authorization

13 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Broadcast uses Realtime Authorization by default

Broadcast uses Realtime Authorization by default to protect your data.

Private channels require Realtime Authorization

For private channels, you need to use Realtime Authorization to control access to the channel and whether users are able to send messages.

RLS policies for Realtime channel authorization

For private channels, create Row Level Security (RLS) policies on the realtime.messages table. Create a SELECT policy for authenticated users to receive broadcasts: CREATE POLICY "authenticated_users_can_receive" ON realtime.messages FOR SELECT TO authenticated USING (true). Create an INSERT policy for authenticated users to send broadcasts: CREATE POLICY "authenticated_users_can_send" ON realtime.messages FOR INSERT TO authenticated WITH CHECK (true).

RLS policies not applied to DELETE events

RLS policies are not applied to DELETE statements because there is no way for Postgres to verify that a user has access to a deleted record.

Enable RLS for tables in private schemas

It is strongly recommended to enable Row Level Security (RLS) and create policies for tables in private schemas. Otherwise, any role you grant access to will have unfettered read access to the table.

Set custom JWT token for Realtime

You can sign your own tokens to customize claims that can be checked in RLS policies. Set the custom JWT after instantiating the Supabase client and before connecting to a Channel. Your project JWT secret is found in Settings > API keys section of the Dashboard.

Do not expose service_role token on client

Do not expose the service_role token on the client because the role is authorized to bypass row-level security.

Set custom JWT example (JavaScript)

const supabase = createClient(process.env.SUPABASE_URL, process.env.SUPABASE_KEY, {}); supabase.realtime.setAuth('your-custom-jwt'); const channel = supabase.channel('db-changes').on('postgres_changes', {event: '*', schema: 'public', table: 'messages', filter: 'body=eq.bye'}, (payload) => console.log(payload)).subscribe()

Set custom JWT example (Dart)

supabase.realtime.setAuth('your-custom-jwt'); supabase.channel('db-changes').onPostgresChanges(event: PostgresChangeEvent.all, schema: 'public', table: 'messages', filter: PostgresChangeFilter(type: PostgresChangeFilterType.eq, column: 'body', value: 'bye'), callback: (payload) => print(payload)).subscribe()

Set custom JWT example (Swift)

await supabase.realtime.setAuth('your-custom-jwt'); let myChannel = await supabase.channel('db-changes'); let changes = await myChannel.postgresChange(UpdateAction.self, schema: 'public', table: 'products', filter: 'name=in.(red,blue,yellow)'); await myChannel.subscribe(); for await change in changes { print(change.record) }

Set custom JWT example (Kotlin)

val supabase = createSupabaseClient(supabaseUrl, supabaseKey) { install(Realtime) { jwtToken = 'your-custom-jwt' } }; val myChannel = supabase.channel('db-changes'); val changes = myChannel.postgresChangeFlow<PostgresAction.Update>(schema = 'public') { table = 'products'; filter = 'name=in.(red,blue,yellow)' }; changes.onEach { println(it.record) }.launchIn(yourCoroutineScope); myChannel.subscribe()

Set custom JWT example (Python)

supabase.realtime.set_auth('your-custom-jwt'); changes = supabase.channel('db-changes').on_postgres_changes('UPDATE', schema='public', table='products', filter='name=in.(red,blue,yellow)', callback=lambda payload: print(payload)).subscribe()

Set custom JWT example (C#)

supabase.Realtime.SetAuth('your-custom-jwt'); var channel = supabase.Realtime.Channel('db-changes'); channel.Register(new PostgresChangesOptions('public', 'messages', ListenType.All, 'body=eq.bye')); channel.AddPostgresChangeHandler(ListenType.All, (sender, change) => { Console.WriteLine(change.Payload); }); await channel.Subscribe()

Give your agent this brain