What

Replaces the three USING (true) SELECT policies on exam_questions, question_options and lesson_comments with predicates that route through their parent (exams / lessons), tightens the two sibling FOR ALL staff policies on the exam tables, and converges the #509 authenticated preview-lesson branch with the anon one.

Closes #542

Why

20260313152048_rls_exam_child_tables.sql created exam_questions and question_options as USING (true). #509 replaced the parent exams policy with a tenant + staff/author + has_course_access gate and stopped there, so any authenticated user of any tenant — holding no entitlement, past their school's access_cutoff_at — could read every exam's correct_answer, grading_rubric, ai_grading_criteria, expected_keywords and question_options.is_correct straight over PostgREST. Both the #509 exam gate and the #494 access cutoff were bypassable for the thing exams exist to protect. lesson_comments was the same shape with lower stakes.

Beyond the four policies the issue lists, this also tightens the sibling FOR ALL staff policies on both exam tables. They matched on get_tenant_role() IN ('teacher','admin') with no row predicate at all, and permissive policies OR together — so without this a teacher of tenant A keeps reading (and writing) every other tenant's exam questions through that policy, and the acceptance criterion "a member of tenant A gets zero rows" would fail for any staff account. Verified: before the change a caller presenting a tenant-A teacher claim read all of tenant B's questions; after, zero.

The preview overshoot is a content leak introduced by the #509 hardening: (is_preview AND status='published') omitted the parent-course-published EXISTS its anon counterpart carries, so a teacher drafting a course who marked a lesson preview + published exposed that body to every signed-in tenant member while anonymous visitors correctly could not see it.

How it works

New can_read_exam(_exam_id) helper (SECURITY INVOKER, so auth.uid() / get_tenant_id() / is_tenant_staff() resolve to the caller) mirrors the #509 exams gate plus the pre-existing super-admin policy, and both exam child tables gate on it — question_options two-hop via exam_questions. Per CLAUDE.md these tables have no tenant_id (adding one errors the query — the #282 teacher-grading regression), hence routing through the FK. The staff/author branches are carried over deliberately: the exam editor, teacher grading and the AI grading path in app/actions/exam-grading.ts all read through RLS-bound user clients, so a missing branch breaks grading rather than failing safe.

Also adds the three missing FK indexes (exam_questions.exam_id, question_options.question_id, lesson_comments.lesson_id), which every new predicate looks rows up by.

How to QA

On a fresh npm run db:reset, then npm run dev:

1. Assert no open policy — should return zero rows:

   select tablename, policyname from pg_policies
    where tablename in ('exam_questions','question_options','lesson_comments')
      and qual = 'true';

2. Automated — npx playwright test exam-answer-key-rls --workers=1 (10 tests; needs no dev server, it drives PostgREST directly). Covers: cross-tenant read → 0 rows; same-tenant-no-entitlement → 0 rows; unscoped whole-table sweep → 0 rows; staff still read rubrics + is_correct; entitled student still reads the exam they are sitting; comments cross-tenant → 0 / in-tenant → visible; preview lesson of a draft course hidden from both signed-in and anon, restored when the course is published.
3. Teacher path, by hand — creator@codeacademy.com on code-academy.lvh.me:3000, open a course exam in the editor and a submission's grading screen; questions, options and rubrics all render.
4. AI grading end to end — npx playwright test exam-grading-test --workers=1 as alice@student.com (needs her seeded entitlement to course 2001).

Screenshots / GIF

n/a — no user-visible surface changes; this is an RLS-only change. Evidence is the policy dump in step 1 and the spec in step 2.

Verification

• npm run typecheck — clean
• npm run test:unit — 370/370 (matches the 146a8cfa baseline)
• npm run build — passes
• npx eslint tests/playwright/exam-answer-key-rls.spec.ts — clean (repo-wide lint has a large pre-existing baseline, unchanged here; SQL isn't linted)
• New spec 10/10, stable across repeated runs
• Prove-the-bug: with the pre-exam_questions and question_options are readable by every authenticated user in every tenant #542 policies restored in place, the 5 leak tests fail and the 5 positive/staff tests still pass — the spec discriminates rather than passing vacuously
• Role-simulated SQL probes (set_config('request.jwt.claims', …)) confirm each branch: cross-tenant student 0, non-entitled member 0, forged tenant-A teacher claim 0, owning-tenant staff full read, entitled student full read, super admin full read
• student-exams, evaluations-security, teacher-content — 40 passed
• exam-grading-test (AI grading end to end) — passes with the new policies active

Two pre-existing failures, confirmed unrelated by re-running each with the old policies restored (identical failure):

• full-student-journey.spec.ts — targets course 9999 / lessons 10000-10001, which no longer exist in supabase/seed.sql; the page 404s regardless of RLS
• The earlier exam-grading-test failure was alice@student.com having lost her seeded entitlement to course 2001 (deleted by a parallel job sharing this local database, not by this change); restoring the row makes it pass

Notes for the reviewer

• Not applied to cloud. Local only, following the pattern of fix(#532): gate checkpoint attempts on entitlements, not enrollments #535. The issue asks for the pg_policies assertion on cloud too — that is a deliberate separate step.
• lib/database.types.ts not regenerated: this migration adds no tables or columns, only policies, one function and three indexes.
• The FOR ALL staff policies keep get_tenant_role() rather than swapping to is_tenant_staff() — the change there is purely the added row predicate, to keep the write gate itself untouched.

Checklist

• npm run typecheck and npm run test:unit pass
• npm run build passes
• Every new tenant-scoped query filters by tenant_id (or the table genuinely has no such column — all three here genuinely have none, hence the FK routing)
• Tested with every relevant role (student / teacher / admin / super admin / anon)
• Loading and error states handled (n/a — no UI change)
• New UI strings added to both messages/en.json and messages/es.json (n/a — no new strings)
• Migration applies cleanly on npm run db:reset, has RLS policies; lib/database.types.ts regeneration not needed (no schema shape change)

🤖 Generated with Claude Code

https://claude.ai/code/session_01Xwf7RJcxHNRVXb3ufFuT8g