Migrating from Supabase

Re:Migrating from Supabase by mfalcao on Friday May 19, 2023 @07:57PM (#36008130)

RLS is great, but it's not that hard to shoot yourself in the foot or miss stuff. E.g.:

  ALTER TABLE bookmarks ENABLE ROW LEVEL SECURITY;
  CREATE POLICY bookmarks_owner ON bookmarks USING (owner_id = auth.uid());
  CREATE VIEW recent_bookmarks AS SELECT * FROM bookmarks ORDER BY created_at DESC LIMIT 5;

The above may look fine at first glance, but recent_bookmarks actually bypasses RLS.

[ Parent | on HN ]

Re:Migrating from Supabase by steve-chavez on Friday May 19, 2023 @09:07PM (#36008489)

For that there's security invoker now:

  CREATE VIEW recent_bookmarks WITH (security_invoker=true) AS 
  SELECT * FROM bookmarks ORDER BY created_at DESC LIMIT 5;

Point taken though, it's not the default behavior.

[ Parent | on HN ]

Re:Migrating from Supabase by mfalcao on Friday May 19, 2023 @10:39PM (#36008920)

Indeed - one of the great changes in v15. (for any folks on previous versions, you need to change the view owner to a non-superuser role without the bypassrls attribute).

Thanks for all your work on PostgREST, Steve! Do you think we'll see relational inserts in the near future, or is that still a bit down the road?

[ Parent | on HN ]