Split out of the #563 audit (suggestion 16), which is otherwise closed.
#536's entity visibility gate needs a per-entity-type test matrix. Two failure
modes it currently has no coverage for, at opposite extremes:
- a
USING (true) policy silently makes the gate a no-op — everything is
visible and every test still passes;
- a missing anon policy 400s every payment for that entity type.
Neither shows up today because the gate is exercised for one entity type and
assumed for the rest. The check is also duplicated across the anon and
key/OIDC paths with only one copy load-bearing per path, so a fix applied to
one is easy to believe applied to both.
Left out of the audit sweep deliberately: this is test infrastructure, not a
defect. It needs a fixture per entity type plus a way to assert RLS policy
behaviour, and its value is catching a future regression rather than any bug
present today — the one item in that audit whose scope is larger than its
finding.
Split out of the #563 audit (suggestion 16), which is otherwise closed.
#536's entity visibility gate needs a per-entity-type test matrix. Two failure
modes it currently has no coverage for, at opposite extremes:
USING (true)policy silently makes the gate a no-op — everything isvisible and every test still passes;
Neither shows up today because the gate is exercised for one entity type and
assumed for the rest. The check is also duplicated across the anon and
key/OIDC paths with only one copy load-bearing per path, so a fix applied to
one is easy to believe applied to both.
Left out of the audit sweep deliberately: this is test infrastructure, not a
defect. It needs a fixture per entity type plus a way to assert RLS policy
behaviour, and its value is catching a future regression rather than any bug
present today — the one item in that audit whose scope is larger than its
finding.