Appendix C — Operations that bypass row-level security

25 operations build a Supabase client with the service-role key. That client is not subject to row-level security, so for these operations the database is not the thing keeping one tenant’s rows away from another — the handler is.

1 of them contain no call that resolves a user. That is a review list, not a defect list: an operation whose entire job is signing someone in cannot verify a caller who is not yet signed in. What the list establishes is that for each of these, the reasoning has to be in the handler, because it is not in the database.

operationId	Method	Path	Verified caller
addOrganizationMember	POST	/api/organizations/add-member	yes
createOrganization	POST	/api/organizations/create	yes
createOrganizationAfterLogin	POST	/api/auth/create-organization-after-login	yes
createOrganizationForAuthenticatedUser	POST	/api/auth/create-organization	yes
createOrganizationForCallingUser	POST	/api/organizations/create-for-user	yes
debugCreateTestOrganization	GET	/api/debug/create-organization-test	yes
debugFixOrganization	GET	/api/debug/fix-organization	yes
debugGetOrganizationStatus	GET	/api/debug/organization-status	yes
debugGetOrganizationsData	GET	/api/debug/organizations-data	yes
debugGetUserOrganization	GET	/api/debug/user-organization	yes
deleteDatasetNotePdf	DELETE	/api/datasets/{slug}/notes/{noteId}/pdf	yes
deleteOrganization	POST	/api/organizations/delete	yes
ensureUserOrganization	GET	/api/auth/ensure-organization	yes
generateThumbnail	POST	/api/thumbnails/generate	yes
generateThumbnailsBulk	POST	/api/thumbnails/generate-bulk	yes
generateVideoThumbnail	POST	/api/thumbnails/generate-video	yes
getImage	GET	/api/images/{id}	yes
getImageThumbnail	GET	/api/images/{id}/thumbnail	yes
listDatasetGeodata	GET	/api/datasets/{slug}/geodata	yes
listImages	GET	/api/images	yes
prepareImageForAnalysis	POST	/api/images/{id}	yes
resolveImageReferences	POST	/api/images	yes
startSsoSignIn	POST	/api/auth/sso	no
updateImageTags	PATCH	/api/images/{id}/tags	yes
uploadDatasetNotePdf	POST	/api/datasets/{slug}/notes/{noteId}/pdf	yes