feat: add config to allow managing policies on tables #85
Conversation
|
Who creates Storage tables on Supabase? Is it the |
|
👍 Will add the docs.
Yup, we get to specify which tables are in the allowlist, similar to
The tables are created by |
README.md
Outdated
| ## Managing Policies Without Table Ownership | ||
|
|
||
| In Postgres, only table owners can create RLS policies for a table. This can be | ||
| limiting if you need to allow certain roles to manage policies without allowing | ||
| them to perform other DDL (e.g. to prevent them from dropping the table). | ||
|
|
||
| With supautils, this can be done like so: | ||
|
|
||
| ``` | ||
| supautils.privileged_role = 'my_privileged_role' | ||
| supautils.privileged_role_allow_policies_on_tables = 'public.not_my_table, public.also_not_my_table' | ||
| ``` | ||
|
|
||
| This allows `my_privileged_role` to manage policies for `public.not_my_table` | ||
| and `public.also_not_my_table` without being an owner of these tables. | ||
|
|
There was a problem hiding this comment.
Thinking more about this. What you really want is something like GRANT CREATE POLICY ON TABLE TO <role>. Maybe this feature can be done with a single config.
There was a problem hiding this comment.
Yup exactly, all this isn't needed if POLICY is a table privilege, that way we can decouple it from table ownership.
This is already a single config though, the privileged_role is a config we already use for other things (e.g. privileged_role_allowed_configs)
There was a problem hiding this comment.
Ok, cool. So since supautils adds security mechanisms that aren't in postgres yet, I think the proper design for this is:
supautils.grant_create_policy = '{"role1": ["table1", "table2"]}'This way it's a generic solution and not just Supabase-specific.
(I know it's not exactly GRANT CREATE POLICY since it's global but it's the best we can do without creating tables)
Also done this way later:
- We won't cause a breaking change
- We can use this flexibility if the need arises
|
Updated the PR to use a more generic |
What kind of change does this PR introduce?
Feature
What is the current behavior?
Only table owners can create RLS policies. This is limiting because e.g. for Supabase Storage we want users to be able to create policies on certain Storage tables but not allow them to perform all DDL on them (which tables owners can do).
What is the new behavior?
Decouple the privileges for managing a table's policies from the table's ownership. With
supautils.policy_grants, the privileged role can manage policies on a set of tables without being the table owner.