Feature request: Disable all write access to the database by client (API/functions/storage/etc.)

[bennettdams]

Feature request

Is your feature request related to a problem? Please describe.

I'm looking for a way to prevent any writes happening by the client as an anon user AND an authenticated user.

I'm using Next.js & Prisma with Supabase for the database, auth and storage.
I do all my changes via Next.js API endpoints, no writes are happening via the client e.g. in the browser.
In these API endpoints I check for authentication or even if that user is allowed to execute the edit he wanted to.

Describe the solution you'd like

Right now, I don't think there's a way to disable all writes from the client.
Only I (the code in my API) should be allowed to make any writes. So wherever I execute writes to the database (via Prisma), which is mostly API endpoints.

The exception are writes to the storage, where inside an API endpoint I e.g. upload a file on behalf of the user, something like:

  import { createServerSupabaseClient } from '@supabase/auth-helpers-nextjs'
  ...

  const supabaseServer = createServerSupabaseClient({ req, res })

  const { error } = await supabaseServer.storage
    .from(...)
    .upload(...), fileParsed, {
      upsert: true,
      contentType: 'image/jpg',
    })

Describe alternatives you've considered

I found two discussions for this topic...

• Option to disable anon key access to database #4547
• Is there a way to disable API access? #4869 (reply in thread)

...but I think both of them are not as far-reaching as what I'm requesting here.