security(streaming): SSE applies the column allowlist but not the policy row-filter — query/stream RLS drift

[EricAndrechek]

Area: api · policy · observability (streaming) — security (RLS bypass on the stream path) · found via pre-launch audit

Expected: the SSE delivery path applies the same policy as the structured-query path — both the column allowlist and the row-filter (RLS predicate) that the query path injects.

Actual: the SSE stream applies the column allowlist but not the policy row-filter, so the two read paths drift: a subscriber receives rows that the structured-query path would filter out for that role.

Impact: any deployment that combines row-policies with a public or role-scoped SSE stream leaks rows over the stream that RLS should remove — a data-exposure on the streaming surface. Live signal on Stats is limited (the public table carries no restrictive row-policy), but the gap is real for any future private/PII table fronted by a stream.

Scope: apply the query-path row-filter inside the stream policy evaluation (applyStreamPolicy).

Related: #294 (SSE delivery path), #214 (per-table policy scopes), the applyStreamPolicy unfiltered-passthrough issue.

---

From WaveHouse-Stats pre-launch security audit (WAVEHOUSE-FEEDBACK.md dogfooding), audited dev 60fed15 (2026-06-10). Filed via /pm-triage.

[coderabbitai]

🔗 Related PRs

#124 - chore(api)!: drop hub wildcard fan-out; SSE/WS use ?table= (closes #100) [merged]
#174 - refactor(table names): handle unsafe table names [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[EricAndrechek]

Ref refresh — the SSE delivery path was refactored in merged #353 (ccd7549) from internal/api/ into the new internal/stream package, so this issue's applyStreamPolicy / transform.go pointers are stale. The drift is unchanged and still open; it now lives in internal/stream/hub.go:

• project() applies column policy only — policy.Evaluate(p, role, evt.TableName, "select", nil) followed by filterColumns(...). No row-filter / RLS predicate.
• The refactor now documents the gap: the package comment justifies projecting once per (role, table) on the grounds that "row-level filtering… the stream path does not apply," and warns that "if row-level filtering is ever added to the stream path, this key (and projection) must take claims into account."

So the fix is still: evaluate the query-path row-filter inside project() and fold the claims into the projection key (otherwise the once-per-role serialization from #353 would serve one role's row-visibility to all of that role's subscribers regardless of per-subscriber claims). Still P1; no change to severity.