fix(#321): least-privilege DB role for the .NET backend — RLS + #281 trigger as a live backstop

[TortoiseWolfe]

What & why

The .NET messaging backend connected to Postgres as the postgres superuser, which bypasses RLS (superuser + table owner) and self-exempts the #281 column-guard trigger (enforce_message_update_columns early-returns when auth.uid() IS NULL AND role IN (…,'postgres')). So the C# controller checks were the sole authorization guard — one missed check is a data-exposure/integrity bug with nothing behind it. This closes the last Phase-1 security item on the owner-blocking #280 arc (verify-and-wire landed in #322/#324).

The backend now connects as a least-privilege dotnet_app role and sets the RLS actor per request (the PostgREST model), so RLS + the trigger enforce as a live backstop behind the C# checks — belt-and-suspenders.

How

• dotnet_app role (monolithic migration, idempotent DO $$ pg_roles guard): LOGIN NOINHERIT NOSUPERUSER NOBYPASSRLS, non-owner, GRANT authenticated only (NOT service_role, so it cannot SET ROLE into a BYPASSRLS role). Because the messaging RLS policies are role-agnostic and gate on auth.uid(), this role gets exactly the participant scoping the C# checks enforce. Password is per-env (roles.sql locally; injected in prod — never committed).
• RlsActorMiddleware (new; wired after UseAuthorization): per authenticated request, opens one transaction and runs SET LOCAL ROLE authenticated + set_config('request.jwt.claims', …, true) (parameterized) so auth.uid() resolves in-DB. SET LOCAL is transaction-scoped → the actor never leaks onto the next request drawing the same pooled connection (Npgsql pools; multiplexing off). The request-scoped AppDbContext is shared, so every controller's EF/raw-SQL enlists automatically — no controller changes, and each request is now atomic.
• Connection: docker-compose.yml + appsettings.json switch Username postgres → dotnet_app.
• Comments: corrected the stale "the trigger exempts this backend" notes (it now fires).

Proof (the whole point)

New tests/rls/dotnet-least-privilege.test.ts — a raw pg connection AS dotnet_app replicating the middleware's exact seam (SET LOCAL ROLE + claims) and issuing the cross-user write with no C# involved — i.e. "what if a C# check were bypassed?":

• BLOCKS a recipient rewriting the sender's ciphertext → 42501, row unchanged
• BLOCKS a recipient soft-deleting the sender's message → 42501
• BLOCKS an outsider reading / updating the conversation → 0 rows (RLS row-scoping)
• ALLOWS the recipient marking read + the sender editing their own recent message

Combined with the conformance suite proving the middleware sets the actor correctly (if it didn't, auth.uid() would be null and RLS would deny every participant read, failing conformance), this proves the backstop end-to-end — without temporarily removing a production security check.

Verified live

docker compose --profile supabase --profile dotnet up (fresh DB → the migration creates dotnet_app) → pnpm test:rls = 113/113:

• .dotnet conformance stays 12/12 under the least-privilege role (legitimate access unbroken)
• the 6 backstop cases green
• all 9 other RLS suites green

The postgres superuser no longer touches the messaging tables. This PR self-validates: it edits paths in the Conformance gate's filter, so that gate runs the full test:rls against a fresh dual-provider stack.

Follow-ups (out of scope)

• Rotate/inject a distinct dotnet_app password in prod + extend the fix(#265): .NET messaging conformance 12/12 + JWT hardening + C11 doc-truth #322 fail-closed startup guard to also refuse the demo DB password in non-Development.
• FORCE ROW LEVEL SECURITY isn't needed (non-owner role); broadening conformance coverage (groups/archive/realtime, C15–C28) is the separate next Migration anchor: swap ScriptHammer's Supabase backend for ASP.NET Core + EF Core (.NET), KDG as reference #265 increment.

Refs #321, #280, #281.

🤖 Generated with Claude Code