All topics

do you use the table auth.users in supabase?

unicodes

24 days ago

I don't know if I made a mistake, but for me, Supabase was new, as was the concept of "public." that Supabase has. I didn't use the auth.users table, and because of this, I cannot use RLS (where only authenticated users can add content). Moving everything from the table I created (users) to auth.users will take a few days (not content but connections, foreign keys, queries, etc.). From the most experienced among you, I would like to understand what I am losing by not doing so.
Lucas G

24 days ago

auth table doesn't, or rather shouldn't, be a reason why you cannot use RLS
Lucas G

24 days ago

Generally speaking, you can't modify the users table in auth so things like permissions/roles would have to be managed by tables in your public schema anyways
Can you clarify what you mean by you didn't use auth.users? Users are automatically created here so it's not clear what you mean
Public schema isn't particular to Supabase btw, that's standard
@Lucas G
Can you clarify what you mean by you didn't use auth.users? Users are automatically created here so it's not clear what you mean
unicodes

24 days ago

This means that every foreign key created is on public.users.id, not on auth.users.id. There is a foreign key between public.users.auth_id and auth.users.id. For example, created_by (of any table) has a foreign key to public.users.id, not auth.users.id. At this stage of learning Supabase, I am not sure if I am doing something wrong by doing so.

I found out that you can create RLS and restrict it to authenticated users by adding auth.user (which is the default in Supabase). However, since there is no direct foreign key to auth.users, I am unsure if it would still default to auth.user() or if I made a mistake.
Lucas G

24 days ago

Short of it is though that you can use RLS policies no matter what and can use any table/function to evaluate whether or not a user can do something to the table in question. If you're using Supabase auth then you're using auth.users and the main thing to use from that in an RLS policy would be ( SELECT auth.uid() AS uid)
@unicodes
This means that every foreign key created is on public.users.id, not on auth.users.id. There is a foreign key between public.users.auth_id and auth.users.id. For example, created_by (of any table) has a foreign key to public.users.id, not auth.users.id. At this stage of learning Supabase, I am not sure if I am doing something wrong by doing so.

I found out that you can create RLS and restrict it to authenticated users by adding auth.user (which is the default in Supabase). However, since there is no direct foreign key to auth.users, I am unsure if it would still default to auth.user() or if I made a mistake.
Lucas G

24 days ago

In this case, no you wouldn't be able to directly use the helpers ( auth.uid() ) directly, you'd have to do match the created_by column to the id in your users table where auth_id equals auth.uid()
Lucas G

24 days ago

What have you been using if not RLS policies so far?
Or has your database just been open
unicodes

24 days ago

I have a column in users.auth_id foreign key to auth.user.id. Can I use that one?
unicodes

24 days ago

I'm using checks like (users.id), but thanks to Edwin, I just found out that Supabase has database injection vulnerabilities. I thought they were using a statement to prevent this by default.
@unicodes
I have a column in users.auth_id foreign key to auth.user.id. Can I use that one?
Lucas G

24 days ago

That's what I meant by this line:
Your RLS policies would have to check whether the created_by column in the column is equal to the id in your users table where auth_id equals auth.uid() from the querying user
@unicodes
I'm using checks like (users.id), but thanks to Edwin, I just found out that Supabase has database injection vulnerabilities. I thought they were using a statement to prevent this by default.
Lucas G

24 days ago

It's not just Supabase. ANY database needs to be secured from this type of thing
RLS policies are pretty much mandatory otherwise a database is open to anything
Lucas G

24 days ago

How are you doing the check to users.id though if not with RLS policies?
unicodes

24 days ago

In the query. Get the cars names where user_id is equal to users.id. Isn't something safe, just a where. I'm very noob regarding RLS and should to learn more because is not enoght what I'm doing.
unicodes

24 days ago

I used UUI everywhere and could be something more safe because you need to know the users IDs but isn't impossible to found it out.
unicodes

23 days ago

Noob level, right? 😆 Still learning! I'm doing this for passion, in a professional environment knowledge sharing would be more and learning as well more focused with clear path.
@unicodes
In the query. Get the cars names where user_id is equal to users.id. Isn't something safe, just a where. I'm very noob regarding RLS and should to learn more because is not enoght what I'm doing.
Lucas G

23 days ago

Ah then I could just a do a query without the where and pull all the data
unicodes

23 days ago

Yes
Lucas G

23 days ago

As a user, I could also delete the entire table
unicodes

23 days ago

Yes 🙂
Lucas G

23 days ago

😬
Lucas G

23 days ago

Yeah turn on policies asap
unicodes

23 days ago

I have to learn how to create an RLS rule to view and edit my own data, how to manage shared data (e.g., some cars should be visible only to users I assign them to), and how to allow only members of a park to see the cars.

