The Complete Production SOP: How to Deploy and Run Supabase RLS & Realtime Engine in Autonomous AI Agents

---
name: "cursor-supabase"
description: "Author secure Row Level Security (RLS) policies, Postgres functions, and Supabase client code."
category: "fullstack"
triggers:
  - "supabase migration"
  - "row level security"
  - "rls policy"
  - "supabase realtime"
dependencies:
  npm:
    - "@supabase/supabase-js"
---

# Supabase RLS & Realtime Engine Rules

1. Always generate deterministic migrations inside `supabase/migrations/<timestamp>_<name>.sql`.
2. Every `CREATE TABLE` statement MUST be immediately followed by `ALTER TABLE <table_name> ENABLE ROW LEVEL SECURITY;`.
3. Never author permissive `USING (true)` policies for authenticated roles unless explicitly tasked with a public read catalog.
4. Foreign key references matching `auth.uid()` MUST be indexed with B-tree indexes to prevent RLS-induced full table scans.
5. Verify policy coverage across ALL four operations: SELECT, INSERT, UPDATE, DELETE.

import { createClient } from '@supabase/supabase-js';

const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL || 'http://127.0.0.1:54321';
const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY || '';

if (!supabaseAnonKey && process.env.NODE_ENV === 'production') {
  throw new Error('Missing NEXT_PUBLIC_SUPABASE_ANON_KEY');
}

export const supabase = createClient(supabaseUrl, supabaseAnonKey);

BEGIN;
SELECT plan(3);

-- Test that RLS is enabled
SELECT tests.rls_enabled('public', 'organizations');
SELECT tests.rls_enabled('public', 'documents');

-- Verify unauthenticated user cannot read documents
SET ROLE anon;
SELECT is_empty('SELECT * FROM public.documents', 'Anon cannot view documents');

SELECT * FROM finish();
ROLLBACK;