supabase / walrus

Applying RLS to PostgreSQL WAL
Apache License 2.0
122 stars 9 forks source link

Reject subscriptions when filter value has the incorrect column type #39

Closed w3b6x9 closed 2 years ago

w3b6x9 commented 2 years ago

Describe the bug

Developers sometimes set incorrect values to filters they want to listen to. For example, I've seen developers try and listen to:

users:id=eq.undefined

and other values when they were not of the column type.

This results in Realtime RLS crashing because of realtime.subscription_check_filters(), specifically performing realtime.cast(val text, type_ regtype).

Expected behavior

Prevent the filter record from being inserted into realtime.subscription table which will force Realtime RLS server to reject subscriptions for filters with incorrect value types. This will keep Realtime RLS server running smoothly.

olirice commented 2 years ago

results in Realtime RLS crashing

the current behavior is intentionally raising an exception https://github.com/supabase/walrus/blob/6b6c3ec212e91f3c2a51fa6698c0209dd5208b20/sql/walrus--0.1.sql#L100

my assumptions were

is that correct?

If so, can this be handled by Realtime issuing a rollback after a failed insert and return the exception's message to the end user?


We could add more structure to exceptions returned from walrus if you'd like to give better error messages

Alternatively, we could wrap the insert statement in a function that returns something equivalent to a result type if you'd like to completely avoid exceptions i.e.

( status := 'fail', message := 'invalid filter' )
or
( status := 'success', message := 'ok' )

lmk how you want to handle it

w3b6x9 commented 2 years ago

@olirice just figured out where to handle this in Realtime. Will close this issue.