fix: handle missing Crowdfund table in RLS migration

Use dynamic SQL loop that skips tables and roles that don't exist,
making the migration safe for both Supabase and Railway environments.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: QSchlegel

prisma/migrations/20251215090000_enable_rls_disable_postgrest/migration.sql

@@ -5,50 +5,34 @@
 -- - Allows Prisma (using the service role) to continue bypassing RLS
 
 DO $$
+DECLARE
+  tbl TEXT;
 BEGIN
-  -- Enable RLS on all tables
-  ALTER TABLE "User" ENABLE ROW LEVEL SECURITY;
-  ALTER TABLE "Wallet" ENABLE ROW LEVEL SECURITY;
-  ALTER TABLE "Transaction" ENABLE ROW LEVEL SECURITY;
-  ALTER TABLE "Signable" ENABLE ROW LEVEL SECURITY;
-  ALTER TABLE "NewWallet" ENABLE ROW LEVEL SECURITY;
-  ALTER TABLE "Nonce" ENABLE ROW LEVEL SECURITY;
-  ALTER TABLE "Ballot" ENABLE ROW LEVEL SECURITY;
-  ALTER TABLE "Proxy" ENABLE ROW LEVEL SECURITY;
-  ALTER TABLE "BalanceSnapshot" ENABLE ROW LEVEL SECURITY;
-  ALTER TABLE "Migration" ENABLE ROW LEVEL SECURITY;
-  ALTER TABLE "Crowdfund" ENABLE ROW LEVEL SECURITY;
-  ALTER TABLE "_prisma_migrations" ENABLE ROW LEVEL SECURITY;
+  -- Enable RLS and optionally create deny-all policies for each table that exists
+  FOR tbl IN
+    SELECT unnest(ARRAY[
+      'User', 'Wallet', 'Transaction', 'Signable', 'NewWallet',
+      'Nonce', 'Ballot', 'Proxy', 'BalanceSnapshot', 'Migration',
+      'Crowdfund', '_prisma_migrations'
+    ])
+  LOOP
+    -- Skip tables that don't exist
+    IF EXISTS (SELECT 1 FROM pg_tables WHERE schemaname = 'public' AND tablename = tbl) THEN
+      EXECUTE format('ALTER TABLE %I ENABLE ROW LEVEL SECURITY', tbl);
 
-  -- Create deny-all policies for anon role (Supabase PostgREST)
-  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'anon') THEN
-    CREATE POLICY "deny_all_anon_User" ON "User" FOR ALL TO anon USING (false) WITH CHECK (false);
-    CREATE POLICY "deny_all_anon_Wallet" ON "Wallet" FOR ALL TO anon USING (false) WITH CHECK (false);
-    CREATE POLICY "deny_all_anon_Transaction" ON "Transaction" FOR ALL TO anon USING (false) WITH CHECK (false);
-    CREATE POLICY "deny_all_anon_Signable" ON "Signable" FOR ALL TO anon USING (false) WITH CHECK (false);
-    CREATE POLICY "deny_all_anon_NewWallet" ON "NewWallet" FOR ALL TO anon USING (false) WITH CHECK (false);
-    CREATE POLICY "deny_all_anon_Nonce" ON "Nonce" FOR ALL TO anon USING (false) WITH CHECK (false);
-    CREATE POLICY "deny_all_anon_Ballot" ON "Ballot" FOR ALL TO anon USING (false) WITH CHECK (false);
-    CREATE POLICY "deny_all_anon_Proxy" ON "Proxy" FOR ALL TO anon USING (false) WITH CHECK (false);
-    CREATE POLICY "deny_all_anon_BalanceSnapshot" ON "BalanceSnapshot" FOR ALL TO anon USING (false) WITH CHECK (false);
-    CREATE POLICY "deny_all_anon_Migration" ON "Migration" FOR ALL TO anon USING (false) WITH CHECK (false);
-    CREATE POLICY "deny_all_anon_Crowdfund" ON "Crowdfund" FOR ALL TO anon USING (false) WITH CHECK (false);
-    CREATE POLICY "deny_all_anon__prisma_migrations" ON "_prisma_migrations" FOR ALL TO anon USING (false) WITH CHECK (false);
-  END IF;
+      IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'anon') THEN
+        EXECUTE format(
+          'CREATE POLICY "deny_all_anon_%s" ON %I FOR ALL TO anon USING (false) WITH CHECK (false)',
+          tbl, tbl
+        );
+      END IF;
 
-  -- Create deny-all policies for authenticated role (Supabase PostgREST)
-  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated') THEN
-    CREATE POLICY "deny_all_authenticated_User" ON "User" FOR ALL TO authenticated USING (false) WITH CHECK (false);
-    CREATE POLICY "deny_all_authenticated_Wallet" ON "Wallet" FOR ALL TO authenticated USING (false) WITH CHECK (false);
-    CREATE POLICY "deny_all_authenticated_Transaction" ON "Transaction" FOR ALL TO authenticated USING (false) WITH CHECK (false);
-    CREATE POLICY "deny_all_authenticated_Signable" ON "Signable" FOR ALL TO authenticated USING (false) WITH CHECK (false);
-    CREATE POLICY "deny_all_authenticated_NewWallet" ON "NewWallet" FOR ALL TO authenticated USING (false) WITH CHECK (false);
-    CREATE POLICY "deny_all_authenticated_Nonce" ON "Nonce" FOR ALL TO authenticated USING (false) WITH CHECK (false);
-    CREATE POLICY "deny_all_authenticated_Ballot" ON "Ballot" FOR ALL TO authenticated USING (false) WITH CHECK (false);
-    CREATE POLICY "deny_all_authenticated_Proxy" ON "Proxy" FOR ALL TO authenticated USING (false) WITH CHECK (false);
-    CREATE POLICY "deny_all_authenticated_BalanceSnapshot" ON "BalanceSnapshot" FOR ALL TO authenticated USING (false) WITH CHECK (false);
-    CREATE POLICY "deny_all_authenticated_Migration" ON "Migration" FOR ALL TO authenticated USING (false) WITH CHECK (false);
-    CREATE POLICY "deny_all_authenticated_Crowdfund" ON "Crowdfund" FOR ALL TO authenticated USING (false) WITH CHECK (false);
-    CREATE POLICY "deny_all_authenticated__prisma_migrations" ON "_prisma_migrations" FOR ALL TO authenticated USING (false) WITH CHECK (false);
-  END IF;
+      IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated') THEN
+        EXECUTE format(
+          'CREATE POLICY "deny_all_authenticated_%s" ON %I FOR ALL TO authenticated USING (false) WITH CHECK (false)',
+          tbl, tbl
+        );
+      END IF;
+    END IF;
+  END LOOP;
 END $$;