skills.rest
gabrielnsmnto
gabrielnsmntoCOMMUNITY
Explore all skills by this author →
GitHub

test-as-user

Emulates authenticated users in PostgreSQL sessions to test Supabase RLS policies.

3|Updated Feb 7, 2026
Search Tags:#testing#postgresql#rls#supabase#row level security#psql#auth
One-click install
npx skills add https://github.com/gabrielnsmnto/kord-aios --skill test-as-user-gabrielnsmnto
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: test-as-user
Source: https://github.com/gabrielnsmnto/kord-aios/tree/main/src/features/builtin-skills/kord-aios/qa/test-as-user
Command: npx skills add https://github.com/gabrielnsmnto/kord-aios --skill test-as-user-gabrielnsmnto

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Verifying Row Level Security policies requires testing queries as specific users, but manually setting JWT claims and switching roles in psql is error-prone and easy to get wrong. ## Core Features & Use Cases - Session Claim Emulation: Sets request.jwt.claims and role via set_config so auth.uid() returns the emulated user ID. - Guided Test Scenarios: Provides five ready-made scenarios covering SELECT, INSERT, UPDATE, DELETE, and admin bypass cases. - Troubleshooting Guidance: Diagnoses common failures like NULL auth.uid(), disabled RLS, and missing table grants. - Use Case: After writing a policy that users can only read their own posts, run this Skill with a test user ID to confirm other users' rows are filtered out before deploying. ## Quick Start Ask the agent to run test-as-user with a user ID and role to verify your RLS policies in an interactive psql session.

Frequently Asked Questions about test-as-user

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test Supabase RLS policies as a specific user?▼

Set the session JWT claims with set_config for request.jwt.claims and request.jwt.claim.sub, then run queries in psql. The auth.uid() function will return the emulated user ID so RLS policies evaluate as that user.

How to emulate an authenticated user in psql for RLS testing?▼

Use set_config to assign request.jwt.claims with the user's sub and role, plus set the role itself. This Skill automates that setup and opens an interactive psql session where all queries run under the emulated identity.

Why does auth.uid() return NULL during RLS testing?▼

auth.uid() returns NULL when the request.jwt.claim.sub session setting is missing or the session was reset. Check current_setting('request.jwt.claim.sub', true), then run RESET ALL and reconfigure the claims.

Can I use service_role to bypass RLS in production code?▼

No. The service_role key bypasses all RLS policies and must never appear in client-side application code. It is only appropriate for controlled testing sessions or trusted server-side operations.

Why can a test user still see other users' rows?▼

This usually means RLS is not enabled on the table or a policy is missing. Check rowsecurity in pg_tables, enable RLS with ALTER TABLE, and create a policy such as USING (user_id = auth.uid()).

Related Skills

Explore More Software Engineering Skills→
SS2608-devSS2608-dev

rls-check

Verify Row Level Security policies are enabled on Supabase tables.

Community
Intermediate
tgsatwittgsatwit

policy-check

Evaluate artifacts against a Policy-as-Code Registry and report pass/fail verdicts.

Community
Advanced
anhnq-labanhnq-lab

supabase-rls-audit

Audit Supabase RLS policies across public schema tables and generate remediation SQL.

Community
Advanced
Elmanuel1Elmanuel1

get-test-token

Exchange user credentials for test JWTs across Supabase, Auth0, Cognito, and OAuth2 endpoints.

Community
Intermediate