3 ms·
What happens when I’m allowed to view a column for some entities but not others? In the real world authorization logic can get very complicated. And who wants
by encoderer 2y ago
What happens when I’m allowed to view a column for some entities but not others?
In the real world authorization logic can get very complicated.
And who wants to migrate this kind of stuff once you’ve implemented it one way?
Honestly it’s best to keep your database doing what it does best: storing data.
- dragonwriter 2y ago> What happens when I’m allowed to view a column for some entities but not others? Column-level rules are a DB design smell, because if some people have a reason to view a table that is coherent without a column, that suggests that you've got at least two different fact shapes communicated by the table that should be normalized into separate tables. Each of those tables then needs appropriate RLS rules. Sometimes you do a join (OUTER on one side) of these tables, so that they look like one, and this also solves the combined row/column security challenge that comes up when you have the less normalized table.
- gopher_space 2y agoI'm looking at a table with columns intentionally removed because they're none of my business, but with calculations I'd want to do on those columns provided in a separate table as anonymity allows. Column-level rules seem like they'd make generating this export fairly easy, no?
- bavell 2y agoViews seem much more appropriate a tool for customizing/restricting column access but I'm no DBA.