From e23b7afa3c089201438fad08c6e1a571d60ded39 Mon Sep 17 00:00:00 2001 From: Duncan Ogilvie Date: Mon, 23 Mar 2020 17:48:09 +0100 Subject: [PATCH] Fix the 'Roles for Each Web User' example (#313) Add missing `ALTER TABLE ... ENABLE ROW LEVEL SECURITY;` --- auth.rst | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/auth.rst b/auth.rst index fc05b2822..b762bc021 100644 --- a/auth.rst +++ b/auth.rst @@ -60,6 +60,8 @@ You can use row-level security to flexibly restrict visibility and access for th message_subject VARCHAR(64) NOT NULL, message_body TEXT ); + + ALTER TABLE chat ENABLE ROW LEVEL SECURITY; We want to enforce a policy that ensures a user can see only those messages sent by him or intended for him. Also we want to prevent a user from forging the message_from column with another person's name. @@ -95,7 +97,7 @@ SQL code can access claims through GUC variables set by PostgREST per request. F current_setting('request.jwt.claim.email', true) -This allows JWT generation services to include extra information and your database code to react to it. For instance the RLS example could be modified to use this current_setting rather than current_user. The second 'true' argument tells current_setting to return NULL if the setting is missing from the current configuration. +This allows JWT generation services to include extra information and your database code to react to it. For instance the RLS example could be modified to use this current_setting rather than current_user. The second 'true' argument tells current_setting to return NULL if the setting is missing from the current configuration. Hybrid User-Group Roles ~~~~~~~~~~~~~~~~~~~~~~~