RLS is enabled, but it's currently set to allow only authenticated users. I still need to implement these rules (after learning the concepts).
@Lucas G
That's what I meant by this line:
Your RLS policies would have to check whether the created_by column in the column is equal to the id in your users table where auth_id equals auth.uid() from the querying user
Lucas G

23 days ago

Your basic policy would be this
Lucas G

23 days ago

You’re about to go into the world of authorization which is a beast in and of itself, take your time
Lucas G

23 days ago

If your app uses accounts then you’ll have to update your users table to be an account table that has different users attached to it and then use roles and/or permissions to be able to declare who can view what
Go by steps though or you’ll be overwhelmed fast.
Start by creating your simple policy where you verify who owns the items
unicodes

23 days ago

I have to learn soon this because I see how important is. Just for understanding the risks, as it is now an auth user can use his token to add in Browser URL any request he wants and edit the query as he wants right? (never tried this).
unicodes

23 days ago

If this is right and that easy to do then I'm in the 💩
@unicodes
I have to learn soon this because I see how important is. Just for understanding the risks, as it is now an auth user can use his token to add in Browser URL any request he wants and edit the query as he wants right? (never tried this).
Lucas G

23 days ago

Correct
They can perform any operation on any table
unicodes

23 days ago

If you know some good video to learn RLS please share because I have to implement it ASAP.
At this moment I realize how vulnerable is the app.
unicodes

23 days ago

Thank you Lucas for your help! 🙏
Lucas G

23 days ago

Hmm you could start with Supabase's docs
I don't have any videos, sorry
Lucas G

23 days ago

The way I learned was through a lot of reading from different sources
I'm still learning
@Lucas G
The way I learned was through a lot of reading from different sources
unicodes

23 days ago

Thank you for all the support you've provided me! It has helped me a lot in learning Toddle, Supabase, and a ton of other things.
❤️1
❤️1
Lucas G

23 days ago

The nice thing about Supabase is that it also has a very large community. Not only that, it is just Postgres so you can learn about Postgres in general and it'll help
Both have very large communities so it is easy to find discussions and content on things
unicodes

23 days ago

You are right, even here on discord. Supabase community on discord is also friendly and always there to help.
unicodes

23 days ago

I'm eager to share with you the project I'm working on. If you want, after making it running well I can share the link with you.
Lucas G

23 days ago

Yeah share it with everyone
Always good to see toddle projects in production
🔥1
🔥1
@unicodes
If you know some good video to learn RLS please share because I have to implement it ASAP.
Armand

23 days ago

This one should get you started (if you haven’t already seen it): https://youtu.be/PdEutzhsrws?feature=shared
❤️1
❤️1
Armand

23 days ago

Also search for RBAC (role based acces control) in postgres
Edwin Paul

23 days ago

Alternatively, you can ask Supabase AI to write RLS policies for you. You can ask AI to help you understand what each line does and test the policies in the dashboard by switching roles. @unicodes
❤️1
❤️1
AI is an amazing teacher
@unicodes
I have to learn how to create an RLS rule to view and edit my own data, how to manage shared data (e.g., some cars should be visible only to users I assign them to), and how to allow only members of a park to see the cars.

RLS is enabled, but it's currently set to allow only authenticated users. I still need to implement these rules (after learning the concepts).
Edwin Paul

23 days ago

This is a policy i use to check if a user is allowed to see messages based on whether they're part of the chat or if they're the sender.
❤️1
❤️1
@Edwin Paul
This is a policy i use to check if a user is allowed to see messages based on whether they're part of the chat or if they're the sender.
unicodes

23 days ago

Wow! You can add complex logic inside! That's awesome! Thank you all for your support!
@Armand
This one should get you started (if you haven’t already seen it): https://youtu.be/PdEutzhsrws?feature=shared
unicodes

23 days ago

Thank you Armand! 🙏
👍1
👍1
@unicodes
Wow! You can add complex logic inside! That's awesome! Thank you all for your support!
Edwin Paul

23 days ago

Complex policies(querying other tables) on "VIEW" can consume a lot of your disk I/O bandwidth on scale. It's a good practice to create indexes as well.
🙏1
🙏1
@Edwin Paul
This is a policy i use to check if a user is allowed to see messages based on whether they're part of the chat or if they're the sender.
Lucas G

23 days ago

Take a look at performance advisor, it is likely recommending you to do something like ( SELECT auth.uid() AS uid) instead of auth.uid()
Reason being is that you're performing the same operation on every row
😮1
😮1
@Lucas G
Take a look at performance advisor, it is likely recommending you to do something like ( SELECT auth.uid() AS uid) instead of auth.uid()
Reason being is that you're performing the same operation on every row
Edwin Paul

23 days ago

Thanks bro
👍1
👍1

do you use the table auth.users in supabase?

unicodes

Lucas G

Lucas G

unicodes

Lucas G

Lucas G

Lucas G

unicodes

unicodes

Lucas G

Lucas G

Lucas G

unicodes

unicodes

unicodes

Lucas G

unicodes

Lucas G

unicodes

Lucas G

Lucas G

unicodes

Lucas G

Lucas G

Lucas G

unicodes

unicodes

Lucas G

unicodes

unicodes

Lucas G

Lucas G

unicodes

Lucas G

unicodes

unicodes

Lucas G

Armand

Armand

Edwin Paul

Edwin Paul

unicodes

unicodes

Edwin Paul

Lucas G

Edwin Paul

Stop scrolling. Start building.

Chat with @team-toddle

Video call our CEO

Get in touch!

Product

Company

Resources

Community