Secure workspace Supabase tables with RLS

[bpnace]

Motivation

• The repository created workspace tables in the public schema without Row-Level Security (RLS) or policies while a browser Supabase anon client is initialized, exposing sensitive tenant data via the Supabase REST API.
• The change locks down direct table access at the database level so browser anon keys cannot bypass server-side requireWorkspaceAccess() guards.

Description

• Added a new Drizzle migration drizzle/0004_lock_workspace_rls.sql that defines security-definer helper functions (workspace_membership_role, is_workspace_member, can_manage_workspace, and lookup helpers) to evaluate auth.uid()-based membership and org relationships.
• The migration enables RLS on workspace tables and briefs, revokes broad anon/authenticated privileges, and re-grants constrained privileges so access is enforced by policies.
• Tenant-scoped CREATE POLICY statements were added for organizations, memberships, invites, brand_profiles, campaigns, campaign_stages, assets, review_threads, comments, and briefs to permit member/admin or author-scoped operations as appropriate.
• Registered the migration in the Drizzle journal (drizzle/meta/_journal.json).

Testing

• Static checks: an rg search and a Node script verified every workspace table has ALTER TABLE ... ENABLE ROW LEVEL SECURITY and at least one policy in drizzle/0004_lock_workspace_rls.sql, and table privilege revocation is present, all passing.
• Lint: ran pnpm lint and it completed successfully with no new errors.
• Unit tests: ran pnpm test and all tests passed (15 files, 54 tests reported as passed) and coverage ran as part of the test run.
• Typecheck: ran pnpm typecheck and route/type generation plus tsc completed successfully.

---

Codex Task