perf(rls): wrap auth.uid()/current_setting() in (select …) for per-statement evaluation

[dmitrymaranik]

Postgres re-evaluates a bare auth.uid() / current_setting(…) in an RLS policy once per row. Wrapping it in a scalar subquery — (select auth.uid()) — makes it an InitPlan the planner evaluates once per statement and caches. It's predicate-equivalent (row visibility unchanged) and the optimization Supabase documents for RLS.

This adds a migration that wraps the 7 affected per-user policies:

• Predicate-equivalent — row visibility is unchanged; only when the auth call is evaluated changes (once per statement vs once per row).
• Covers both USING and WITH CHECK (the write path runs per inserted/updated row too).
• Verified with pgrls (an open-source RLS linter) on Postgres 16: the PERF001 findings clear to 0 after the change, nothing else altered.
• The SQL is pgrls fix --rule PERF001 output, added as a new migration (20260629150153_wrap_rls_perf_initplan.sql).

Happy to adjust the migration filename/placement to your conventions.

[vercel]

@dmitrymaranik is attempting to deploy a commit to the Helicone Team on Vercel.

A member of the Team first needs to authorize it.

[greptile-apps]

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.