jimmy/postgrest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: expose row-level can_edit/can_delete on select *

Browse Source 
Compute per-row editability and deletability from a table's row-level
security policies and return them as synthetic columns so clients can
hide edit/delete affordances for rows the user cannot change.

- Introspect pg_policies and relrowsecurity at schema-cache load and
  combine the UPDATE/DELETE USING qualifiers per table (permissive OR,
  restrictive AND).
- Store the combined qualifiers on Table and inject can_edit/can_delete
  as computed select fields when expanding `select *`, only for
  RLS-enabled tables with a matching policy (COALESCE'd to a boolean).
- Keep the computed columns out of the OpenAPI spec so they are not
  rendered as regular fields.
- Add a cfExpression field to CoercibleField to carry raw SQL
  expressions through the planner to SqlFragment.
This commit is contained in:
jimmy
2026-08-29 11:30:21 +02:00
parent 77ab8f83ac
commit 7989108b0b
11 changed files with 329 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/io/fixtures/privileges.sql
+5
View File
@@ -7,3 +7,8 @@ GRANT SELECT ON directors, films, awards TO postgrest_test_anonymous, postgrest_
GRANT ALL ON cats TO postgrest_test_anonymous;
GRANT ALL ON items_w_isolation_level TO postgrest_test_anonymous, postgrest_test_repeatable_read, postgrest_test_serializable;
GRANT SELECT ON rls_items TO postgrest_test_author;
GRANT UPDATE(name) ON rls_items TO postgrest_test_author;
GRANT DELETE ON rls_items TO postgrest_test_author;
GRANT SELECT ON no_rls_items TO postgrest_test_author;