Fixing infinite recursion in Supabase RLS multi-tenant policies

Short summary

When a Supabase RLS policy on a tenant table queries another table that also has RLS enabled, the policy re-evaluation creates infinite recursion. The fix is to resolve membership through a SECURITY DEFINER function that runs with the definer's privileges, bypassing RLS on the membership table. The function must be read-only, return only the caller's workspace IDs, and set search_path to empty to prevent search-path hijacking.

• •RLS policies that query other RLS-protected tables cause infinite recursion
• •Fix with a SECURITY DEFINER function that bypasses RLS and returns only the caller's workspace IDs
• •Pin search_path = '' to prevent the classic SECURITY DEFINER search-path hijacking vulnerability

Generated with AI, which can make mistakes.