Adding and optimizing RLS policies

As I said, we won’t be implementing editing comments in this book, but I’ll still create a policy for it so I can test updates with active policies directly in the database (with the impersonation feature you already know from Chapter 6). UI-wise, I want to be able to fetch and insert comments within a tenant to which I have access. Policy-wise, I want the updating and deletion of comments to only be allowed for its creators (created_by).

If we were to implement the DELETE or UPDATE policy for the author of a comment, it would look like this (however, don’t add this yet):

EXISTS (SELECT FROM service_users s WHERE s.id = created_by AND s.supabase_user = auth.uid())

You’ve already seen a similar statement for the deletion policy of the ticket.

For inserting and fetching comments, again, we would have to use the well-known expression that we’ve used in other policies (don’t add this one yet either...