supabase-health-doctor

Run the supabase-health edge function, which checks pg_policies and pg_class.relrowsecurity for tables with RLS disabled or zero policies. Any table with a tenant_id column whose policies do not reference tenant_id is flagged red under tenant_isolation.exposed_tables.

The database.missing_indexes check uses pg_stat_user_tables seq_scan versus idx_scan ratios and flags foreign key columns without indexes. The database.slow_queries check reads pg_stat_statements and marks queries red when mean execution time exceeds 1000ms.

Yes, every check is independently runnable via supabase-health?check=<id> for debugging. Each check lives in its own file under supabase/functions/supabase-health/checks and default-exports an id and run function.

The /admin/health-doctor route and the supabase-health invocation are master-only. The edge function verifies the master role server-side, and anonymous or regular authenticated callers receive a 403 response.

New evidence fields go into the existing JSONB payload column to avoid schema-cache drift. Adding new top-level columns requires a migration with NOTIFY pgrst reload schema, so JSONB additions keep the PostgREST schema cache stable without migrations.

The full inspection must complete in under 30 seconds, so long checks like slow_queries and orphaned_files use LIMIT and sampling. Partial results are persisted even if one check fails, and evidence is capped at 50 rows per check.