Database RPC/function references exist in schema

A hallucinated RPC function name is more disruptive than a hallucinated table name: Supabase .rpc() calls to non-existent functions return a PostgREST 404 error immediately rather than an empty result set, causing hard failures in dashboards, analytics, and any server action that delegates business logic to the database. This is a reference-integrity gap (OWASP A08) specific to Supabase projects where the AI correctly patterns the .rpc() call but invents the function name. Unlike missing tables, there is no partial fallback — the entire call fails, and the error message (function get_dashboard_data() does not exist) requires knowing to look in migration SQL to diagnose.

Verify the function name against your migration SQL, then either fix the call to match an existing function or create the missing function in a new migration.

-- supabase/migrations/042_add_dashboard_rpc.sql
CREATE OR REPLACE FUNCTION public.get_dashboard_data(p_user_id UUID)
RETURNS TABLE (metric TEXT, value BIGINT) AS $$
BEGIN
  RETURN QUERY
  SELECT 'submissions'::TEXT, COUNT(*)::BIGINT
  FROM submissions
  WHERE user_id = p_user_id;
END;
$$ LANGUAGE plpgsql SECURITY DEFINER;

Apply with supabase db push. The function name in .rpc('get_dashboard_data') must match the CREATE FUNCTION public.get_dashboard_data name exactly — Supabase strips the public. prefix in RPC calls. Run supabase gen types typescript after adding the function to get type-checked RPC argument validation.