Skip to content

Add support for FORCE ROW LEVEL SECURITY #214

@neglect-yp

Description

@neglect-yp

It would be great to support FORCE ROW LEVEL SECURITY in addition to the existing ENABLE ROW LEVEL SECURITY support.

Background

PostgreSQL provides two separate RLS controls:

  • ALTER TABLE ... ENABLE ROW LEVEL SECURITY - enables RLS on a table
  • ALTER TABLE ... FORCE ROW LEVEL SECURITY - forces RLS to apply to table owners as well

See: https://www.postgresql.org/docs/current/sql-altertable.html#SQL-ALTERTABLE-DESC-FORCE-ROW-LEVEL-SECURITY

NO FORCE/FORCE ROW LEVEL SECURITY
These forms control the application of row security policies belonging to the table when the user is the table owner. If enabled, row-level security policies will be applied when the user is the table owner. If disabled (the default) then row-level security will not be applied when the user is the table owner. See also CREATE POLICY.

Example

old.sql (current state):

CREATE TABLE users (
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    tenant_id UUID NOT NULL,
    username TEXT NOT NULL
);

ALTER TABLE users ENABLE ROW LEVEL SECURITY;

CREATE POLICY tenant_isolation_policy ON users
    USING (tenant_id = current_setting('app.current_tenant_id')::UUID);

new.sql (desired state):

CREATE TABLE users (
    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    tenant_id UUID NOT NULL,
    username TEXT NOT NULL
);

ALTER TABLE users ENABLE ROW LEVEL SECURITY;
ALTER TABLE users FORCE ROW LEVEL SECURITY;

CREATE POLICY tenant_isolation_policy ON users
    USING (tenant_id = current_setting('app.current_tenant_id')::UUID);

Actual plan:

No changes detected.

Expected plan:

ALTER TABLE users FORCE ROW LEVEL SECURITY;

Metadata

Metadata

Assignees

Labels

No labels
No labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions