Supabase is an open source Firebase alternative. Start your project with a Postgres database, Authentication, instant APIs, Edge Functions, Realtime subscriptions, and Storage.

Supabase

you have a similar example in allowing access based on email template

User table rather than auth . It feels like this works on everything apart from insert?

I'm guessing it doesn't know what the Id we're trying to insert is.. but what's the point of rls if you can't check before inserting!

This (and the example above it) might help:

https://supabase.com/docs/guides/auth/row-level-security#policies-with-security-definer-functions

you have access to the inserted data on check so shopID gets you that value

Firstly thanks for helping <@764524500162445402> - I tried something like shopID IN (SELECT shopID FROM shop_access WHERE userID = uid()) and still no luck . Seems very odd! Really not sure why it doesn't work

Do you have RLS on shop_access and if so select access for uid?

Yeh! But the way your saying this makes me think I need to persevere, must be something basic going on

I'm guessing you've done this before right, I'm not making up an anti pattern of postgre or something?

I use the security definer function route myself, but what you have above seems to be the same as what SB select example does as far as that specific code.

Awesome.. thanks so much for your help Gary, really appreciate it!!

Hey <@!313441475151134721> if you are doing insert you need to be doing WITH CHECK not USING (as in the example for updates).  That looks at new data.

You can create a special rule for insert, where anyone can insert.

I'm not too sure about more than that though, I usually use Django for more complex stuff, but there must be a way

I'm guessing you can let anyone insert and then use a trigger to add the inserter to the access table. Either that or have a creator field, and have another RLS rule that allows the creator to perform all operations (bypassing the access table)

Sorry if that might be a dumb question, but does RLS work for views?

I don't think so.   You might be able to use an RPC function though to return a "secure" table.  You also can add a where clause to the view with some checks.

It actually depends what you mean by "work for views". The answer is NOT simple but it is rougly this:
 - you CANNOT define RLS on a view;
 - a view is always executed in the context of the postgres role which defined the view;
 - a view will still respect the RLS defined on the underlying table AS LONG AS the role which defined the view does NOT bypass RLS altogether (such roles are superusers and roles that have the BYPASSRLS permission - this is true for the user in the Supabase SQL editor, so if you define views there, they will NOT respect RLS)

you can read more here: https://www.cybertec-postgresql.com/en/postgresql-row-level-security-views-and-a-lot-of-magic/

"You also can add a where clause to the view with some checks." - this is definitely an option, just keep in mind that this approach usually requires to mark the view with a security_barrier (you can read more about it here: https://www.postgresql.org/docs/13/rules-privileges.html)

Inserting with RLS  dependent on another table check

So the issue I've been having with raw user meta data not working was resolved by updating the supabase js package.

Hey im having an error adding a foreign key relation in dashboard

wud appreciate it if someone can tell me why this is happening

Hi. Does anyone knows what operation that resets the "inactivity counter" for free tier? Have an instance  where we access the postgres database directly that got paused today. It is in daily use -> database activity does not count as "activity" in this case

Hey, Im struggling to find resources about data validation in Supabase. I mean cases like e-mail field validation, field min and max length and other formatting validation usually made on backend side. How should it be handled in Supabase, by RLS. Does anyone have some sample? 🙂

I’m on mobile and will be brief. I think you are after check constraints as per https://www.postgresql.org/docs/13/ddl-constraints.html

Link to docs is perfect enough 👌I will try it, thank you 🙏

Wondering if someone can help me select all from a table and then join two other tables using supabase syntax

```
.select(`
    *,
    contracts (
      name,
      id
    ),
    collections(
      name,
      discord_url
    )
  `)
```
Anyone have some advice?

Hello can anyone PM me I think I have a dangling connection on supabase which is killing my prisma migration attempts.

Do you have a error message? The select looks fine if you have a fk relation to contracts and collections