I’m using Supabase for similar reasons but there’s one specific situation I’m trying to sort out.
Say you have a user “profile” which includes their privileges - like say a column named “privileges” which is some JSON object denoting what they can/can’t do.
Even with RLS, how do you ensure that a user can’t simply make a curl call with their own JWT to elevate their own privileges?
Basically, how to enforce column level security?
The best thing I can think of is to place “privileges” in a child table and only let the service account update that table.
Say you have a user “profile” which includes their privileges - like say a column named “privileges” which is some JSON object denoting what they can/can’t do.
Even with RLS, how do you ensure that a user can’t simply make a curl call with their own JWT to elevate their own privileges?
Basically, how to enforce column level security?
The best thing I can think of is to place “privileges” in a child table and only let the service account update that table.