First App.
Your learning space A little progress, every day
EXTRA LESSONAfter Apple enrolment

Test access and lost connections

Test the locks as carefully as the buttons. Use two test people and a signed-out session, with made-up information.

On your iPhone10 min read & do
By the end of this lesson

Show that forbidden access fails and interrupted saves do not lose or duplicate work.

Allow extra time for two-account testing. Do not skip it because the screen looks correct.

Let’s do this

  1. 1
    On your iPhone

    Make two distinct test users

    Use two separate Apple Accounts on test devices, A and B, plus a signed-out session. Save a private record as A. Check that B and the signed-out session cannot see it. For shared records, also test an invited member and an uninvited person.

  2. 2
    In Codex

    Test the actual online requests

    Ask Codex to run access tests against your test project using normal user sessions and the public key. Try reading A’s record by its exact ID as B, then editing, deleting, changing its owner and joining a group without an invitation. Every forbidden request must fail.

  3. 3
    On your iPhone

    Test a lost connection

    Turn on Airplane Mode before and during a save. The app should keep the draft and explain whether it is saved or waiting. Reconnect and retry. Check that one tap sequence produces one saved item, including after reopening the app.

  4. 4
    On your iPhone

    Test switching people

    Sign out and sign in as the other user on the same device. Check the previous user’s records and cached screens are gone. Test an expired session. Write down the build, database rules and results before marking the checks passed.

Supabase’s Swift example app showing a signed-in profile, Update profile and Sign out.View larger
Supabase’s current Swift tutorial shows an account with saved profile information. Your app will use its own screens and the native Apple sign-in route taught here.Screenshot source (opens a new tab)

A message for Codex

Test my first iPhone app against its actual Supabase RLS rules with user A, user B, a signed-out session and any shared-group roles. Use ordinary user credentials and the public key, never admin credentials for the access assertions. Attempt forbidden reads, inserts, edits, deletes, owner changes and self-enrolment in groups. Also test offline saves, reconnect/retry duplicates, expired sessions and cached data after sign-out. Report failures and fix the rules before family testing.

Make this message fit your idea.

What you should see

Permitted actions work; forbidden requests fail at the service; lost connections preserve a clear, recoverable state.

If you get stuck

Go at your own pace. There is no test to pass.

Checked 7 September 2026. Screens can change; the official guides below have the latest steps.

Control access to Supabase recordsConnect a Swift app to Supabase