fix(database): make title-word policy explicitly backend-only

[BigSimmo]

Summary

• Add an idempotent service_role-only RLS policy for public.document_title_words while retaining revoked privileges for public, anon, and authenticated.
• Preserve the existing public-title synchronization trigger, indexed-public corpus invariant, and service-role-only query corrector behavior.
• Update the schema mirror, regenerated drift manifest, focused schema coverage, and advisor disposition documentation.

RAG impact: no retrieval behaviour change — the corrector SQL, trigger logic, ranking, and public-title scope are unchanged; this only makes the existing backend-only RLS posture explicit.

Verification

• npm run verify:pr-local
  • Runtime, changed-file formatting, lint, and TypeScript passed.
  • Vitest: 356 files passed; 3,164 tests passed and 1 skipped.
  • Offline RAG fixture validation passed: 36 golden cases across 21 suites.
  • Build correctly skipped because no build-affecting files changed.
• npm run drift:manifest
  • Disposable PostgreSQL 17.6 schema replay completed and the manifest records exactly one title-word policy addressed to service_role.
• npm run verify:ui — not run; no UI, routing, styling, or browser behavior changed.
• npm run verify:release — not run; this is not a release operation.
• npm run eval:retrieval:quality — not run; retrieval behavior is unchanged and the command is live/provider-backed.
• npm run check:production-readiness — not run; it is provider-backed and no live Supabase interaction was authorized.

Risk and rollout

• Risk: Low. The policy is metadata-only and addressed exclusively to service_role; browser roles still have neither table privileges nor a matching policy.
• Rollback: Use a reviewed forward migration to drop document title words service role all; the prior fail-closed ACL/RLS posture remains, but the advisor finding would return.
• Provider or production effects: None. No live migration, Supabase inspection, or production write was performed.

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked; no clinical decision-support behavior changed

Notes

• Live resolution of the advisor finding remains unverified until an explicitly approved migration apply and advisor rerun.

Summary by CodeRabbit

• Security
  • Restricted document-title word data access to approved backend operations.
  • Ensured browser and standard client roles cannot access or modify this data.
• Bug Fixes
  • Addressed the database security advisory for missing row-level access controls.
  • Updated security guidance to reflect the remediation and migration status.
• Tests
  • Added validation confirming the access restrictions and backend policy remain consistent.

[supabase]

Updates to Preview Branch (codex/chat-supabase-rls-title-words-0ef3) ↗︎

Deployments	Status	Updated
Database	✅	Wed, 22 Jul 2026 04:21:30 UTC
Services	✅	Wed, 22 Jul 2026 04:21:30 UTC
APIs	✅	Wed, 22 Jul 2026 04:21:30 UTC

Tasks are run on every commit but only new migration files are pushed.
Close and reopen this PR if you want to apply changes from existing seed or migration files.

Tasks	Status	Updated
Configurations	✅	Wed, 22 Jul 2026 04:21:33 UTC
Migrations	✅	Wed, 22 Jul 2026 04:21:35 UTC
Seeding	✅	Wed, 22 Jul 2026 04:21:36 UTC
Edge Functions	✅	Wed, 22 Jul 2026 04:21:39 UTC

---

View logs for this Workflow Run ↗︎.
Learn more about Supabase for Git ↗︎.

[coderabbitai]

Warning

Review limit reached

@BigSimmo, you've reached your PR review limit, so we couldn't start this review.

Next review available in:2 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 3434e871-ef12-46e2-ba49-abe10e115916

📥 Commits

Reviewing files that changed from the base of the PR and between 4e70085 and 38efe6d.

📒 Files selected for processing (1)

• tests/supabase-schema.test.ts

📝 Walkthrough

Walkthrough

Adds an explicit service-role-only RLS policy for public.document_title_words, revokes standard client access, updates the schema and drift manifest, and adds replay coverage plus maintenance guidance for the advisor finding.

Changes

Document title words backend policy

Layer / File(s)	Summary
Backend-only policy enforcement supabase/migrations/..., supabase/schema.sql, docs/db-maintenance.md	The migration and canonical schema enable RLS, revoke public, anon, and authenticated privileges, grant full service_role access, and document the pending remediation workflow.
Policy metadata and replay validation supabase/drift-manifest.json, tests/supabase-schema.test.ts	The regenerated manifest records the service-role policy, and replay tests verify RLS, privileges, and policy targets for both the schema and migration.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• BigSimmo/Database#868: Both changes modify public.document_title_words RLS and service-role access.

Suggested reviewers:claude

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the main change: making the title-word policy explicitly backend-only.
Description check	✅ Passed	The description matches the template well, with Summary, Verification, Risk and rollout, Clinical Governance Preflight, and Notes all present.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/chat-supabase-rls-title-words-0ef3

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/supabase-schema.test.ts`:
- Around line 1451-1468: Strengthen the test for public.document_title_words to
validate the complete policy and ACL state in both schema and migration
fixtures, not just expected substrings. Reuse the existing SQL replay mechanism
to inspect the resulting table policies and grants, and ensure no public, anon,
or authenticated policy or access remains alongside the service_role policy.
Remove the migration-only forbidden-role check once equivalent validation covers
both fixtures.

🪄 Autofix (Beta)

✅ Autofix completed

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 0e9c14b5-9366-4072-af8a-6f810ea5b174

📥 Commits

Reviewing files that changed from the base of the PR and between 9273fbe and 4e70085.

📒 Files selected for processing (5)

• docs/db-maintenance.md
• supabase/drift-manifest.json
• supabase/migrations/20260722110000_explicit_document_title_words_backend_policy.sql
• supabase/schema.sql
• tests/supabase-schema.test.ts

[coderabbitai]

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Fixes Applied Successfully

Fixed 1 file(s) based on 1 unresolved review comment.

Files modified:

• tests/supabase-schema.test.ts

Commit:af91a4ba1fe45b081b5f4e224df58a903b9476e4

The changes have been pushed to the codex/chat-supabase-rls-title-words-0ef3 branch.

Time taken:4m 57s