Terminal

supabase/migrations/20260807002000_reporting_view_fixes.sql

@@ -47,7 +47,7 @@ LANGUAGE sql STABLE SECURITY DEFINER SET search_path = public AS $$
     AND (public.can_access_student(_student)
          OR public.is_billing_admin()
          OR public.is_auditor()
-         OR pg_has_role(current_user, 'service_role', 'MEMBER'));
+         OR public.is_service_context());
 $$;
 
 GRANT EXECUTE ON FUNCTION public.student_display_name(UUID) TO authenticated;
@@ -170,11 +170,11 @@ SELECT
   COUNT(DISTINCT d.student_id) FILTER (WHERE d.is_past_due) AS delinquent_accounts,
   CASE
     -- Everyone who can genuinely read public.scholarships: billing admins and
-    -- auditors by policy, plus service_role (and superusers) by RLS bypass —
-    -- without that last arm, server-side reporting would see NULL too.
+    -- auditors by policy, plus service_role by RLS bypass — without that last
+    -- arm, server-side reporting would silently see NULL too.
     WHEN public.is_billing_admin()
       OR public.is_auditor()
-      OR pg_has_role(current_user, 'service_role', 'MEMBER')
+      OR public.is_service_context()
     THEN public.campus_pending_scholarship_cents(c.id)
     ELSE NULL
   END AS scholarship_pending_cents