Merge pull request #183 from supabase/rls

feat: broadcast changes based on RLS (Row-Level Security) policies

Author: w3b6x9

examples/next-js/package-lock.json

@@ -7,7 +7,7 @@
     "start": "next start"
   },
   "dependencies": {
-    "@supabase/realtime-js": "^1.0.6",
+    "@supabase/realtime-js": "^1.2.1",
     "axios": "^0.21.2",
     "chart.js": "^2.9.4",
     "dotenv": "^8.2.0",

examples/next-js/package.json

@@ -0,0 +1,16 @@
+version: '3'
+services:
+  db:
+    image: supabase/postgres
+    ports:
+      - 5432:5432
+    volumes:
+      - ./sql/setup.sql:/docker-entrypoint-initdb.d/setup.sql
+      - ./sql/walrus--0.1.sql:/docker-entrypoint-initdb.d/walrus--0.1.sql
+    command:
+      - postgres
+      - -c
+      - wal_level=logical
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres

rls_setup/docker-compose.db.yml

@@ -0,0 +1,32 @@
+version: '3'
+services:
+  realtime:
+    image: realtime/walrus
+    build: .
+    ports:
+      - 4000:4000
+    environment:
+      DB_HOST: db
+      DB_NAME: postgres
+      DB_USER: postgres
+      DB_PASSWORD: postgres
+      DB_PORT: 5432
+      PORT: 4000
+      JWT_SECRET: SOMETHING_SUPER_SECRET
+      SECURE_CHANNELS: 'true'
+    depends_on:
+      - db
+  db:
+    image: supabase/postgres
+    ports:
+      - 5432:5432
+    volumes:
+      - ./sql/setup.sql:/docker-entrypoint-initdb.d/setup.sql
+      - ./sql/walrus--0.1.sql:/docker-entrypoint-initdb.d/walrus--0.1.sql
+    command:
+      - postgres
+      - -c
+      - wal_level=logical
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres

rls_setup/docker-compose.dev.yml

@@ -0,0 +1,119 @@
+-- Copied from https://github.com/supabase/walrus/blob/f54b2b1657c8348ce9e22c92092eaa50bfa8993a/sql/setup.sql
+
+/*
+    SETUP
+*/
+-- Set up reatime
+create publication supabase_realtime for all tables;
+
+-- Extension namespacing
+create schema extensions;
+create extension if not exists "uuid-ossp"      with schema extensions;
+
+-- Developer roles
+create role anon                nologin noinherit;
+create role authenticated       nologin noinherit; -- "logged in" user: web_user, app_user, etc
+create role service_role        nologin noinherit bypassrls; -- allow developers to create JWT's that bypass their policies
+
+create user authenticator noinherit;
+grant anon              to authenticator;
+grant authenticated     to authenticator;
+grant service_role      to authenticator;
+
+grant usage                     on schema public to postgres, anon, authenticated, service_role;
+alter default privileges in schema public grant all on tables to postgres, anon, authenticated, service_role;
+alter default privileges in schema public grant all on functions to postgres, anon, authenticated, service_role;
+alter default privileges in schema public grant all on sequences to postgres, anon, authenticated, service_role;
+
+CREATE SCHEMA IF NOT EXISTS auth AUTHORIZATION postgres;
+
+-- auth.users definition
+CREATE TABLE auth.users (
+    instance_id uuid NULL,
+    id uuid NOT NULL,
+    aud varchar(255) NULL,
+    "role" varchar(255) NULL,
+    email varchar(255) NULL,
+    encrypted_password varchar(255) NULL,
+    confirmed_at timestamptz NULL,
+    invited_at timestamptz NULL,
+    confirmation_token varchar(255) NULL,
+    confirmation_sent_at timestamptz NULL,
+    recovery_token varchar(255) NULL,
+    recovery_sent_at timestamptz NULL,
+    email_change_token varchar(255) NULL,
+    email_change varchar(255) NULL,
+    email_change_sent_at timestamptz NULL,
+    last_sign_in_at timestamptz NULL,
+    raw_app_meta_data jsonb NULL,
+    raw_user_meta_data jsonb NULL,
+    is_super_admin bool NULL,
+    created_at timestamptz NULL,
+    updated_at timestamptz NULL,
+    CONSTRAINT users_pkey PRIMARY KEY (id)
+);
+CREATE INDEX users_instance_id_email_idx ON auth.users USING btree (instance_id, email);
+CREATE INDEX users_instance_id_idx ON auth.users USING btree (instance_id);
+-- auth.refresh_tokens definition
+CREATE TABLE auth.refresh_tokens (
+    instance_id uuid NULL,
+    id bigserial NOT NULL,
+    "token" varchar(255) NULL,
+    user_id varchar(255) NULL,
+    revoked bool NULL,
+    created_at timestamptz NULL,
+    updated_at timestamptz NULL,
+    CONSTRAINT refresh_tokens_pkey PRIMARY KEY (id)
+);
+CREATE INDEX refresh_tokens_instance_id_idx ON auth.refresh_tokens USING btree (instance_id);
+CREATE INDEX refresh_tokens_instance_id_user_id_idx ON auth.refresh_tokens USING btree (instance_id, user_id);
+CREATE INDEX refresh_tokens_token_idx ON auth.refresh_tokens USING btree (token);
+-- auth.instances definition
+CREATE TABLE auth.instances (
+    id uuid NOT NULL,
+    uuid uuid NULL,
+    raw_base_config text NULL,
+    created_at timestamptz NULL,
+    updated_at timestamptz NULL,
+    CONSTRAINT instances_pkey PRIMARY KEY (id)
+);
+-- auth.audit_log_entries definition
+CREATE TABLE auth.audit_log_entries (
+    instance_id uuid NULL,
+    id uuid NOT NULL,
+    payload json NULL,
+    created_at timestamptz NULL,
+    CONSTRAINT audit_log_entries_pkey PRIMARY KEY (id)
+);
+CREATE INDEX audit_logs_instance_id_idx ON auth.audit_log_entries USING btree (instance_id);
+-- auth.schema_migrations definition
+CREATE TABLE auth.schema_migrations (
+    "version" varchar(255) NOT NULL,
+    CONSTRAINT schema_migrations_pkey PRIMARY KEY ("version")
+);
+INSERT INTO auth.schema_migrations (version)
+VALUES  ('20171026211738'),
+        ('20171026211808'),
+        ('20171026211834'),
+        ('20180103212743'),
+        ('20180108183307'),
+        ('20180119214651'),
+        ('20180125194653');
+-- Gets the User ID from the request cookie
+create or replace function auth.uid() returns uuid as $$
+  select nullif(current_setting('request.jwt.claim.sub', true), '')::uuid;
+$$ language sql stable;
+-- Gets the User Role from the request cookie
+create or replace function auth.role() returns text as $$
+  select nullif(current_setting('request.jwt.claim.role', true), '')::text;
+$$ language sql stable;
+-- Gets the User Email from the request cookie
+create or replace function auth.email() returns text as $$
+  select nullif(current_setting('request.jwt.claim.email', true), '')::text;
+$$ language sql stable;
+GRANT ALL PRIVILEGES ON SCHEMA auth TO postgres;
+GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA auth TO postgres;
+GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA auth TO postgres;
+ALTER ROLE postgres SET search_path = "$user", public, auth;
+
+GRANT USAGE ON SCHEMA auth TO anon, authenticated, service_role;