For Supabase apps

E2E Testing
for Supabase Apps.

Test your auth. Test your policies. Ship confidently. Row Level Security is the load-bearing wall of your Supabase app, and it fails silently in prod the moment a policy gets one column wrong. Lastest replays your real auth and Realtime flows on every push, so you catch the regression before your users do. Learn how to test Supabase RLS policies end-to-end.

Start Free →View source
Auth + RLS readyREST API login$0 self-hosted
Lastest running an E2E test suite against a Supabase-backed app with auth and RLS
Auth. Tested.

Why Manual Auth Testing Fails

Your RLS policies look right in the dashboard. Then prod happens.

Auth session edge cases, expired JWTs, RLS policies that pass in your local seed and quietly break against real production data: none of it shows up until a user emails you. Two ways to handle it, and which one actually catches the silent leaks.

01

Click through signup and pray RLS holds.

You sign up as a test user, you click around, the dashboard loads. You ship. A week later a user reports that they can see another tenant's data because a policy joins on user_id instead of org_id. The Supabase dashboard never warned you. Neither did your unit tests.

  • RLS failures are silent - the query just returns the wrong rows
  • Auth session edge cases - expired JWT, refresh race, oauth callback flap
  • Realtime drift - channel subscriptions break and you don't notice
  • You only find out when a user notices first
02

Use Lastest. Replay every auth flow on every push.

Record your signup, login, dashboard, and tenant-switch flows once. Lastest captures them as deterministic Playwright with self-healing selectors and a visual baseline. Even better, log in via the Supabase REST API in a setup file and reuse the session across tests, roughly 10x faster and far less flaky than UI login.

  • REST API login setup file - one auth call, reused across the whole suite
  • Multi-tenant flows - switch users, prove isolation, catch RLS leaks
  • Realtime channel coverage - assert subscription state in-browser
  • Visual diffs on dashboards and tables to catch silent data shifts
  • $0 forever - self-host on the same VPS as your Supabase project

Built for Supabase Workflows

Auth holds. Policies hold. Sleep holds.

Two features that matter most when your Supabase project is the backbone of a one-person SaaS.

01 · Fast auth

Log in once via the REST API. Reuse the session.

Driving the login UI on every test is slow and flaky. Lastest supports a setup file pattern that hits the Supabase REST API directly with a test user, captures the JWT, and stores it as the auth state for every other test. ~10x faster, far less flaky, and you still get a separate UI test that exercises the real login form.

  • Works with email + password, magic links, and OAuth providers
  • Per-tenant auth state for multi-org coverage
  • Refresh-token aware for long-running suites
Recorder timeline showing a Supabase auth flow captured by Lastest

02 · RLS regression

Prove tenant A can't see tenant B's data.

Record one flow per tenant. Lastest replays them in parallel and asserts that the dashboard, lists, and detail pages render exactly the rows they should - and nothing they shouldn't. Visual diffs surface the difference between “empty state” and “leaked another user's row” in the same screenshot.

  • Multi-user fixtures keep RLS regressions out of main
  • Branch-to-branch compare for policy changes in PRs
  • Visual baseline catches silent data drift across deploys
Visual diff slider comparing two tenant dashboards in a Supabase app

Common questions for Supabase apps

Why are Supabase RLS bugs so hard to catch?
RLS bugs leak data silently. The wrong rows just appear in the UI; nothing throws. Unit tests don’t exercise auth. Lastest signs in as user A, runs the flow, signs in as user B, and asserts B can’t see A’s data on screen. End-to-end RLS coverage as a visible diff.
Does Lastest test Supabase Auth (email/password, magic links, OAuth)?
Email/password and magic links are easy to record: paste a test inbox link or use a stable test account. OAuth round-trips are usually saved for manual smoke checks since the provider page is third-party; the rest of the auth flow records cleanly.
What about Supabase realtime subscriptions and RPC functions?
Lastest tests the rendered UI, so realtime updates and RPC results appear as DOM changes the recorder waits for. If a realtime channel breaks, the assertion times out; if an RPC returns wrong data, the screenshot diff catches it.
Will it work with Supabase storage and signed URLs?
Yes. The recorder follows file uploads and downloads, captures the resulting UI, and asserts on the rendered preview or download dialog.
How does it integrate with my Supabase migrations?
Run Lastest against your preview/staging environment after migrations apply. Schema changes that break the UI (renamed columns, dropped tables) surface as test failures or visual diffs against the previous baseline.
What does it cost?
Zero. Open source, self-hosted via Docker, unlimited screenshots. Pairs with Supabase free tier for a $0 full-stack test environment.

Add E2E tests
to your Supabase app.
In five minutes.

No cloud account. No API key. No procurement. Point it at your deployed URL and go. Open source, FSL-1.1-ALv2 licensed, $0 forever.

★ Star & Install from GitHub →
install

# 1. clone

$ git clone https://github.com/las-team/lastest

 

# 2. start

$ cd lastest && docker-compose up -d

 

# 3. record your auth flow

$ open http://localhost:3000

 

✓ test your auth. test your policies.