DailyMath/Docs/migrations/001_disable_rls.sql at df8ee5dbf41feeafb519a82deb69c2d703615a5d · anju2246/DailyMath · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
-- ============================================================
-- Migration 001 — Disable RLS for academic project
-- Fecha: 2026-05-16
--
-- Contexto: DailyMath es proyecto de universidad. No requiere
-- aislamiento por usuario a nivel de fila. RLS solo agregaba
-- fricción para tests automatizados sin aportar valor a la rúbrica.
--
-- ⚠️ Esta migración hace TODAS las tablas accesibles para
-- lectura/escritura/borrado a cualquiera con la anon key del
-- proyecto. Aceptable solo en contexto académico (no público).
--
-- Ejecutar en: Supabase Dashboard → SQL Editor → Run.
-- Es idempotente (`if exists`), se puede correr varias veces.
-- ============================================================

-- ── 1. Drop policies ────────────────────────────────────────
drop policy if exists "Profiles readable by all"     on public.profiles;
drop policy if exists "Users update own profile"     on public.profiles;
drop policy if exists "Users insert own profile"     on public.profiles;

drop policy if exists "Exercises readable"           on public.exercises;
drop policy if exists "Users create exercises"       on public.exercises;
drop policy if exists "Authors/mods update"          on public.exercises;
drop policy if exists "Authors delete"               on public.exercises;

drop policy if exists "Votes readable"               on public.exercise_votes;
drop policy if exists "Users vote"                   on public.exercise_votes;
drop policy if exists "Users unvote"                 on public.exercise_votes;

drop policy if exists "Comments readable"            on public.comments;
drop policy if exists "Users comment"                on public.comments;
drop policy if exists "Authors delete comment"       on public.comments;

drop policy if exists "Users see own flashcards"     on public.flashcards;
drop policy if exists "Users create flashcards"      on public.flashcards;
drop policy if exists "Users update flashcards"      on public.flashcards;
drop policy if exists "Users delete flashcards"      on public.flashcards;

drop policy if exists "Users see own notifications"  on public.notifications;
drop policy if exists "System insert notifications"  on public.notifications;
drop policy if exists "Users mark read"              on public.notifications;

drop policy if exists "Anyone sees waiting duels"    on public.duels;
drop policy if exists "Users create duels"           on public.duels;
drop policy if exists "Players update duels"         on public.duels;

drop policy if exists "Players see questions"        on public.duel_questions;
drop policy if exists "Anyone insert questions"      on public.duel_questions;
drop policy if exists "Anyone update questions"      on public.duel_questions;

drop policy if exists "Tournaments readable"         on public.tournaments;
drop policy if exists "Admins manage tournaments"    on public.tournaments;

drop policy if exists "Participants readable"        on public.tournament_participants;
drop policy if exists "Users join tournaments"       on public.tournament_participants;
drop policy if exists "Users update their score"     on public.tournament_participants;

drop policy if exists "Badges readable"              on public.user_badges;
drop policy if exists "System grants badges"         on public.user_badges;

-- ── 2. Disable row level security on every table ────────────
alter table public.profiles                disable row level security;
alter table public.exercises               disable row level security;
alter table public.exercise_votes          disable row level security;
alter table public.comments                disable row level security;
alter table public.flashcards              disable row level security;
alter table public.notifications           disable row level security;
alter table public.duels                   disable row level security;
alter table public.duel_questions          disable row level security;
alter table public.tournaments             disable row level security;
alter table public.tournament_participants disable row level security;
alter table public.user_badges             disable row level security;

-- ── 3. Storage policies (mantener public read) ──────────────
-- Las storage policies necesitan permitir uploads/deletes sin auth
-- para que tests puedan subir imágenes de ejercicios test.
drop policy if exists "Auth users upload images" on storage.objects;
drop policy if exists "Authors delete images"    on storage.objects;
create policy "Anyone upload exercise images"  on storage.objects
  for insert with check (bucket_id = 'exercise-images');
create policy "Anyone delete exercise images"  on storage.objects
  for delete using (bucket_id = 'exercise-images');

-- ── 4. Verificación ─────────────────────────────────────────
-- Después de correr, deberías poder hacer:
--   select * from public.profiles limit 1;
-- con la anon key y obtener filas sin login.