CODEWITHSUNDEEP
postgresqlpostgrestsupabase
Patric
Patric

Reputation: 1627

Supabase / PostgREST: Deny select multiple

I am bulding a supabase app. Instead of a login every user gets a uuid (or multiple, if he wants to). Everyone that knows the uuid has full acces to the data behind this uuid.

So basically the database is open to anyone, as long as you use any valid uuid to write/read your stuff.

Now the problem: I don't want users being able to select all entries in the table. I want to enforce that every query has a condition where id = xxx. Of course I could do this in my app, but it is not enough, since we should never trust a client... I need to enforce this in the backend (i.e. in postgrest/supabase).

In firestore the read permission is broken down in get and list, so I can just allow get and disallow list and I am good to go. Is there something similar in postgrest/supabase?

Upvotes: 0

Views: 806

Answers (1)

Steve Chavez
Steve Chavez

Reputation: 1176

I want to enforce that every query has a condition where id = xxx.

This is exactly what a PostgreSQL RLS policy would do.

You have some examples on the supabase docs:

https://supabase.io/docs/guides/auth#policy-examples

Upvotes: 1

Related Questions