# Postgres RLS/Audit Smoke

Use this only against a local or disposable dev Postgres database initialized from
`infra/db/init/*.sql`. The checker writes temporary fixture learners, sessions,
turns, and audit rows, then removes only rows tagged with its unique run id.

## Run

Use the non-owner app role created by `infra/db/init/99_app_role.sh`; do not use
`postgres`, a superuser, a `BYPASSRLS` role, or a table owner.

```powershell
$env:VIGNETTE_RLS_AUDIT_DSN = "postgresql://vignette_app:vignette_app@127.0.0.1:5432/vignette"
C:\Users\encep\AppData\Local\Programs\Python\Python311\python.exe scripts\check-postgres-rls-audit.py --write-fixtures
```

The script intentionally ignores `DATABASE_URL`. Without an explicit smoke DSN
and `--write-fixtures`, it prints prerequisites and exits nonzero.

## Checks

- Learner A can read their own session, but cannot read learner B's session or turns.
- Instructor visibility is scoped to `app.current_cohort`.
- An evaluator-only turn is hidden from learner/client/counselor AI context and visible to evaluator AI.
- Instructor and admin read paths can insert `audit.audit_log` `read_session` rows.

Any proof that cannot be made from the current schema or connection role is not
reported as passed. Default exit code is nonzero for failures or skipped proof;
use `--allow-skips` only when intentionally probing a partial local schema.