Enabling RLS on tables in Supabase - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable Row Level Security (RLS) on the 'users' table.

Supabase

ALTER TABLE users [1];

Drag options to blanks, or click blank then click option'

AENABLE ROW LEVEL SECURITY

BADD ROW LEVEL SECURITY

CDISABLE ROW LEVEL SECURITY

DCREATE ROW LEVEL SECURITY

Attempts:

3 left

💡 Hint

Common Mistakes

Using DISABLE instead of ENABLE

Trying to ADD or CREATE RLS which are not valid commands

To enable RLS on a table, use ALTER TABLE table_name ENABLE ROW LEVEL SECURITY;

2fill in blank

medium

Complete the code to create a policy named 'select_policy' that allows SELECT on the 'orders' table for all users.

Supabase

CREATE POLICY select_policy ON orders FOR [1] TO public USING (true);

Drag options to blanks, or click blank then click option'

ADELETE

BUPDATE

CINSERT

DSELECT

Attempts:

3 left

💡 Hint

Common Mistakes

Using INSERT or UPDATE instead of SELECT

Confusing the operation with the table name

The policy is for SELECT operations, so use FOR SELECT.

3fill in blank

hard

Fix the error in the policy creation by completing the code to restrict UPDATE on 'products' table only to users with matching user_id.

Supabase

CREATE POLICY update_policy ON products FOR UPDATE TO authenticated USING (user_id = [1]);

Drag options to blanks, or click blank then click option'

Auser()

Bauth.uid()

Csession_user

Dcurrent_user

Attempts:

3 left

💡 Hint

Common Mistakes

Using SQL functions like current_user which do not return the auth user ID

Using session_user or user() which are not valid in this context

In Supabase, auth.uid() returns the current user's ID for RLS policies.

4fill in blank

hard

Fill both blanks to create a policy named 'delete_policy' that allows DELETE on 'comments' table only if the comment's author matches the current user.

Supabase

CREATE POLICY delete_policy ON comments FOR [1] TO authenticated USING (author_id = [2]);

Drag options to blanks, or click blank then click option'

ADELETE

Bauth.uid()

CSELECT

DINSERT

Attempts:

3 left

💡 Hint

Common Mistakes

Using SELECT or INSERT instead of DELETE

Using incorrect user ID functions

The policy is for DELETE operations and uses auth.uid() to check the current user.

5fill in blank

hard

Fill all three blanks to create a policy named 'insert_policy' on 'messages' table that allows INSERT only if the sender_id matches the current user and the message is not empty.

Supabase

CREATE POLICY insert_policy ON messages FOR [1] TO authenticated USING (sender_id = [2]) WITH CHECK (content [3] '');

Drag options to blanks, or click blank then click option'

AINSERT

Bauth.uid()

C<>

D=

Attempts:

3 left

💡 Hint

Common Mistakes

Using = instead of <> for content check

Using wrong operation like UPDATE or DELETE

Using wrong user ID function

The policy is for INSERT, uses auth.uid() to check sender_id, and ensures content is not empty using <>.

Practice

1. What does enabling Row Level Security (RLS) on a Supabase table do?

easy

A. It backs up the table data to a secure location.

B. It encrypts the entire table data automatically.

C. It controls which rows a user can access based on their identity.

D. It increases the table's storage capacity.

Solution

1. Step 1: Understand RLS purpose

   RLS restricts access to rows in a table depending on who the user is.

2. Step 2: Compare options

   Only It controls which rows a user can access based on their identity. describes controlling row access by user identity, others describe unrelated features.

3. Final Answer:

   It controls which rows a user can access based on their identity. -> Option C

4. Quick Check:

   RLS = Row access control [OK]

Hint: RLS controls row access by user identity, not encryption or backup [OK]

Common Mistakes:

• Confusing RLS with encryption
• Thinking RLS backs up data
• Assuming RLS increases storage

2. Which SQL command correctly enables Row Level Security on a table named profiles in Supabase?

easy

A. ALTER TABLE profiles SET RLS = TRUE;

B. ALTER TABLE profiles ENABLE ROW LEVEL SECURITY;

C. ENABLE RLS ON TABLE profiles;

D. SET ROW LEVEL SECURITY ON profiles;

Solution

1. Step 1: Recall correct SQL syntax for enabling RLS

   The correct command is ALTER TABLE [table_name] ENABLE ROW LEVEL SECURITY;.

