fix(rls): apply RLS filter post-QueryEngine, fix getSingleDoc $and, update dashboard label

Agent-Logs-Url: https://github.com/yash-pouranik/urBackend/sessions/91669e19-a2de-410f-a997-63b1a2f4f61d

Co-authored-by: yash-pouranik <172860064+yash-pouranik@users.noreply.github.com>

Author: Copilot

apps/public-api/src/__tests__/data.controller.read.test.js

@@ -1,15 +1,22 @@
 'use strict';
 
 const mockFind = jest.fn();
+const mockAnd = jest.fn();
 const mockFindOne = jest.fn();
+const mockQueryLean = jest.fn().mockResolvedValue([]);
 
-const mockQueryEngine = jest.fn((query) => ({
-    filter: () => ({
-        sort: () => ({
-            paginate: () => ({ query }),
-        }),
-    }),
-}));
+// mockAnd returns an object with .lean() so features.query.lean() works after .and()
+mockAnd.mockReturnValue({ lean: mockQueryLean });
+
+const mockQueryEngine = jest.fn((query) => {
+    const engine = {
+        query,
+        filter() { return engine; },
+        sort() { return engine; },
+        paginate() { return engine; },
+    };
+    return engine;
+});
 
 jest.mock('@urbackend/common', () => ({
     sanitize: (v) => v,
@@ -18,7 +25,7 @@ jest.mock('@urbackend/common', () => ({
     getCompiledModel: jest.fn(() => ({
         find: (...args) => {
             mockFind(...args);
-            return { lean: jest.fn().mockResolvedValue([]) };
+            return { and: mockAnd, lean: mockQueryLean };
         },
         findOne: (...args) => {
             mockFindOne(...args);
@@ -75,7 +82,8 @@ describe('data.controller read RLS filters', () => {
 
         await getAllData(req, res);
 
-        expect(mockFind).toHaveBeenCalledWith({ userId: 'user_1' });
+        expect(mockFind).toHaveBeenCalledWith();
+        expect(mockAnd).toHaveBeenCalledWith([{ userId: 'user_1' }]);
         expect(res.json).toHaveBeenCalled();
     });
 
@@ -86,8 +94,10 @@ describe('data.controller read RLS filters', () => {
         await getSingleDoc(req, res);
 
         expect(mockFindOne).toHaveBeenCalledWith({
-            _id: '507f1f77bcf86cd799439011',
-            userId: 'user_1',
+            $and: [
+                { _id: '507f1f77bcf86cd799439011' },
+                { userId: 'user_1' },
+            ],
         });
         expect(res.json).toHaveBeenCalled();
     });

apps/public-api/src/controllers/data.controller.js

@@ -103,8 +103,14 @@ module.exports.getAllData = async (req, res) => {
     );
 
     const baseFilter = req.rlsFilter && typeof req.rlsFilter === 'object' ? req.rlsFilter : {};
-    const features = new QueryEngine(Model.find(baseFilter), req.query)
-      .filter()
+    const features = new QueryEngine(Model.find(), req.query)
+      .filter();
+
+    if (Object.keys(baseFilter).length > 0) {
+      features.query = features.query.and([baseFilter]);
+    }
+
+    features
       .sort()
       .paginate();
 

apps/web-dashboard/src/pages/Database.jsx

@@ -782,8 +782,13 @@ export default function Database() {
                 onChange={(e) => setRlsEnabled(e.target.checked)}
                 style={{ accentColor: "var(--color-primary)" }}
               />
-              <span>Enable RLS for publishable-key writes</span>
+              <span>Enable RLS access rules for publishable-key requests</span>
             </label>
+            <p className="rls-help-text">
+              {rlsMode === "private"
+                ? "When enabled, publishable-key access is restricted to the owner for both reads and writes."
+                : "When enabled, publishable-key writes are restricted to the owner. Reads remain available according to the selected access mode."}
+            </p>
 
             <div className="rls-owner-field-group">
               <label htmlFor="rls-mode">Access Mode</label>