test-as-user

You can test Supabase Row Level Security (RLS) policies by emulating authenticated users and executing queries in an interactive psql session. This approach validates whether SELECT, INSERT, UPDATE, and DELETE operations are correctly permitted or denied based on user roles and data ownership.

Yes, you can emulate 'anon', 'authenticated', and 'service_role' users for RLS testing. The emulation sets specific session claims to verify that your database security policies correctly restrict or allow access for each distinct role.

The best way to validate RLS policies is through scenario-based testing in an interactive psql environment. By temporarily assuming a user's identity, you can execute operations to confirm they can only view, update, and delete their own records before deployment.

Testing RLS policies with emulated users is not intended for production environments. The Skill includes explicit security warnings against production use, meaning you should restrict scenario-based policy validation to development or staging databases to prevent unauthorized access.

To check if a user is blocked from accessing other records in PostgreSQL, emulate that authenticated user and attempt cross-record operations. The RLS policy testing will confirm whether the database correctly denies access to data not owned by the emulated session.