2. Step 2: Match options to syntax

   Only ALTER TABLE profiles ENABLE ROW LEVEL SECURITY; matches the exact syntax; others are invalid SQL commands.

3. Final Answer:

   ALTER TABLE profiles ENABLE ROW LEVEL SECURITY; -> Option B

4. Quick Check:

   ALTER TABLE + ENABLE ROW LEVEL SECURITY = correct syntax [OK]

Hint: Use ALTER TABLE ... ENABLE ROW LEVEL SECURITY to enable RLS [OK]

Common Mistakes:

• Using SET instead of ENABLE
• Wrong command order
• Missing ALTER TABLE keyword

3. Given the following policy on table tasks with RLS enabled:

CREATE POLICY "Users can view their tasks" ON tasks FOR SELECT USING (user_id = auth.uid());

What will happen if a user tries to select tasks where user_id is different from their own?

medium

A. They will see only tasks where user_id matches their auth.uid().

B. They will get a syntax error.

C. They will see all tasks regardless of user_id.

D. They will see no tasks at all.

Solution

1. Step 1: Understand the policy condition

   The policy allows SELECT only if user_id = auth.uid(), meaning users see only their own tasks.

2. Step 2: Predict query result for mismatched user_id

   If user_id differs, the condition fails, so those rows are not visible.

3. Final Answer:

   They will see only tasks where user_id matches their auth.uid(). -> Option A

4. Quick Check:

   Policy filters rows by user_id = auth.uid() [OK]

Hint: Policy USING clause filters rows by user identity [OK]

Common Mistakes:

• Assuming all rows are visible
• Expecting syntax errors from policy
• Thinking no rows are visible at all

4. You enabled RLS on the orders table but users report they cannot see any rows even though policies exist. What is the most likely cause?

medium

A. The table has too many rows.

B. The table is missing a primary key.

C. The database connection is lost.

D. RLS is enabled but no policies allow access to rows.

Solution

1. Step 1: Understand RLS behavior

   When RLS is enabled, access depends on policies. Without policies allowing access, no rows are visible.

2. Step 2: Evaluate other options

   Missing primary key, connection loss, or row count do not directly cause no rows to show due to RLS.

3. Final Answer:

   RLS is enabled but no policies allow access to rows. -> Option D

4. Quick Check:

   RLS needs policies to permit row access [OK]

Hint: Enable policies after RLS to allow row access [OK]

Common Mistakes:

• Ignoring missing policies
• Blaming unrelated database issues
• Assuming RLS shows all rows by default

5. You want to allow users to insert rows into the messages table only if the sender_id matches their authenticated user ID. Which policy correctly enforces this with RLS enabled?

hard

A. CREATE POLICY "Allow insert if sender matches" ON messages FOR INSERT WITH CHECK (sender_id = auth.uid());

B. CREATE POLICY "Allow insert" ON messages FOR INSERT USING (sender_id = auth.uid());

C. CREATE POLICY "Allow insert" ON messages FOR SELECT WITH CHECK (sender_id = auth.uid());

D. CREATE POLICY "Allow insert" ON messages FOR UPDATE WITH CHECK (sender_id = auth.uid());

Solution

1. Step 1: Identify correct policy type for INSERT

   For INSERT, WITH CHECK controls if new rows meet the condition.

2. Step 2: Match condition to sender_id and auth.uid()

   The condition sender_id = auth.uid() ensures users insert only their own messages.

3. Step 3: Verify options

   CREATE POLICY "Allow insert if sender matches" ON messages FOR INSERT WITH CHECK (sender_id = auth.uid()); uses FOR INSERT with WITH CHECK and correct condition; others use wrong commands or clauses.

4. Final Answer:

   CREATE POLICY "Allow insert if sender matches" ON messages FOR INSERT WITH CHECK (sender_id = auth.uid()); -> Option A

5. Quick Check:

   INSERT policies use WITH CHECK to validate new rows [OK]

Hint: Use WITH CHECK for INSERT policies to validate new rows [OK]

Common Mistakes:

• Using USING instead of WITH CHECK for INSERT
• Applying SELECT or UPDATE instead of INSERT
• Missing condition on sender_id