3 ms·
In a recent post here on HN, Shipping Multi-Tenant SaaS Using Postgres Row-Level Security [1], comments indicated gaps in PostgreSQL's RLS implementation, speci
by infogulch 4y ago
In a recent post here on HN, Shipping Multi-Tenant SaaS Using Postgres Row-Level Security [1], comments indicated gaps in PostgreSQL's RLS implementation, specifically for views (at least until PG15). I suppose EdgeQL is compiled directly to full SQL statements and doesn't utilize views, so this issue in particular may not affect EdgeDB.
Does EdgeDB implement object-level access control on top of PostgreSQL's RLS? Have you run into any tricky edge cases? Did you have any particular inspirations for the design (e.g. Google Zanzibar)?
[1]: https://news.ycombinator.com/item?id=32241820 https://news.ycombinator.com/item?id=32241820
- RedCrowbar 4y agoEdgeDB does not use Postgres RLS, access rules are injected into every query by the query compiler instead. This side-steps the RLS gotchas and limitations (RLS does not allow aggregates in rules, EdgeDB does), but also yields somewhat better query performance.