jimmy
7989108b0b
Compute per-row editability and deletability from a table's row-level security policies and return them as synthetic columns so clients can hide edit/delete affordances for rows the user cannot change. - Introspect pg_policies and relrowsecurity at schema-cache load and combine the UPDATE/DELETE USING qualifiers per table (permissive OR, restrictive AND). - Store the combined qualifiers on Table and inject can_edit/can_delete as computed select fields when expanding `select *`, only for RLS-enabled tables with a matching policy (COALESCE'd to a boolean). - Keep the computed columns out of the OpenAPI spec so they are not rendered as regular fields. - Add a cfExpression field to CoercibleField to carry raw SQL expressions through the planner to SqlFragment.
15 lines
757 B
SQL
15 lines
757 B
SQL
GRANT USAGE ON SCHEMA v1 TO postgrest_test_anonymous;
|
|
GRANT USAGE ON SCHEMA test TO postgrest_test_anonymous;
|
|
|
|
GRANT SELECT ON authors_only TO postgrest_test_author;
|
|
GRANT SELECT ON projects TO postgrest_test_anonymous, postgrest_test_w_superuser_settings;
|
|
GRANT SELECT ON directors, films, awards TO postgrest_test_anonymous, postgrest_test_w_superuser_settings;
|
|
|
|
GRANT ALL ON cats TO postgrest_test_anonymous;
|
|
GRANT ALL ON items_w_isolation_level TO postgrest_test_anonymous, postgrest_test_repeatable_read, postgrest_test_serializable;
|
|
|
|
GRANT SELECT ON rls_items TO postgrest_test_author;
|
|
GRANT UPDATE(name) ON rls_items TO postgrest_test_author;
|
|
GRANT DELETE ON rls_items TO postgrest_test_author;
|
|
GRANT SELECT ON no_rls_items TO postgrest_test_author;
|