RLS Patterns Skill

Name: rls-patterns
Rating: 92
Author: bybren-llc

Purpose

Enforce Row Level Security (RLS) patterns for all database operations. Ensures data isolation and prevents cross-user data access.

When This Skill Applies

•Writing any Prisma database query
•Creating or modifying API routes that access the database
•Implementing webhook handlers
•Working with user data, payments, subscriptions

Critical Rules

NEVER Do This

typescript

// ❌ FORBIDDEN - Direct Prisma calls bypass RLS
const user = await prisma.user.findUnique({ where: { user_id } });

ALWAYS Do This

typescript

import { withUserContext, withAdminContext, withSystemContext } from "@/lib/rls-context";

// ✅ CORRECT - User context for user operations
const user = await withUserContext(prisma, userId, async (client) => {
  return client.user.findUnique({ where: { user_id: userId } });
});

// ✅ CORRECT - System context for webhooks
await withSystemContext(prisma, "webhook", async (client) => {
  return client.webhook_events.create({ data: eventData });
});

Context Helper Reference

Helper	Use For
`withUserContext`	User-facing operations (profile, payments, subscriptions)
`withAdminContext`	Admin-only operations (disputes, webhook events)
`withSystemContext`	Webhooks and background jobs

Common Patterns

API Route with User Context

typescript

export async function GET() {
  const { userId } = await requireAuth();

  const payments = await withUserContext(prisma, userId, async (client) => {
    return client.payments.findMany({
      where: { user_id: userId },
      orderBy: { created_at: "desc" },
    });
  });

  return NextResponse.json(payments);
}

Admin Pages: Force Dynamic

typescript

// REQUIRED for admin pages with RLS
export const dynamic = "force-dynamic";

Reference

•Implementation Guide: docs/database/RLS_IMPLEMENTATION_GUIDE.md
•Policy Catalog: docs/database/RLS_POLICY_CATALOG.md