react-doctor/supabase-client-owned-authz-field

When the client writes authorization columns (`ownerId`, `orgId`, `role`, `isAdmin`) to Supabase, an attacker can forge them and escalate their own access.

Validation prompt

Confirm the detector match and collect the required evidence before deciding whether an edit is warranted.

Fires in client (browser) code only when BOTH signals are present: (a) a Supabase write: supabase…insert(/upsert(/update(, or .from(...) followed by insert/upsert/update( with an object/array-literal argument: that includes an authorization column (ownerId, creatorId, userId, orgId, tenantId, role, or isAdmin), and (b) a sensitive-field name (ownerId|creatorId|userId|uid|providerId|orgId|tenantId|teamId|workspaceId|role|roles|isAdmin|admin, with Id/ID variants) appearing in the file. The two-signal gate avoids flagging files that merely mention these names.

Suppress when: the written value comes from a trusted server context the client only echoes back (an authenticated session id, or a column an RLS with check policy independently re-verifies) rather than raw client input: confirm whether RLS actually constrains the column server-side.

Evidence boundary

The diagnostic proves only that the detector’s modeled source pattern matched. It does not prove runtime impact, product intent, rendered failure, or that one remediation is correct.

Establish the environment, repository policy, exceptions, and required rendered or runtime evidence before deciding the occurrence.

Record one outcome:

• Confirmed failure: The required evidence establishes the violation.
• Rejected: A documented exception or false-positive predicate applies.
• Needs evidence: Named evidence can still be collected.
• Unavailable: Required evidence cannot be collected in this run.
• Waived with evidence: An authorized, scoped exception applies to an established failure.
• Observation: The review records an optional tradeoff without claiming a defect.

A waiver records its scope, authority, evidence, and review condition. It is not a pass or false positive.

Default severity is registry metadata. Use the occurrence’s JSON severity after repository configuration when ordering real findings.

Fix prompt

Apply this candidate correction only after the required evidence confirms the risk.

Stop sending owner, org, tenant, or role columns from the client; let the database set them. Default user_id to auth.uid(), derive org and role from server-owned membership rows, and enforce it with an RLS with check policy so a forged ownerId or role in the payload is rejected. Move any genuinely privileged write behind a server route or a security definer Postgres function that validates the actor.

Repository-wide copy prompt

Use this repository-wide prompt only after validating each occurrence. For one occurrence, use the guidance above.