-
Notifications
You must be signed in to change notification settings - Fork 29
Description
It would be great to support FORCE ROW LEVEL SECURITY in addition to the existing ENABLE ROW LEVEL SECURITY support.
Background
PostgreSQL provides two separate RLS controls:
ALTER TABLE ... ENABLE ROW LEVEL SECURITY- enables RLS on a tableALTER TABLE ... FORCE ROW LEVEL SECURITY- forces RLS to apply to table owners as well
NO FORCE/FORCE ROW LEVEL SECURITY
These forms control the application of row security policies belonging to the table when the user is the table owner. If enabled, row-level security policies will be applied when the user is the table owner. If disabled (the default) then row-level security will not be applied when the user is the table owner. See also CREATE POLICY.
Example
old.sql (current state):
CREATE TABLE users (
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
tenant_id UUID NOT NULL,
username TEXT NOT NULL
);
ALTER TABLE users ENABLE ROW LEVEL SECURITY;
CREATE POLICY tenant_isolation_policy ON users
USING (tenant_id = current_setting('app.current_tenant_id')::UUID);new.sql (desired state):
CREATE TABLE users (
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
tenant_id UUID NOT NULL,
username TEXT NOT NULL
);
ALTER TABLE users ENABLE ROW LEVEL SECURITY;
ALTER TABLE users FORCE ROW LEVEL SECURITY;
CREATE POLICY tenant_isolation_policy ON users
USING (tenant_id = current_setting('app.current_tenant_id')::UUID);Actual plan:
No changes detected.
Expected plan:
ALTER TABLE users FORCE ROW LEVEL SECURITY;Reactions are currently unavailable