mirror of
https://github.com/pezkuwichain/pwap.git
synced 2026-07-26 20:05:40 +00:00
pezkuwichain
20a5602167
Replicates the Supabase RLS model on a real Postgres engine (pglite) with roles + an auth.role() JWT-claim stub and proves the harden_financial_rls + escrow-REVOKE migrations enforce: anon cannot read balances / payment-method PII or execute release_escrow_internal; the SECURITY DEFINER read path + service_role still work. 6/6. Together with the freeze-trigger test and the 34 app-auth tests, the fund-custody security layer is now proven-by-execution (logic); staging deploy is the in-situ step.