From 5db48e16b3b9bfb3de752bbfff00365a27355792 Mon Sep 17 00:00:00 2001
From: 732642856 <732642856@qq.com>
Date: Tue, 21 Jul 2026 12:15:12 +0800
Subject: [PATCH] fix: add chat session delete row policy (#21)

---
 .../20260721100000_chat_sessions_delete_grant.sql          | 7 +++++++
 tests/test_session_management_entrypoints.py               | 2 ++
 2 files changed, 9 insertions(+)

diff --git a/frontend/supabase/migrations/20260721100000_chat_sessions_delete_grant.sql b/frontend/supabase/migrations/20260721100000_chat_sessions_delete_grant.sql
index bb7aad04..d20a4dfd 100644
--- a/frontend/supabase/migrations/20260721100000_chat_sessions_delete_grant.sql
+++ b/frontend/supabase/migrations/20260721100000_chat_sessions_delete_grant.sql
@@ -1,5 +1,12 @@
 begin;
 
+drop policy if exists chat_sessions_delete_own on public.chat_sessions;
+create policy chat_sessions_delete_own
+  on public.chat_sessions
+  for delete
+  to authenticated
+  using ((select auth.uid()) = user_id);
+
 grant delete on table public.chat_sessions to authenticated;
 
 commit;
diff --git a/tests/test_session_management_entrypoints.py b/tests/test_session_management_entrypoints.py
index 9cd2b2d2..7efdb1ba 100644
--- a/tests/test_session_management_entrypoints.py
+++ b/tests/test_session_management_entrypoints.py
@@ -45,3 +45,5 @@ def test_chat_session_delete_is_server_controlled_and_granted() -> None:
     assert '.eq("user_id", user.id)' in route
     assert 'count !== 1' in route
     assert 'grant delete on table public.chat_sessions to authenticated' in migration.lower()
+    assert 'create policy chat_sessions_delete_own' in migration.lower()
+    assert 'using ((select auth.uid()) = user_id)' in migration.lower()