rls-patterns

Enforce Row Level Security patterns for Prisma queries and API routes.

395|84|Updated Oct 5, 2025

Search Tags:#context #security #isolation #rls #prisma

Ready to run

npx skills add https://github.com/bybren-llc/wtfb-safe-agentic-workflow --skill rls-patterns

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: rls-patterns
Source: https://github.com/bybren-llc/wtfb-safe-agentic-workflow/tree/main/.claude/skills/rls-patterns
Command: npx skills add https://github.com/bybren-llc/wtfb-safe-agentic-workflow --skill rls-patterns

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Enforce Row Level Security patterns for all DB operations to prevent data leakage.

Core Features & Use Cases

Context Wrappers: withUserContext/withAdminContext/withSystemContext
Admin/System access: admin and system contexts
Development Guidance: Admin pages must force runtime rendering
Tables with RLS: policy by table

Quick Start

Wrap data access with withUserContext for user-specific queries

Frequently Asked Questions about rls-patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent cross-user data access in Prisma queries?▼

Row Level Security (RLS) patterns enforce data isolation by wrapping Prisma queries with context helpers—withUserContext, withAdminContext, or withSystemContext—that automatically scope database operations to the appropriate user, admin, or system level, preventing unauthorized data leakage across user boundaries.

What tables need RLS protection in a multi-tenant application?▼

RLS applies to user-specific data tables including user profiles, payments, subscriptions, and enrollments, plus admin and system tables. Each table requires a defined security policy to ensure operations respect the calling context and prevent cross-tenant or privilege-escalation access.

Can I make direct Prisma calls in API routes that handle user data?▼

No. RLS patterns forbid direct Prisma calls in API routes, webhook handlers, and data-access layers. All database operations must route through context wrappers to guarantee policy-compliant isolation and prevent accidental data exposure.

How do I enforce RLS patterns automatically in my codebase?▼

ESLint-based enforcement detects violations of RLS patterns, flagging direct Prisma calls and improper context usage. Combined with runtime rendering requirements for admin pages, this dual-layer approach ensures Row Level Security policies stay applied throughout development and production.

Do webhook handlers need the same RLS context protection as API routes?▼

Yes. Webhook handlers that write to the database must wrap operations with the appropriate context helper—withSystemContext for webhooks triggered by external events—to maintain consistent data isolation and prevent database writes outside the intended security scope.

What's the difference between withUserContext, withAdminContext, and withSystemContext?▼

withUserContext scopes queries to a specific user's data, withAdminContext grants privileged read/write access for administrative operations, and withSystemContext allows system-level background tasks to interact with data without user or admin constraints, each enforcing distinct RLS boundaries.