Open ggregoire opened 3 years ago
can you post the policy body and the sample curl request (the parameters), without that i am not sure what is wrong, everything seems right (except that last grant, that is wrong).
grant api to current_user;
is needed because otherwise alter view my_table_view owner to api;
fails since master
does not have SUPERUSER
privileges to change the view owner. This grand does not relate to the flow of requests coming through postgrest, it's strictly so that alter
statement succeeds;
for the full picture please also include the grants to my_table_view
for anonymous
and webuser
Hi!
Sorry to bother with the following questions, it's probably a misunderstanding on my side.
I created a role
api
as you did:Then created a policy assigned to
api
as you did:api
is the owner of the corresponding view and has access to the table as you did:However the endpoint
my_table_view
returns 0 rows towebuser
, although the policy allows him to see some rows. Then once I executed:the endpoint and the policy worked as expected.
So my question:
You never do
grant api to anonymous, webuser
in this project. Is it actually needed or did I miss something?(And I'm wondering, what's the purpose of
grant api to current_user;
? I saw the comment but why doesmaster
needSUPERUSER
privileges to run PostgREST? And how givingapi
tomaster
solves the issue sinceapi
is created withoutSUPERUSER
privileges? I'm on RDS and I tried with bothgrant api to current_user;
andrevoke api from current_user;
and I don't see a difference, but I might be missing something again)