Row level security best practice for join tables -- curious if anyone has advice / experience setting RLS on a join table? I have a many-to-many relationship between artists and tags. Users can assign many tags to different artists. Is it necessary to have a user_id column on the join table?

Hello @Derek! This thread has been automatically created from your message in #843999948717555735 a few seconds ago. We have already mentioned the @User so that they can see your message and help you as soon as possible! Want to unsubscribe from this thread? Right-click the thread in Discord (or use the ``...`` menu) and select "Leave Thread" to unsubscribe from future updates. Want to change the title? Use the ``/title`` command! We have solved your problem? Click the button below to archive it.

Can you clarify what you want the RLS to do on the join table?

Users can CRUD artists and tags. The question is what the best way to prevent CRUD on a join table for the unauthenticated; not sure if this is inherited by the FK or if it can be done via postgres roles, or if I should add a user_id column to the join table as well.

If any signed in user can update any tag then you just need to check role for authenticated. If a user can only modify or delete his own tags then you need user_id to compare to uid() in delete, update.