diff --git a/auth.rst b/auth.rst index 7aaa9eabd..8d0f6df50 100644 --- a/auth.rst +++ b/auth.rst @@ -46,7 +46,7 @@ PostgreSQL manages database access permissions using the concept of roles. A rol Roles for Each Web User ~~~~~~~~~~~~~~~~~~~~~~~ -PostgREST can accommodate either viewpoint. If you treat a role as a single user then the the JWT-based role switching described above does most of what you need. When an authenticated user makes a request PostgREST will switch into the role for that user, which in addition to restricting queries, is available to SQL through the :code:`current_user` variable. +PostgREST can accommodate either viewpoint. If you treat a role as a single user then the JWT-based role switching described above does most of what you need. When an authenticated user makes a request PostgREST will switch into the role for that user, which in addition to restricting queries, is available to SQL through the :code:`current_user` variable. You can use row-level security to flexibly restrict visibility and access for the current user. Here is an `example `_ from Tomas Vondra, a chat table storing messages sent between users. Users can insert rows into it to send messages to other users, and query it to see messages sent to them by other users.