Moving a browser-queried Supabase app shut all 228 RLS policies until auth.uid() moved too

Leaving Supabase is possible because the dashboard's single product is a Postgres database plus four open-source services that run anywhere, according to the developer's account on dev.to ^[18]. In this app, the client bundle's 326 calls to tables, rpc functions and storage all reach Postgres with a JWT attached ^[1][3]. Every policy depends on one small function. `auth.uid()` reads a session variable that the connection holder sets from the token before the query runs ^[5].

"I expected this to be the expensive part. It was twenty lines," the developer wrote ^[6]. The replacement checks the flat variable `request.jwt.claim.sub` first, then the `sub` key inside the JSON in `request.jwt.claims` ^[5]. "I did not rewrite a single one of the 228 policies," the author wrote, calling that "the difference between a week of work and a quarter of it" ^[8][9].

The move took about a week ^[2]. For that figure to hold on another codebase, its policies have to reference only objects a bootstrap file can recreate. This one needed the `anon`, `authenticated` and `service_role` roles, plus an `auth` schema holding `auth.uid()`, `auth.role()`, `auth.jwt()`, `auth.email()` and an `auth.users` table ^[10]. Migrations also assumed the `supabase_realtime` publication exists ^[10]. Extensions need their own `extensions` schema. Installed into `public`, `pgcrypto` is dropped on rebuild and `gen_random_uuid()` goes with it ^[11].

Grants were the fifth gap ^[10]. Without a `GRANT` to `authenticated`, Postgres refuses the request at the table with `permission denied` before RLS is evaluated ^[12]. "It reads exactly like broken RLS. It isn't. I lost an hour here," the developer wrote ^[12].

The replacement reads two places because of GoTrue ^[14]. Each service is consistent with itself. Together they disagree about where `sub` lives ^[14]. Under GoTrue's version, the author got NULL on every request and nothing in the logs ^[15]. "It looks like the data vanished," the developer wrote ^[15].

The ordering fix is good engineering ^[16]. `CREATE OR REPLACE` keeps the object identity the policies are bound to, so they never see the swap ^[16]. I'd wire the restore into the same deploy that bumps the GoTrue image. A forgotten manual step fails as silently as the original bug ^[15].

Loading the data had one more trap ^[17]. Disabling triggers is the standard advice for a dump with circular references. But `pg_dump` adds foreign keys at the end as `ALTER TABLE ADD CONSTRAINT`, and that statement runs a full validation pass anyway ^[17]. The author's load failed on `users.auth_uid` pointing at `auth.users` ^[17].