[Postgres] Add checks for RLS affecting replication

[rkistner]

Background

Originally, Supabase only supported logical replication by using the built-in postgres role. In the meantime, it is possible to create a custom role with REPLICATION, and we recommend it in our docs.

The caveat is that using RLS is very common and encouraged on Supabase, but RLS affects every non-superuser user by default. So when switching from postgres to a custom role, you could easily lose access to read the tables. And worse, this does not show up as an error - we simply get 0 results. And this often does not show up immediately, since streaming replication still works - you only notice when updating sync rules and the data is suddenly missing.

The fix

The fix is to make sure that the custom role has the BYPASSRLS attribute set.

The check

This adds a check on whether RLS is enabled for every replicated table, and logs a warning if RLS is enabled and the role is not super-user or has BYPASSRLS set.

This logs a warning, and also reports the same info via the diagnostics api. We don't block replication in this case, since there are scenarios not covered by this check, for example explicitly adding a RLS policy giving access to the custom role.

Sample log output:

info: Created replication slot powertest_160_1da4
warn: [PSYNC_S1145] Row Level Security is enabled on table "test_items". To make sure that powersync_role can read the table, run: 'ALTER ROLE powersync_role BYPASSRLS'.
info: powertest_160_1da4 Replicating "public"."test_items"
info: powertest_160_1da4 Replicating "public"."lists"

[changeset-bot]

🦋 Changeset detected

Latest commit: 90969da

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 13 packages

Name	Type
@powersync/service-core	Patch
@powersync/service-image	Patch
@powersync/service-jpgwire	Patch
@powersync/service-module-postgres	Minor
@powersync/service-core-tests	Patch
@powersync/service-module-core	Patch
@powersync/service-module-mongodb-storage	Patch
@powersync/service-module-mongodb	Patch
@powersync/service-module-mysql	Patch
@powersync/service-module-postgres-storage	Patch
test-client	Patch
@powersync/lib-service-postgres	Patch
@powersync/service-schema	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR