Learning to work with RLS

Does it sound like lovely music when I tell you that you’ll now fetch data based on the users’ permissions from the database that you created in the previous chapter? Well, I hope so because as we step into the realm of RLS, you’ll transform your multi-tenant application into a fortress of data integrity and peace of mind.

In this section, I’ll show you what happens if we fetch data with the normal Supabase client, without any RLS policy set up. Then, we’ll move on to understanding how a simple RLS can be set up and what effect it has on our data selection for signed-in users. From there, we’ll create RLS policies that enforce the permissions we set up in the previous chapter and talk about RLS implications and potential pitfalls. We’ll conclude by using so-called custom claims with RLS, allowing us to simplify tenant permission checks.

You will learn RLS by doing something that, UI-wise, sounds rather...