Skip to content

Update rls.mdx: fix table schema to match CRDT requirements and best practices, add an example for the RLS delete policy #126

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Aug 7, 2025
Merged

Update rls.mdx: fix table schema to match CRDT requirements and best practices, add an example for the RLS delete policy #126

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 18 additions & 11 deletions sqlite-cloud/platform/rls.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,9 +85,9 @@ Suppose you have a `tasks` table with the following schema:

```sql
CREATE TABLE tasks (
id INTEGER PRIMARY KEY,
id TEXT PRIMARY KEY NOT NULL,
user_id TEXT,
title TEXT,
owner_id INTEGER,
status TEXT
);
```
Expand All @@ -98,39 +98,46 @@ Here are a few examples of RLS policies you can create:

```sql
-- SELECT policy
owner_id = auth_userid()
user_id = auth_userid()
```

**2. Users can only insert tasks for themselves.**

```sql
-- INSERT policy
NEW.owner_id = auth_userid()
NEW.user_id = auth_userid()
```

**3. Users can only update the status of their own tasks.**

```sql
-- UPDATE policy
OLD.owner_id = auth_userid()
OLD.user_id = auth_userid()
```

**4. Users with the 'admin' group can see all tasks.**
**4. Users can only delete their own tasks.**

```sql
-- DELETE policy
OLD.user_id = auth_userid()
```

**5. Users with the 'admin' group can see all tasks.**

```sql
-- SELECT policy
json_extract(auth_json(), '$.attributes.group') = 'admin'
```

**5. Role-Based Access within a Tenancy**
**6. Role-Based Access within a Tenancy**

```sql
-- SELECT policy
org_id = json_extract(auth_json(), '$.attributes.org_id') AND
(json_extract(auth_json(), '$.attributes.role') = 'admin' OR owner_id = auth_userid())
(json_extract(auth_json(), '$.attributes.role') = 'admin' OR user_id = auth_userid())
```

**6. Access via a Membership Linking Table**
**7. Access via a Membership Linking Table**

```sql
-- SELECT policy
Expand All @@ -141,11 +148,11 @@ EXISTS (
)
```

**7. Public vs. Private Record Visibility**
**8. Public vs. Private Record Visibility**

```sql
-- SELECT policy
visibility = 'public' OR owner_id = auth_userid()
visibility = 'public' OR user_id = auth_userid()
```

With these policies, when a user executes a query, SQLite Cloud will automatically enforce the defined RLS rules, ensuring data security and compliance.
Expand Down