Supabase is an open source Firebase alternative. Start your project with a Postgres database, Authentication, instant APIs, Edge Functions, Realtime subscriptions, and Storage.

Supabase

Is there a way to only allow selecting rows with known id's using RLS? I'd like my database to be public but only for accessing records with known ID's.
Something where a RLS policy would require a where clause on the id column.

Hello <@458296024994414612>!
This thread has been automatically created from your message in <#843999948717555735> a ``few seconds ago``.

Pinging <@&951828363943759883> so that they see this as well!

**Want to unsubscribe from this thread?**
Right-click the thread in Discord (or use the ... menu) and select **Leave Thread** to unsubscribe from future updates.

**Want to change the title?**
Use the `/title` command!

**We have solved your problem?**
Click the button below to archive it.

🆕 Restricting Select with a known ID using RLS

Yeah you can do that, remember you are just writing SQL inside of a RLS policy.

Restricting Select with a known ID using RLS

How can a policy check if a where clause is used?

And nice to see you here <@107176742342402048>  🙂

It can't check if a where clause is being used, what you can do is create an allowlist with ids that can be accessed from any query.

Unless I'm not understanding what you are trying to accomplish well enough?

Good to see a fellow Svelte user over here too.

Ah no. id want to have users access all, as long as they know the ID. so I'd have clients store the id somewhere. but not go through the hassle of setting up user accounts.

I'm still not clear on what you are trying to accomplish

I want not the whole set of data to be disoverable.

So users should only be allowed to query by id, not get all the records.

I can also make a private endpoint. prolly be doing that now.

I guess you can create a Database function with the ID as parameter and then return the row

Be sure to use non guessable ids though, else this is vulnerable to resource enumeration.

i've been thinking about it. but it doesn't allow for subscribing to those records.

so it seems that RLS is designed for use with auth.user() in the constraints. instead of only selecting rows with specific uuid's

can you elaborate on the broader problem you are trying to solve?

It can be used for almost any sql queries, but you are asking for it to restrict a feature or SQL which it cannot do as it has no way of knowing if you are querying for one or for all records.