Updates the "auth.users exposed" lint to check for 3 different conditions
auth.users exposed in a materialized view (no RLS possible)
auth.users exposed in a SECURITY DEFINER view (no RLS possible)
auth.users exposed in SECURITY INVOKER view, but RLS not enabled on auth.users
We also add tests for each of these cases, and confirm that resolving the issue in the third case removes the record.
Finally, the docs have been updated to reflect document security_invoker + RLS as an option for resolving the problem in addition to the trigger based solution already in the docs
What kind of change does this PR introduce?
Updates the "
auth.usersexposed" lint to check for 3 different conditionsWe also add tests for each of these cases, and confirm that resolving the issue in the third case removes the record.
Finally, the docs have been updated to reflect document security_invoker + RLS as an option for resolving the problem in addition to the trigger based solution already in the docs
resolves #23