supabase / walrus

Applying RLS to PostgreSQL WAL
Apache License 2.0
122 stars 9 forks source link

Bugfix: in support for non-text types #71

Closed olirice closed 1 year ago

olirice commented 1 year ago

What changed

The subscription check is supposed to special case the in operator and confirm that the value provided by the user is cast-able as an "array of the correct type". The bug is that, after the special case logic, the usual check to make sure the type is cast-able as "the base type" also occurred

The only type that would pass both checks is text, because text[]::text is valid, but other types like uuid[]::uuid is not

Code Change

Before

        -- Set maximum number of entries for in filter
         if filter.op = 'in'::realtime.equality_op then
             in_val = realtime.cast(filter.value, (col_type::text || '[]')::regtype);
             if coalesce(jsonb_array_length(in_val), 0) > 100 then
                 raise exception 'too many values for `in` filter. Maximum 100';
             end if;
         end if;

         -- raises an exception if value is not coercable to type
         perform realtime.cast(filter.value, col_type);
     end loop;

After

        -- Set maximum number of entries for in filter
         if filter.op = 'in'::realtime.equality_op then
             in_val = realtime.cast(filter.value, (col_type::text || '[]')::regtype);
             if coalesce(jsonb_array_length(in_val), 0) > 100 then
                 raise exception 'too many values for `in` filter. Maximum 100';
             end if;
         else
             -- raises an exception if value is not coercable to type
             perform realtime.cast(filter.value, col_type);
         end if;

     end loop;

There is a new test to prevent regressions.

resolves realtime/issues/491