coygeek
## Summary The Authorization Setup section in `examples/prompts/use-realtime.md` tells readers how to authorize writes to a private channel, but its `FOR INSERT` policy uses `USING (...)`. PostgreSQL INSERT policies accept `WITH CHECK` expressions, not `USING` expressions, so the documented policy cannot be created. ## Steps to reproduce 1. Open the [private-channel INSERT policy](https://github.com/supabase/supabase/blob/4ab54b935919ba3f4bb92f436ae4e757108e4f8a/examples/prompts/use-realtime.md#L286-L300). 2. Observe that `FOR INSERT TO authenticated` is followed by `USING (...)`. 3. To isolate the clause mismatch from Supabase schemas and authentication helpers, try this minimal statement in a disposable PostgreSQL transaction: ```sql BEGIN; CREATE TABLE realtime_policy_fixture (topic text); CREATE POLICY room_members_can_write ON realtime_policy_fixture FOR INSERT USING (topic LIKE 'room:%'); ROLLBACK; ``` The SQL was not executed during this report. The directly observed evidence is the source's `FOR INSERT` / `USING` combination and PostgreSQL's documented restriction. ## Expected behavior The private-channel write example defines a valid INSERT policy that checks the proposed new row against the intended room-membership predicate. ## Actual behavior The example uses `USING`, which is not a supported expression clause for an INSERT-only policy. The room-membership predicate cannot be installed through the supplied statement. ## Affected area `examples/prompts/use-realtime.md`, Authorization Setup, `room_members_can_write` policy, lines 290-299 at revision `4ab54b935919ba3f4bb92f436ae4e757108e4f8a`. ## Runtime or environment Source inspection at the repository's `master` head, revision `4ab54b935919ba3f4bb92f436ae4e757108e4f8a`. No PostgreSQL server or live Supabase project was used. This is an invalid documentation example, not a demonstrated authorization bypass. ## Evidence - [FOR INSERT followed by USING](https://github.com/supabase/supabase/blob/4ab54b935919ba3f4bb92f436ae4e757108e4f8a/examples/prompts/use-realtime.md#L286-L300). - [PostgreSQL CREATE POLICY documentation](https://www.postgresql.org/docs/current/sql-createpolicy.html), INSERT Policies: INSERT policies cannot have a `USING` expression and accept a `WITH CHECK` expression. ## Impact Users copying the example into a migration or SQL editor cannot install the intended write policy for private-channel authorization. ## Additional context The closure check is that the revised INSERT policy can be created with all documented prerequisites present and checks candidate rows through the intended membership predicate. The SELECT policy elsewhere in this section has a separate contract and should retain its valid SELECT-specific expression behavior.