RLS policy on invoice lines lets any logged-in user read every workspace's line items
Description
The invoices table has RLS enabled, and its policy correctly limits reads to the user's own workspace. The invoice_lines table has RLS enabled too, but its policy only checks that the user is logged in. Any authenticated user can therefore read the line items (descriptions, quantities and amounts) of every workspace's invoices, even though the invoices themselves stay hidden.
Reproduction
Log in as user A (workspace X). Query invoice_lines through the Supabase REST API with the public anon key and user A's session token, without a filter. The response also contains line items of invoices that belong to workspace Y.
Recommendation
Replace the policy on invoice_lines with one that checks the workspace of the parent invoice. Drop the old policy while you're at it: Postgres combines permissive policies with OR, so only adding a stricter one changes nothing.
drop policy "authenticated can read" on invoice_lines;
create policy "read lines of own workspace" on invoice_lines
for select to authenticated
using (exists (
select 1 from invoices i
where i.id = invoice_lines.invoice_id
and i.workspace_id = auth_workspace_id()
));Here auth_workspace_id() returns the logged-in user's workspace. Then add an automated test that queries as a user of a second workspace and expects zero rows.