postgres

Your authorisation layer is correct and your query still leaks

A permission check answers "may this user do this". It doesn't answer "to which rows". In multi-tenant software the second question is the one that leaks data, and it fails in a way that passes every test you've written.

gosecuritymulti-tenancypostgres