Use AI to enable and generate RLS policies for Postgres with Supabase

This is your step-by-step guide to enabling and testing RLS (Row Level Security) in Supabase.
Day 1 - Supabase Studio Updates: AI Assistant, User Impersonation, and more: supabase.com/blog/studio-intr...
Row Level Security (RLS) is a super powerful way to implement authorization directly in your PostgreSQL database! In this video, Jon explains what RLS is and how to use AI to write policies from a simple text input! 🤖
In this new Supabase tutorial, we’re talking about security features in Supabase, specifically Row Level Security (RLS) in Postgres and Supabase. Watch as Jon demonstrates how it empowers you to implement robust authorisation directly within your database. Forget about complex back-end logic for data filtering-RLS does it seamlessly for you!
What you'll learn:
✅ Understanding RLS: Learn the basics of RLS and why you need it. It’s a powerful feature in Postgres that allows you to enforce data access controls directly at the database level.
✅ Setting Up RLS in Supabase: Learn how to activate RLS from the Supabase dashboard or via SQL commands to enhance your app's security.
✅ Crafting RLS Policies with AI: Utilise Supabase AI to generate and refine security policies, making the setup process less intimidating and more accessible.
✅ Testing RLS Policies: See how to test these policies for specific user scenarios to ensure they perform as expected.
✅ Practical Demonstration: Follow a step-by-step guide to creating and applying RLS policies to a blog post table, ensuring that only published posts are visible to users.
After watching this video, you'll be able to:
✅ Configure RLS on your tables confidently with Supabase.
✅ Write and apply selective access policies that enhance the security and usability of your applications.
✅ Utilise AI tools to simplify the creation and management of security policies.
Don’t let the backend logistics scare you away; with Supabase’s RLS and AI tools, setting up database security is straightforward and really quick. If you want to handle authorisation in Supabase - watch this!
More Launch Week 🆇: supabase.com/launch-week?utm_...
CHAPTERS:
0:00 What you'll learn!
0:16 What is RLS (Row Level Security)
0:28 Example of RLS policy on site
0:58 Enabling RLS in Supabase
1:48 Empty array troubleshooting
2:04 Enabling RLS in Supabase and troubleshooting tips
4:44 Authenticating users
💻 Videos to watch next:
▶ Watch ALL Postgres/Supabase videos: • Learn Postgres
▶ Implement Authorization using Row Level Security with Supabase
: • Implement Authorizatio...
▶ Supabase is now GA: • Supabase is now GA
👇 Learn more about Supabase 👇
🕸 Website: supabase.com/
🏁 Get started: app.supabase.com/
📄 Docs: supabase.com/docs
🔔 Subscribe for more tutorials and feature updates from Supabase: / @supabase
📱 Connect with Us:
🐙 Github: www.github.com/supabase
💬 Discord: www.discord.supabase.com/
🐦 Twitter: / supabase
▶ Instagram (follow for memes): / supabasecom
ABOUT SUPABASE:
Supabase is the open source Firebase alternative. Supabase provides a full Postgres database for every project with pgvector, backups, realtime, and more. Add and manage email and password, passwordless, OAuth, and mobile logins to your project through a suite of identity providers and APIs.
Build in a weekend, scale to millions.
#Supabase #AppDevelopment #RealtimeApps #DeveloperTools

[@Supabase]

This is just the first announcement of Supabase Launch Week X. Read the blog post here: supabase.com/blog/studio-introducing-assistant?

[@Supabase]

And more Launch week announcements here: supabase.com/launch-week?

[@awalias]

@@Supabase spicy

[@codooze]

I didn't know we could also impersonate users from Supabase, that's a huge help. Also pls a video about creating customs roles, and how they relate to auth.users if there is any relation, because I don't know if we should be modifying that.

[@DarrylChangHeathcote]

my UI does not match the UI in this video. Not sure if this version of Supabase is outdated?

[@adamordway4548]

This is great! I really like the impersonation feature. It’s always a pain to test different levels of access.

[@JonMeyers]

Yeah, I agree! This is going to save me so much time! 🎉

[@awalias]

@@JonMeyers the kinda thing you don't realize how much it was missing until it's there!

