Hi, and thanks for core-oss. I ran a static RLS analyzer (pgrls) over core-api/supabase/migrations and found 39 RLS policies that call auth.uid() per row in their USING/WITH CHECK -- 39 policies across the schema (e.g. on access_requests).
Postgres re-evaluates a bare auth.uid() in a policy once per row. Wrapping it in a scalar subquery -- (select auth.uid()) -- makes it an InitPlan the planner evaluates once per statement and caches. It's predicate-equivalent (row visibility unchanged) and the optimization Supabase documents for RLS.
I've opened a PR with the wrap (a new migration) -- it's pgrls fix --rule PERF001 output, verified to clear the finding with nothing else changed.
Hi, and thanks for core-oss. I ran a static RLS analyzer (pgrls) over
core-api/supabase/migrationsand found 39 RLS policies that callauth.uid()per row in theirUSING/WITH CHECK-- 39 policies across the schema (e.g. on access_requests).Postgres re-evaluates a bare
auth.uid()in a policy once per row. Wrapping it in a scalar subquery --(select auth.uid())-- makes it an InitPlan the planner evaluates once per statement and caches. It's predicate-equivalent (row visibility unchanged) and the optimization Supabase documents for RLS.I've opened a PR with the wrap (a new migration) -- it's
pgrls fix --rule PERF001output, verified to clear the finding with nothing else changed.