Can I make a blanket RLS Policy to restrict the pu...
# helpk
knoppoly
07/26/2022, 3:39 PMCan I make a blanket RLS Policy to restrict the public schema to only authenticated users?
n
Needle
07/26/2022, 3:39 PMHello @knoppoly!
This thread has been automatically created from your message in #843999948717555735 a few seconds ago.
We have already mentioned the @User so that they can see your message and help you as soon as possible!
Want to unsubscribe from this thread?
Right-click the thread in Discord (or use the ``...`` menu) and select "Leave Thread" to unsubscribe from future updates.
Want to change the title?
Use the ``/title`` command!
We have solved your problem?
Click the button below to archive it.
g
garyaustin
07/26/2022, 3:49 PMRLS policy is per table only.
If you google "postgres schema grants" you will get information on controlling access to a schema. Then refine to include public.
The public schema defaults with access for everyone. I've created new schemas and added grants to them, but not tried to remove, then add back desired grants for the public schema. You would have to get all the needed Supabase roles grants back (besides not including anon role). You need to be careful doing this, and be prepared to start with a new instance if you mess it up too badly. You should also be able to find all the grants needed for SB by googling. I've seen them, but don't have a link.
k
knoppoly
07/26/2022, 4:16 PMI figured out an easy way to do it
knoppoly
07/26/2022, 4:16 PMPut RLS on every table, to block out non-authed users
knoppoly
07/26/2022, 4:16 PMthen alter the role 'authenticated' to bypass rls
g
garyaustin
07/26/2022, 4:17 PMWhy not just allow authenticated users?
k
knoppoly
07/26/2022, 4:17 PMyou mean through policies?
knoppoly
07/26/2022, 4:17 PMI didn't see how to do that all in one place
knoppoly
07/26/2022, 4:18 PMand making a policy for every join seems tedious
g
garyaustin
07/26/2022, 4:18 PMYes. If you are going to put it on each table (which is the way I would go versus grants)
garyaustin
07/26/2022, 4:18 PMOh I see, just turn on RLS, no policy.
k
knoppoly
07/26/2022, 4:18 PMYeah exactly
knoppoly
07/26/2022, 4:19 PMbecause I want any user to be able to access everything, and controlling it all in one spot seems easier
knoppoly
07/26/2022, 4:19 PMthis is my first time with Supabase and postgres, so if I'm doing something silly let me know lol
g
garyaustin
07/26/2022, 4:19 PMUntil you need to protect a table yes from authenticated from doing something....
garyaustin
07/26/2022, 4:20 PMI'd personally just do the RLS with policy for all and click authenticated in the to field. Someday you are going to have something you need to control.
k
knoppoly
07/26/2022, 4:21 PMI tried that, but then I started using joins and I didn't see how to fix it
knoppoly
07/26/2022, 4:21 PMeach table had a RLS policy that the authed user could use
g
garyaustin
07/26/2022, 4:22 PMYou also could be screwing up realtime if you decided to use it.
k
knoppoly
07/26/2022, 4:22 PMbut I couldnt get my data through the join in the api call
knoppoly
07/26/2022, 4:22 PMhmm, do you know how to allow any joins through the RLS policies too then?
g
garyaustin
07/26/2022, 4:23 PMIf your RLS is just authenticated as role and true for policy that should work for everything.
garyaustin
07/26/2022, 4:29 PMSorry if I'm not understanding your "join" issue. I've got to run. You probably will want to ask a new question if you want more help.
k
knoppoly
07/26/2022, 4:29 PMNo problem, thank you for the help 🙂
knoppoly
07/26/2022, 4:32 PMyeah it works now
knoppoly
07/26/2022, 4:32 PMI needed "true" in both spots, not just the bottom one which is what the template does