Skip to content

Commit 368b8ac

Browse files
committed
fix: Bypass RLS for login
The authenticate_user! method in AuthController also needs to bypass RLS when finding users by email during login, since we don't have RLS context yet at that point.
1 parent d130351 commit 368b8ac

1 file changed

Lines changed: 2 additions & 1 deletion

File tree

app/modules/authentication/controllers/auth_controller.rb

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -340,7 +340,8 @@ def authenticate_user!
340340

341341
return nil if email.blank? || password.blank?
342342

343-
user = User.find_by(email: email)
343+
# Bypass RLS for login - we don't have RLS context yet during authentication
344+
user = User.unscoped.find_by(email: email)
344345
user&.authenticate(password) ? user : nil
345346
end
346347

0 commit comments

Comments
 (0)