Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Setup Row Level CRUD for things like Users. e.g. the logged in user should be able to edit their own user even if they shouldnt be able to edit others. #100

Closed
jacebenson opened this issue Dec 10, 2021 · 4 comments
Assignees

Comments

@jacebenson
Copy link
Contributor

jacebenson commented Dec 10, 2021

I'm not sure the best way to do this, at the time of writing, this can be accomplished with before read rules. I don't like this but, it would make life pretty simple. Just modify the query appropriately for the logged in user.
If they only can see their records, when they do a search for preferences containing language, then append { userId: session.user.id } to each of their queries.

Another option would be to make another folder for these kind of rules where by role we limit what they can see.

@jacebenson
Copy link
Contributor Author

#104 is part of this.

@jacebenson
Copy link
Contributor Author

You can add where clauses to update, and delete calls in prisma.
This should simplify RLS for api side.

@jacebenson
Copy link
Contributor Author

This will be handled with "before" "read" and "readAll" rules to add proper where clauses.

@jacebenson
Copy link
Contributor Author

This is done and just needs some docs on it here: tskrio/docs#10

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant