fix(rls): infinite recursion in profiles policy — use SECURITY DEFINER is_admin() function

web/lib/supabase/schema.sql

@@ -128,24 +128,35 @@ ALTER TABLE public.api_keys ENABLE ROW LEVEL SECURITY;
 ALTER TABLE public.custom_rules ENABLE ROW LEVEL SECURITY;
 ALTER TABLE public.admin_logs ENABLE ROW LEVEL SECURITY;
 
+-- ─── FIX v4.3: SECURITY DEFINER function to check admin role ───
+-- Querying profiles FROM a profiles policy causes infinite recursion (42P17).
+-- SECURITY DEFINER bypasses RLS, breaking the cycle.
+CREATE OR REPLACE FUNCTION public.is_admin()
+RETURNS boolean AS $$
+  SELECT EXISTS (
+    SELECT 1 FROM public.profiles
+    WHERE id = auth.uid() AND role = 'admin'
+  );
+$$ LANGUAGE sql SECURITY DEFINER STABLE;
+
 -- Profiles
 CREATE POLICY "Users see own profile" ON public.profiles FOR SELECT USING (auth.uid() = id);
 CREATE POLICY "Users update own profile" ON public.profiles FOR UPDATE USING (auth.uid() = id);
-CREATE POLICY "Admins read all profiles" ON public.profiles FOR SELECT USING (auth.uid() IN (SELECT id FROM public.profiles WHERE role = 'admin'));
-CREATE POLICY "Admins update all profiles" ON public.profiles FOR UPDATE USING (auth.uid() IN (SELECT id FROM public.profiles WHERE role = 'admin'));
+CREATE POLICY "Admins read all profiles" ON public.profiles FOR SELECT USING (public.is_admin());
+CREATE POLICY "Admins update all profiles" ON public.profiles FOR UPDATE USING (public.is_admin());
 
 -- Analyses
 CREATE POLICY "Users see own analyses" ON public.analyses FOR SELECT
   USING (auth.uid() = user_id OR team_id IN (SELECT team_id FROM public.profiles WHERE id = auth.uid()));
 CREATE POLICY "Users insert analyses" ON public.analyses FOR INSERT WITH CHECK (auth.uid() = user_id);
 CREATE POLICY "Users delete own analyses" ON public.analyses FOR DELETE USING (auth.uid() = user_id);
-CREATE POLICY "Admins read all analyses" ON public.analyses FOR SELECT USING (auth.uid() IN (SELECT id FROM public.profiles WHERE role = 'admin'));
+CREATE POLICY "Admins read all analyses" ON public.analyses FOR SELECT USING (public.is_admin());
 
 -- Teams
 CREATE POLICY "Team members can view" ON public.teams FOR SELECT
   USING (id IN (SELECT team_id FROM public.profiles WHERE id = auth.uid()) OR owner_id = auth.uid());
 CREATE POLICY "Owner can update team" ON public.teams FOR UPDATE USING (owner_id = auth.uid());
-CREATE POLICY "Admins read all teams" ON public.teams FOR SELECT USING (auth.uid() IN (SELECT id FROM public.profiles WHERE role = 'admin'));
+CREATE POLICY "Admins read all teams" ON public.teams FOR SELECT USING (public.is_admin());
 
 -- Team invites
 CREATE POLICY "Members see team invites" ON public.team_invites FOR SELECT
@@ -156,17 +167,17 @@ CREATE POLICY "Users can invite" ON public.team_invites FOR INSERT WITH CHECK (i
 CREATE POLICY "Users see own API keys" ON public.api_keys FOR SELECT
   USING (user_id = auth.uid() OR team_id IN (SELECT team_id FROM public.profiles WHERE id = auth.uid()));
 CREATE POLICY "Users manage own API keys" ON public.api_keys FOR ALL USING (user_id = auth.uid());
-CREATE POLICY "Admins read all api_keys" ON public.api_keys FOR SELECT USING (auth.uid() IN (SELECT id FROM public.profiles WHERE role = 'admin'));
+CREATE POLICY "Admins read all api_keys" ON public.api_keys FOR SELECT USING (public.is_admin());
 
 -- Custom Rules
 CREATE POLICY "Users see own rules" ON public.custom_rules FOR SELECT
   USING (user_id = auth.uid() OR team_id IN (SELECT team_id FROM public.profiles WHERE id = auth.uid()));
 CREATE POLICY "Users manage own rules" ON public.custom_rules FOR ALL USING (user_id = auth.uid());
-CREATE POLICY "Admins read all rules" ON public.custom_rules FOR SELECT USING (auth.uid() IN (SELECT id FROM public.profiles WHERE role = 'admin'));
+CREATE POLICY "Admins read all rules" ON public.custom_rules FOR SELECT USING (public.is_admin());
 
 -- Admin Logs
 CREATE POLICY "Admins manage logs" ON public.admin_logs FOR ALL
-  USING (auth.uid() IN (SELECT id FROM public.profiles WHERE role = 'admin'));
+  USING (public.is_admin());
 
 -- ─── Auto-create profile on signup ───
 CREATE OR REPLACE FUNCTION public.handle_new_user()