From 3110932d789a4a45082ee407422f373e379bfc5e Mon Sep 17 00:00:00 2001 From: Arnas Donauskas Date: Mon, 29 Jun 2026 17:33:41 +0300 Subject: [PATCH] fix(templates): scope template picker to account, not user MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The inbox/contact TemplatePicker fetched approved templates filtered by `user_id = current user`, so in a shared account a teammate only saw templates they personally created — others' approved templates were hidden, leaving them unable to send those templates. message_templates is account-owned and its RLS SELECT policy already scopes rows to account members (is_account_member, migration 017), so the user_id filter was both redundant and over-restrictive. Drop it and rely on RLS, matching the broadcast template picker. Co-Authored-By: Claude Opus 4.8 --- src/components/inbox/template-picker.tsx | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/components/inbox/template-picker.tsx b/src/components/inbox/template-picker.tsx index f3607c1..9a0b754 100644 --- a/src/components/inbox/template-picker.tsx +++ b/src/components/inbox/template-picker.tsx @@ -104,10 +104,13 @@ export function TemplatePicker({ return; } + // Scope by RLS (message_templates_select → is_account_member), NOT by + // user_id. Templates are account-owned, so filtering on the caller's + // user_id hid templates that a teammate created — leaving them unable + // to send approved templates in a shared account. const { data, error } = await supabase .from("message_templates") .select("*") - .eq("user_id", user.id) .eq("status", "APPROVED") .order("created_at", { ascending: false });