RLS Isolation Validation Drill
Drill validacion RLS / Validacion RLS dos empresas local. El drill mantiene Referencias env-only, Sin custodia de fondos yPendiente de revision previa. Aun falta capturar evidencia RLS sanitizada.
- Drill validacion RLS
- Validacion RLS dos empresas local
- Evidencia RLS pendiente
- Preflight RLS T-057 registrado
- Preparacion Supabase local
- Docker CLI disponible, engine pendiente
- Supabase CLI disponible
- Supabase local pendiente
- Validacion RLS pendiente
- Requerido no confirmado
- Supabase local requerido
- .\\local.cmd doctor
- .\\local.cmd rls-t057
- .\\local.cmd rls-t057-live
- supabase start
- bellezapro_allow_own_company_read
- bellezapro_deny_cross_company_read
- Referencias env-only
- Sin custodia de fondos
- Pendiente de revision previa
Diagnostico local alternativo
| Control | Estado |
|---|---|
| Docker Engine | Docker CLI disponible, engine pendiente |
| Supabase CLI | Supabase CLI disponible |
| Supabase local | Supabase local pendiente |
| RLS live validation | Validacion RLS pendiente |
Comandos ejecucion T-057
| Comando | Resultado esperado | Estado |
|---|---|---|
| .\local.cmd rls-t057 | t-057 local pack shows preflight, manual commands, evidence cases and blocked decisions | required before rls execution |
| .\local.cmd doctor | supabase local available only when docker engine is running | required before rls execution |
| docker info | docker server responds without pipe or permission errors | required before rls execution |
| supabase start | local supabase services are available | required when docker available |
| supabase migration up | growth platform rls migration applied locally | required when supabase local available |
| .\local.cmd rls-t057-live | bellezapro allow/deny, comparison allow and client write denied evidence are produced locally | required when supabase local available |
| npm.cmd test -- tests/supabase-schema.test.js | static migration assertions pass | required before security gate review |
Evidencia esperada T-057
| Evidencia | Decision esperada | Estado |
|---|---|---|
| bellezapro_allow_own_company_read | allow own company read | pending supabase local |
| bellezapro_deny_cross_company_read | deny cross company read | pending supabase local |
| comparison_allow_own_company_read | allow own company read | pending supabase local |
| client_write_denied | deny client write | pending supabase local |
Casos allow deny RLS
| Caso | Actor | Target | Decision esperada | Estado |
|---|---|---|---|---|
| select_growth_company_rows | rls_actor_company_client_demo | Cliente Demo | allow own company read | ready for supabase local execution |
| select_growth_company_rows | rls_actor_company_client_demo | AltiroPay | deny cross company read | ready for supabase local execution |
| select_growth_company_rows | rls_actor_company_internal | AltiroPay | allow own company read | ready for supabase local execution |
| select_growth_company_rows | rls_actor_company_internal | Cliente Demo | deny cross company read | ready for supabase local execution |
| insert_growth_provider_account | rls_actor_company_client_demo | Cliente Demo | deny client write | ready for supabase local execution |
| insert_growth_provider_account | rls_actor_company_internal | AltiroPay | deny client write | ready for supabase local execution |
Checklist SQL local
| Paso | Estado |
|---|---|
| Apply growth platform RLS migration in Supabase local | required when docker available |
| Seed two authenticated users mapped to two company memberships | required when supabase local available |
| Run own-company allow and cross-company deny select cases | Requerido antes de produccion |
| Confirm client viewers cannot mutate provider, payment or evidence rows | Requerido antes de produccion |
Evidencia RLS requerida
| Evidencia | Estado |
|---|---|
| Two users and two companies RLS result captured as sanitized evidence | Requerido antes de produccion |
| Security Gate Preflight rerun after RLS drill | Requerido antes de produccion |
| No cross-company rows visible in client portal or API evidence | Requerido antes de produccion |
Bloqueos
| Bloqueo | Estado |
|---|---|
| Aprobar RLS productivo | Pendiente de revision previa |
| Habilitar portal cliente publico | Pendiente de revision previa |
| Guardar credenciales crudas o secretos | Prohibido |