5e3a77fc70
Includes explicit GRANTs for anon/authenticated/service_role on all public tables: the Supabase CLI's current default no longer auto-exposes new tables, so RLS policies from the initial schema were unreachable without them (every request failed at the privilege check before RLS was evaluated).
40 lines
1.3 KiB
PL/PgSQL
40 lines
1.3 KiB
PL/PgSQL
-- Base table grants for the API roles. The Supabase CLI's current default
|
|
-- (auto_expose_new_tables unset) no longer auto-grants table privileges to
|
|
-- anon/authenticated/service_role, so without these GRANTs the RLS policies
|
|
-- from the initial schema migration are unreachable (every request fails at
|
|
-- the privilege check before RLS is even evaluated). This is the documented
|
|
-- "explicit grants + RLS" pattern Supabase recommends going forward; the
|
|
-- actual access is still fully governed by each table's RLS policies.
|
|
grant select, insert, update, delete on
|
|
public.products,
|
|
public.services,
|
|
public.schedule_template,
|
|
public.schedule_exceptions,
|
|
public.bookings,
|
|
public.booked_slots,
|
|
public.inquiries
|
|
to anon, authenticated, service_role;
|
|
|
|
-- Keeps the public, PII-free booked_slots table in sync whenever a booking
|
|
-- is created. security definer + explicit search_path per Supabase's
|
|
-- documented safe pattern for definer functions.
|
|
|
|
create or replace function public.sync_booked_slot()
|
|
returns trigger
|
|
language plpgsql
|
|
security definer
|
|
set search_path = ''
|
|
as $$
|
|
begin
|
|
insert into public.booked_slots (date, time)
|
|
values (new.date, new.time)
|
|
on conflict do nothing;
|
|
return new;
|
|
end;
|
|
$$;
|
|
|
|
create trigger booking_created_sync_slot
|
|
after insert on public.bookings
|
|
for each row
|
|
execute function public.sync_booked_slot();
|