RLS and Sync Rules

PowerSync’s Sync Rules and Supabase’s support for Row Level Security (RLS) can be used in conjunction. Here are some high level similarities and differences:

• RLS should be used as the authoritative set of security rules applied to your users’ CRUD operations that reach Postgres.
• Sync Rules are only applied for data that is to be downloaded to clients — they do not apply to uploaded data.
  • Sync Rules can typically be considered to be complementary to RLS, and will generally mirror your RLS setup.

​

Example

Continuing with the schema set up during the guide, below are the RLS policies for the to-do list app:

alter table public.lists
  enable row level security;

alter table public.todos
  enable row level security;

create policy "owned lists" on public.lists for ALL using (
  auth.uid() = owner_id
);

create policy "todos in owned lists" on public.todos for ALL using (
  auth.uid() IN (
    SELECT lists.owner_id FROM lists WHERE (lists.id = todos.list_id)
  )
);

auth.uid() in a Supabase RLS policy is the same as request.user_id() (previously token_parameters.user_id) in Sync Rules.

If you compare these to your Sync Rules configuration in sync-rules.yaml, you’ll see they are quite similar.

If you have any questions, join us on our community Discord where our team is always available to help.