From 0dc33dbf9fdcee400395f6d1845a29c807a3704f Mon Sep 17 00:00:00 2001
From: opensrcken <opensrcken@gmail.com>
Date: Sun, 8 May 2016 09:31:28 -0700
Subject: [PATCH] =?UTF-8?q?fix=20row=20level=20security=20readme=20per=20h?=
 =?UTF-8?q?ttps://github.com/begriffs/postgre=E2=80=A6=20(#579)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix row level security readme per https://github.com/begriffs/postgrest/issues/554

* handle anonymous access to posts / comments tables

* address insertion use case in row-level security readme
---
 docs/examples/blog.md | 45 ++++++++++++++++++++++++++++++++++++-------
 1 file changed, 38 insertions(+), 7 deletions(-)

diff --git a/docs/examples/blog.md b/docs/examples/blog.md
index b5cbdcb2d..604f860a8 100644
--- a/docs/examples/blog.md
+++ b/docs/examples/blog.md
@@ -71,21 +71,52 @@ security](http://www.postgresql.org/docs/9.5/static/ddl-rowsecurity.html).
 Note that it requires PostgreSQL 9.5 or later.
 
 ```sql
+grant select on posts, comments to anon;
+
 ALTER TABLE posts ENABLE ROW LEVEL SECURITY;
-drop policy if exists authors_eigenedit on posts;
-create policy authors_eigenedit on posts
-  using (true)
+ALTER TABLE comments ENABLE ROW LEVEL SECURITY;
+
+drop policy if exists posts_select_unsecure on posts;
+create policy posts_select_unsecure on posts for select
+  using (true);
+
+drop policy if exists comments_select_unsecure on comments;
+create policy comments_select_unsecure on comments for select
+  using (true);
+
+drop policy if exists authors_eigencreate on posts;
+create policy authors_eigencreate on posts for insert
   with check (
     author = basic_auth.current_email()
   );
 
-ALTER TABLE comments ENABLE ROW LEVEL SECURITY;
-drop policy if exists authors_eigenedit on comments;
-create policy authors_eigenedit on comments
-  using (true)
+drop policy if exists authors_eigencreate on comments;
+create policy authors_eigencreate on comments for insert
+  with check (
+      author = basic_auth.current_email()
+  );
+
+drop policy if exists authors_eigenedit on posts;
+create policy authors_eigenedit on posts for update
+  using (author = basic_auth.current_email())
   with check (
     author = basic_auth.current_email()
   );
+
+drop policy if exists authors_eigenedit on comments;
+create policy authors_eigenedit on comments for update
+  using (author = basic_auth.current_email())
+  with check (
+    author = basic_auth.current_email()
+  );
+
+drop policy if exists authors_eigendelete on posts;
+create policy authors_eigendelete on posts for delete
+  using (author = basic_auth.current_email());
+
+drop policy if exists authors_eigendelete on comments;
+create policy authors_eigendelete on comments for delete
+  using (author = basic_auth.current_email());
 ```
 
 Finally we need to modify the `users` view from the previous example.