[@yarapolana]

OMGGGGG I literally suggested this on Twitter/X, I had no clue you were actually implementing it.

[@dshukertjr]

I was just playing around with user impersonation, and wow it's easy to use and powerful.

[@awalias]

Yeah I honestly love this feature!

[@Flopshoubox]

Those impersonate tool and ai assitant are damn good ! Makes me want to deep dive on RLS !

[@JonMeyers]

Yeah, it’s going to save me so much time! 🚀

[@BretMogilefsky]

Terrific stuff, very well presented. Thanks!

[@thorwebdev]

This is awesome, the Supabase Dashboard is becoming so incredibly powerful 🙌

[@dnlmgwi]

Love This!

[@JonMeyers]

Glad you enjoyed it! 🙌 Much more coming over the next few days!

[@ricardocnn]

Awesome video!

[@JonMeyers]

Thanks! 🙌 Glad you enjoyed it! What do you want to see next?

[@ricardocnn]

@@JonMeyers RLS also set a limit of registers?

[@darkbacon2630]

awesome feature 🤙

[@JonMeyers]

It’s one of my favourites so far! 🚀

[@eleah2665]

Jon is here!

[@JonMeyers]

Let’s get into it!

[@emergingbits]

This is great. Thanks for the hard work! I also find defining functions a bit jarring as a new user. For instance to inserting multiple records relational queries is a common use case that's not that easy to do out of the box. An AI tool for functions and some advanced examples with `plpgsql` or how to properly use sql in functions would be greatly appreciated. Or an alternative would be to provide the supabase sdk to allow for nested inserts (for relational queries) would be a huge unlock (like it's possible with Prisma if you google: Prisma Relational Queries: Nested Writes)

[@JonMeyers]

Great feedback! 🙌 Supabase AI is also available in the SQL Editor so it can help you write your Postgres functions. I am also putting together a bunch of Postgres theory content for next year so will make sure all of this is covered!

[@davebenjamin4388]

Awesome but when will it be available for local Dev, which is where we really need this?

[@frnk_snslvdr]

User Impersonation: brilliant

[@rodrigomansuelinunes1285]

Great video!

[@farow610]

The impersonation feature only works with supabase auth and not next-auth, correct ? Also, the ai assistant is so cool but does it have hallucinations like Chatgpt ?

[@JonMeyers]

I haven't played with next-auth for a while, but if it doesn't enforce regular RLS policies, then the impersonation feature won't match what a user in next-auth would get back. Also, I don't think next-auth uses the auth.users table so your next-auth users will probably not show up under the impersonation tab - again, haven't tested this so it might work perfectly! 🙂 We recommend checking the AI suggestion is what you want to do before running the SQL, as it may get a little "creative" 👍

[@2an_sound]

Why is your UI for creating a new policy so different from mine? When I click New Policy it brings up the modal with templates or from scratch options.

[@chychywoohoo]

Same for me. This video seems to be outdated

[@mahdiboughanmi6781]

am new to supabase and postgres , while i loved it at first i hated rls for more complicated schemas like for exp user owns a store and a store has its own categories how do i write a policy for only store owners can add categories when they don't have direct relationship

[@1gouravgg]

is there really a need to enable RLS if I access db only via backend?

[@pearceodegard582]

What if someone attempts to access your database API directly if they get ahold of the URL?

[@thorwebdev]

If you don’t expose your anon key it’s fine. But better be safe than sorry!

[@ricardocnn]

I don't have this feature.

[@din2]

How to make page views with NextJs and Supabase?

[@sonuaryan5287]

Enabling RLS strict live changes

[@supa_olirice]

🚀

[@schlep]

🤖🚀🚀

[@souravhazari4983]

Through RLS I have acheive user_permission design. With this I can control which user can select, insert and update or delete from a table's boolean value ,,user wise row.

[@HijabiCoder]

🔥 🆇

[@JonMeyers]

4 more to go! Plus all those other one more things! 😆

[@Supabase]

There's always one more thing(s)