Supabase is an open source Firebase alternative. Start your project with a Postgres database, Authentication, instant APIs, Edge Functions, Realtime subscriptions, and Storage.

Supabase

I'm kinda stuck writing such a policy :

```sql
CREATE POLICY "policy_companies_country_view"
ON companies_country_view
FOR SELECT USING (
  // I want the id to be provided for SELECT to be allowed, i.e. 'WHERE id = xxx' required
  // I dont want to allow the entire table to be seen, but only to allow a single line operation
);
```

Any idea ?

Hello <@210882495707742219>!
This thread has been automatically created from your message in <#843999948717555735> a ``few seconds ago``.

Pinging <@&951828363943759883> so that they see this as well!

**Want to unsubscribe from this thread?**
Right-click the thread in Discord (or use the ... menu) and select **Leave Thread** to unsubscribe from future updates.

**Want to change the title?**
Use the `/title` command!

**We have solved your problem?**
Click the button below to archive it.

This is not possible afaik. Policies aren't evaluated against the query, rather the row. One thing you can do is block select altogether, and use a `rpc` function to access one row at a time.

ok thx <@!691954098869895178> . I just want to force the `id` argument on the API call at this point. any way to do that?

Not without modifying kong config or postgrest.

I guess that means I have to use a SSR frontend if I don't want people to be able to see my entire table

No, generally what you want to do is to use policies to restrict access based on ownership

Then you write the front end code to access what you need for the view.

Well, there's no authentification. I only use the anon token. I just need to avoid any `SELECT *` on a specific table and only allow `SELECT * WHERE id = xx`. Whcih I guess I can contain with a SSR frontend

In that case, you can use a stored procedure as I mentioned initially

1. Make the select policy `using (false)`
2.  Create a function to select one row,
```
 CREATE FUNCTION getfoo(int) RETURNS SETOF foo AS $$
    SELECT * FROM foo WHERE fooid = $1;
$$ LANGUAGE SQL;
```
3. Call that function in the frontend using `rpc`

You also need to make that function "security definer"