RLS Policies Referencing user_metadata in Supabase

What goes wrong

In Supabase, user_metadata (stored as raw_user_meta_data in auth.users) can be changed by the signed-in user with supabase.auth.updateUser({ data: { role: 'admin' } }). An RLS policy that checks user_metadata to decide access can be bypassed by a user who edits their own metadata.

How it happens

The policy reads a role or flag from auth.jwt() -> 'user_metadata' instead of app_metadata.

How to find it

Search pg_policies for expressions that mention user_metadata or raw_user_meta_data.

SELECT tablename, policyname, cmd, qual, with_check
FROM pg_policies
WHERE schemaname = 'public'
  AND (
    qual::text LIKE '%user_metadata%'
    OR qual::text LIKE '%raw_user_meta_data%'
    OR with_check::text LIKE '%user_metadata%'
    OR with_check::text LIKE '%raw_user_meta_data%'
  );

How to fix it

Use auth.jwt() -> 'app_metadata' in the policy instead. app_metadata can only be set server-side, with the service_role key or the Dashboard.

ALTER POLICY "<policy_name>" ON public.<table_name>
  USING ((SELECT auth.jwt() -> 'app_metadata' ->> 'role') = '<role>');