invisal / libsql-studio

A lightweight LibSQL/rqlite graphical client on your browser
https://libsqlstudio.com
MIT License
161 stars 13 forks source link

Add fine granular permission table and column level #69

Open invisal opened 3 months ago

invisal commented 3 months ago

Each databases can have multiple roles. The role can be defined by owner. The role is stored in database_role

However, if we want to define granular permission to table and column level, we will rely on database_role_permission. By default without can_execute_query, user has no permission to any table.

To grant permission to table, they can do

role access table_name column_name
table read users NULL
table write blogs NULL
table write_delete courses NULL

When user granted the table permission, they can read all columns. To limit the column permission, we can do

role access table_name column_name
table write blogs NULL
table column_deny blogs created_at
table column_read blogs created_by

We can implement this here

https://github.com/invisal/libsql-studio/blob/develop/src/app/api/database/%5Bdatabase_id%5D/ops/route.ts

You can propose on how the API look like. It should contain: