From 7718fd6e67e419f80d4b16cedeea775def48263d Mon Sep 17 00:00:00 2001 From: Rafael Winter Date: Fri, 27 Feb 2026 16:23:49 -0800 Subject: [PATCH 1/2] Migration to allow project members read profiles from requesting users --- ...icy_allow_read_profile_from_requesters.sql | 31 +++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 supabase/migrations/20260227161801_add_policy_allow_read_profile_from_requesters.sql diff --git a/supabase/migrations/20260227161801_add_policy_allow_read_profile_from_requesters.sql b/supabase/migrations/20260227161801_add_policy_allow_read_profile_from_requesters.sql new file mode 100644 index 000000000..f50d5260a --- /dev/null +++ b/supabase/migrations/20260227161801_add_policy_allow_read_profile_from_requesters.sql @@ -0,0 +1,31 @@ +-- ============================================================================ +-- RLS POLICY +-- ============================================================================ + +-- Drop policy if it exists to ensure idempotency +drop policy if exists "project members can read requesting user profile" + on public.profile; + +-- Allow authenticated users to read the profile of users who have sent +-- requests to projects the current user is linked to +-- Rationale: A profile should only be visible to authenticated users +-- when there is a legitimate relationship established via a request +-- tied to one of their projects. This prevents unrestricted profile +-- access while enabling necessary visibility within project context. +create policy "project members can read requesting user profile" + on public.profile + for select + to authenticated + using ( + exists ( + select 1 + from public.request r + where r.sender_profile_id = profile.id + and exists ( + select 1 + from public.profile_project_link ppl + where ppl.project_id = r.project_id + and ppl.profile_id = auth.uid() + ) + ) + ); \ No newline at end of file From 4e5a7e7edb8dad2f29d0e89a48f840446d5f70f7 Mon Sep 17 00:00:00 2001 From: Rafael Winter Date: Sat, 28 Feb 2026 07:07:39 -0800 Subject: [PATCH 2/2] Add comment line --- ...0227161801_add_policy_allow_read_profile_from_requesters.sql | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/supabase/migrations/20260227161801_add_policy_allow_read_profile_from_requesters.sql b/supabase/migrations/20260227161801_add_policy_allow_read_profile_from_requesters.sql index f50d5260a..245f21efd 100644 --- a/supabase/migrations/20260227161801_add_policy_allow_read_profile_from_requesters.sql +++ b/supabase/migrations/20260227161801_add_policy_allow_read_profile_from_requesters.sql @@ -1,7 +1,7 @@ -- ============================================================================ -- RLS POLICY -- ============================================================================ - +-- -- Drop policy if it exists to ensure idempotency drop policy if exists "project members can read requesting user profile" on public.profile;