From 17715744b2c14ce3f2b0bb3e5d4df6db74675772 Mon Sep 17 00:00:00 2001
From: Joshen Lim <joshenlimek@gmail.com>
Date: Thu, 15 Jan 2026 10:27:07 +0700
Subject: [PATCH] Update programmatically generated policies to use
 authenticated role (#41812)

* Update programmatically generated policies to use authenticated role

* Fix test

* Fix unit tests
---
 .../interfaces/Auth/Policies/Policies.utils.test.ts        | 4 ++--
 .../components/interfaces/Auth/Policies/Policies.utils.ts  | 4 ++--
 .../SidePanelEditor/TableEditor/ApiAccessToggle.tsx        | 7 ++++---
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/apps/studio/components/interfaces/Auth/Policies/Policies.utils.test.ts b/apps/studio/components/interfaces/Auth/Policies/Policies.utils.test.ts
index 25cebe323bb..a271cbba208 100644
--- a/apps/studio/components/interfaces/Auth/Policies/Policies.utils.test.ts
+++ b/apps/studio/components/interfaces/Auth/Policies/Policies.utils.test.ts
@@ -156,7 +156,7 @@ describe('Policies.utils - Policy Generation', () => {
           expect(policy).toHaveProperty('schema', 'public')
           expect(policy).toHaveProperty('action', 'PERMISSIVE')
           expect(policy).toHaveProperty('roles')
-          expect(policy.roles).toContain('public')
+          expect(policy.roles).toContain('authenticated')
         }
       })
 
@@ -214,7 +214,7 @@ describe('Policies.utils - Policy Generation', () => {
         expect(selectPolicy?.sql).toContain('CREATE POLICY')
         expect(selectPolicy?.sql).toContain('public.posts')
         expect(selectPolicy?.sql).toContain('AS PERMISSIVE FOR SELECT')
-        expect(selectPolicy?.sql).toContain('TO public')
+        expect(selectPolicy?.sql).toContain('TO authenticated')
         expect(selectPolicy?.sql).toContain('USING')
         expect(selectPolicy?.sql).toContain('auth.uid()')
       })
diff --git a/apps/studio/components/interfaces/Auth/Policies/Policies.utils.ts b/apps/studio/components/interfaces/Auth/Policies/Policies.utils.ts
index 128668a8d71..c741b45ab07 100644
--- a/apps/studio/components/interfaces/Auth/Policies/Policies.utils.ts
+++ b/apps/studio/components/interfaces/Auth/Policies/Policies.utils.ts
@@ -316,7 +316,7 @@ const buildPoliciesForPath = (
 
   return (['SELECT', 'INSERT', 'UPDATE', 'DELETE'] as const).map((command) => {
     const name = `Enable ${command.toLowerCase()} access for users based on ${ident(targetCol)}`
-    const base = `CREATE POLICY "${name}" ON ${ident(table.schema)}.${ident(table.name)} AS PERMISSIVE FOR ${command} TO public`
+    const base = `CREATE POLICY "${name}" ON ${ident(table.schema)}.${ident(table.name)} AS PERMISSIVE FOR ${command} TO authenticated`
 
     const sql =
       command === 'INSERT'
@@ -338,7 +338,7 @@ const buildPoliciesForPath = (
       definition,
       check,
       action: 'PERMISSIVE' as const,
-      roles: ['public'],
+      roles: ['authenticated'],
     }
   })
 }
diff --git a/apps/studio/components/interfaces/TableGridEditor/SidePanelEditor/TableEditor/ApiAccessToggle.tsx b/apps/studio/components/interfaces/TableGridEditor/SidePanelEditor/TableEditor/ApiAccessToggle.tsx
index 2357d328d35..b70de35f06d 100644
--- a/apps/studio/components/interfaces/TableGridEditor/SidePanelEditor/TableEditor/ApiAccessToggle.tsx
+++ b/apps/studio/components/interfaces/TableGridEditor/SidePanelEditor/TableEditor/ApiAccessToggle.tsx
@@ -319,9 +319,10 @@ export const ApiAccessToggle = ({
             <p className="text-sm text-foreground flex items-center gap-1.5">
               Data API Access
               <InfoTooltip side="top" className="max-w-80">
-                This controls which operations the <code className="text-xs">anon</code> and{' '}
-                <code className="text-xs">authenticated</code> roles can perform on this table via
-                the Data API. Unselected privileges are revoked from these roles.
+                This controls which operations the <code className="text-code-inline">anon</code>{' '}
+                and <code className="text-code-inline whitespace-nowrap">authenticated</code> roles
+                can perform on this table via the Data API. Unselected privileges are revoked from
+                these roles.
               </InfoTooltip>
             </p>
             <p className="text-sm text-foreground-lighter">