What is the BEST practice for having admin users of the soft

Question

What is the BEST practice for having admin users of the software that have the ability to bypass RLS and have full access to all data It s a business requirement and a must

Needle · Answer

Hello < tandyman> This thread has been automatically created from your message in < 843999948717555735> a ``few seconds ago`` Pinging < 951828363943759883> so that they see this as well Want to unsubscribe from this thread Right click the thread in Discord or use the menu and select Leave Thread to unsubscribe from future updates Want to change the title Use the ` title` command We have solved your problem Click the button below to archive it

Scott P · Answer

I would consider adding an `is admin` column to your public users table if you have one or adding that property to the metadata of the user Your RLS policies would then include an `OR` statement where `is admin`

tandyman · Answer

Ok

tandyman · Answer

Would the syntax look like this So like ` auth uid = agent id OR auth is admin `

tandyman · Answer

The stripe starter thing that I started building with did provide a public users table so yes I just added that column

tandyman · Answer

I keep getting syntax errors trying to figure out how to write it

Scott P · Answer

Yeah something like that ```sql auth uid = agent id OR is admin ``` Brackets are important

tandyman · Answer

uid = agent id OR user is admin fails

Scott P · Answer

You shouldn t need the `user` on the start of the or check as it s going to look up the column in the table that the policy applies to Personal preference is to also use `auth uid ` over just `uid ` I don t think it d make a difference but it ensures it s looking in the correct schema

tandyman · Answer

hmm it says is admin doesn t exist

tandyman · Answer

What happens now in the tool is each time I save it automatically re writes auth uid to uid sadly

tandyman · Answer

`user is admin` `auth is admin` and `is admin` all fail Sometimes it says doesn t exist or missing a FROM in the policy

Scott P · Answer

I ve just added the `is admin` column onto a test project and both the following allowed me to add the select policy ```sql is admin OR auth uid = id ``` or ```sql auth uid = id OR is admin ```

Scott P · Answer

For me `id` is the column where my users ID is stored but I don t see how calling it `agent id` would differ

tandyman · Answer

so agent id is just on that table on setting the policy on

tandyman · Answer

So the policy is for a table called client profiles and agent id is a part of that

tandyman · Answer

Probably because the foreign key is to the auth users table instead of the public one right

tandyman · Answer

That would make sense to me I m going to update that FK

tandyman · Answer

bah

tandyman · Answer

I still get `is admin` doesn t exist

tandyman · Answer

even if I simplify the heck out of the policy ```CREATE POLICY only admins can access ON public client profiles FOR SELECT USING is admin ```

tandyman · Answer

^ that s the preview before I try to hit save policy

tandyman · Answer

Maybe `is admin` needs to be in auth users rather than public users

garyaustin · Answer

Your policy is looking for is admin in client profiles

tandyman · Answer

Right so how do I access then

tandyman · Answer

It s strange to me that it works for scott just fine

garyaustin · Answer

he put it in the table he was doing RLS on

tandyman · Answer

ahh

garyaustin · Answer

You will have to select it I like putting that in a function with stable myself so it acts like auth uid something like isAdmin

tandyman · Answer

how in the world do i do that

tandyman · Answer

^ under here

garyaustin · Answer

First just get a OR with select working Hate to dig into functions at same time

tandyman · Answer

when you say I have to select it I have no idea what you are saying

tandyman · Answer

I m sorry

tandyman · Answer

The only templates that supabase gives are just using auth whatever

tandyman · Answer

Further what is interesting is in auth users I see a is super admin but I cannot edit anything in the auth users table in the supabase UI

tandyman · Answer

I was wondering if that is usable to just use that

garyaustin · Answer

OR SELECT is admin FROM public users WHERE auth uid = id is probably what you want where the last id is the uuid column in your public users table Don t mess with the auth users table

garyaustin · Answer

If you have RLS on public users then that will have to have OR is admin to bypass you don t need select there

tandyman · Answer

Nice

tandyman · Answer

Ok that works

tandyman · Answer

Having that recipe formula I can adjust that repeatedly to what I need I didn t know you can select within policy rule like that

garyaustin · Answer

RLS policy is just an extra where statement

tandyman · Answer

I see

tandyman · Answer

So above those are my policies on public users table

tandyman · Answer

It seems to work with those I didn t need to modify anything Does that seem right

garyaustin · Answer

Yeah in this case you are the uid for that row so don t need the admin thing there like I had said

tandyman · Answer

Ahh but for other people who are admins I will need to add the is admin there

garyaustin · Answer

No cause they will be logged in

tandyman · Answer

I m tracking with ya

garyaustin · Answer

Not sure why you have a public users table and a profile table I combine the two but it does not hurt just more to deal with

tandyman · Answer

client profiles is something very different it s a bit ambiguous

garyaustin · Answer

K

tandyman · Answer

Life insurance agents They have their clients and they create profiles for them and it contains all of their info scenarios debts etc

tandyman · Answer

^ updated

tandyman · Answer

Thx < garyaustin> again Also < Scott P> also for you getting me 75 of the way there You guys unblocked me and it s much appreciated

tandyman · Answer

Community is everything