|
+
- **@product-lead (Axis):** Coordinates with on backlog and sprint planning
|
|
211
211
|
|
|
212
212
|
**I delegate to:**
|
|
213
213
|
|
|
@@ -254,7 +254,7 @@ Type `*help` to see all commands.
|
|
|
254
254
|
|
|
255
255
|
### Prerequisites
|
|
256
256
|
|
|
257
|
-
1. Backlog prioritized by @product-lead (
|
|
257
|
+
1. Backlog prioritized by @product-lead (Axis)
|
|
258
258
|
2. Story templates available
|
|
259
259
|
3. Story draft checklist accessible
|
|
260
260
|
4. Understanding of current sprint goals
|
|
@@ -278,7 +278,7 @@ Type `*help` to see all commands.
|
|
|
278
278
|
|
|
279
279
|
### Related Agents
|
|
280
280
|
|
|
281
|
-
- **@product-lead (
|
|
281
|
+
- **@product-lead (Axis)** - Provides backlog prioritization
|
|
282
282
|
- **@developer (Pixel)** - Implements stories
|
|
283
283
|
- **@github-devops (Pipeline)** - Handles push operations
|
|
284
284
|
|
|
@@ -31,7 +31,7 @@
|
|
|
31
31
|
|
|
32
32
|
```yaml
|
|
33
33
|
task: analyzeProjectStructure()
|
|
34
|
-
responsible: architect (
|
|
34
|
+
responsible: architect (Stratum)
|
|
35
35
|
responsible_type: Agent
|
|
36
36
|
atomic_layer: Analysis
|
|
37
37
|
elicit: true
|
|
@@ -405,7 +405,7 @@ Generate `docs/architecture/project-analysis.md`:
|
|
|
405
405
|
# Project Analysis: {feature_name}
|
|
406
406
|
|
|
407
407
|
**Generated:** {date}
|
|
408
|
-
**Generated By:** @architect (
|
|
408
|
+
**Generated By:** @architect (Stratum)
|
|
409
409
|
**Story:** WIS-15
|
|
410
410
|
|
|
411
411
|
---
|
|
@@ -470,7 +470,7 @@ Generate `docs/architecture/recommended-approach.md`:
|
|
|
470
470
|
# Recommended Approach: {feature_name}
|
|
471
471
|
|
|
472
472
|
**Generated:** {date}
|
|
473
|
-
**Generated By:** @architect (
|
|
473
|
+
**Generated By:** @architect (Stratum)
|
|
474
474
|
**Story:** WIS-15
|
|
475
475
|
|
|
476
476
|
---
|
|
@@ -870,11 +870,11 @@ This task is owned by:
|
|
|
870
870
|
- `@project-lead` (Morgan/Bob) - Primary orchestrator
|
|
871
871
|
|
|
872
872
|
This task spawns:
|
|
873
|
-
- `@product-lead` (
|
|
874
|
-
- `@developer` (
|
|
875
|
-
- `@architect` (
|
|
876
|
-
- `@devops` (
|
|
877
|
-
- `@quality-gate` (
|
|
873
|
+
- `@product-lead` (Axis) - Story validation, checkpoints
|
|
874
|
+
- `@developer` (Pixel) - Story implementation (via development-cycle)
|
|
875
|
+
- `@architect` (Stratum) - Wave gates, final gate
|
|
876
|
+
- `@devops` (Pipeline) - Branch merge, push
|
|
877
|
+
- `@quality-gate` (Litmus) - Quality gates (via development-cycle)
|
|
878
878
|
|
|
879
879
|
---
|
|
880
880
|
|