JCBSComputer
20 lines
1.0 KiB
SQL
20 lines
1.0 KiB
SQL
-- ============================================================================
|
|
-- Migration 015: Fix RLS for scheduled_events to include participant_id
|
|
-- ============================================================================
|
|
-- Previously, the RLS policy only checked user_id, which meant participants
|
|
-- could not see events at the database level (the app-layer WHERE clause
|
|
-- did the filtering, but RLS was defense-in-depth that missed this case).
|
|
--
|
|
-- This policy also allows app.current_user_id IS NULL for backward compat
|
|
-- with queries that don't set the session variable.
|
|
-- ============================================================================
|
|
|
|
DROP POLICY IF EXISTS scheduled_events_user_policy ON scheduled_events;
|
|
CREATE POLICY scheduled_events_user_policy ON scheduled_events
|
|
FOR ALL
|
|
USING (
|
|
user_id = current_setting('app.current_user_id', true)::uuid
|
|
OR participant_id = current_setting('app.current_user_id', true)::uuid
|
|
OR current_setting('app.current_user_id', true) IS NULL
|
|
);
|