Insert policies for write access in Supabase - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to allow insert operations in the policy.

Supabase

create policy "Allow insert" on messages for [1] with check (true);

Drag options to blanks, or click blank then click option'

Ainsert

Bdelete

Cselect

Dupdate

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'select' instead of 'insert' for write access.

The policy must specify insert to allow write access for inserting new rows.

2fill in blank

medium

Complete the WITH CHECK expression to allow inserts only if the user is authenticated.

Supabase

create policy "Allow insert if authenticated" on messages for insert with check (auth.uid() [1] null);

Drag options to blanks, or click blank then click option'

A==

Bis not

C<

D>

Attempts:

3 left

💡 Hint

Common Mistakes

Using '==' which would allow only null users.

The condition auth.uid() is not null ensures only authenticated users can insert.

3fill in blank

hard

Fix the error in the policy condition to allow inserts only by the owner.

Supabase

create policy "Allow owner insert" on messages for insert with check (auth.uid() = [1]);

Drag options to blanks, or click blank then click option'

Auser_id

Bauth.uid()

Cowner_id

Did

Attempts:

3 left

💡 Hint

Common Mistakes

Comparing auth.uid() to itself instead of the owner column.

The condition must compare auth.uid() to the user_id column to check ownership.

4fill in blank

hard

Fill both blanks to allow inserts only if the user is authenticated and the inserted user_id matches auth.uid().

Supabase

create policy "Insert own messages" on messages for insert with check (auth.uid() [1] null and user_id [2] auth.uid());

Drag options to blanks, or click blank then click option'

Ais not

B==

C<>

D=

Attempts:

3 left

💡 Hint

Common Mistakes

Using '==' with null, which allows unauthenticated inserts.

The first condition checks user is authenticated (auth.uid() is not null), and the second ensures the inserted user_id matches the authenticated user (user_id = auth.uid()).

5fill in blank

hard

Fill all three blanks to create a policy that allows inserts only if the user is authenticated, the inserted user_id matches auth.uid(), and the message is not empty.

Supabase

create policy "Insert valid messages" on messages for insert with check (auth.uid() [1] null and user_id [2] auth.uid() and length(message) [3] 0);

Drag options to blanks, or click blank then click option'

Ais not

B=

C>

D<

Attempts:

3 left

💡 Hint

Common Mistakes

Using '<' instead of '>' for message length, allowing empty messages.

The policy checks that the user is authenticated (auth.uid() is not null), the inserted user_id matches the authenticated user (user_id = auth.uid()), and the message length is greater than zero (length(message) > 0), ensuring non-empty messages.

Practice

1. What is the main purpose of an insert policy in Supabase?

easy

A. To create new tables in the database

B. To delete data from a table

C. To update existing data in a table

D. To control who can add new data to a table

Solution

1. Step 1: Understand insert policy role

   Insert policies define rules about who can add new rows to a table.

2. Step 2: Differentiate from other policies

   Delete and update policies control removing or changing data, not inserting.

3. Final Answer:

   To control who can add new data to a table -> Option D

4. Quick Check:

   Insert policy = control insert access [OK]

Hint: Insert policies control adding data only [OK]

Common Mistakes:

• Confusing insert with update or delete policies
• Thinking insert policies create tables
• Assuming insert policies control data reading

2. Which of the following is the correct syntax to create an insert policy in Supabase?

easy

A. CREATE POLICY "Insert policy" ON table_name FOR UPDATE TO public WITH CHECK (true);

B. CREATE POLICY "Insert policy" ON table_name FOR INSERT TO public USING (true);

C. CREATE POLICY "Insert policy" ON table_name FOR INSERT TO public WITH CHECK (true);

D. CREATE POLICY "Insert policy" ON table_name FOR DELETE TO public USING (true);

Solution

1. Step 1: Identify correct command for insert policy

   Insert policies use FOR INSERT and require WITH CHECK to validate new rows.

2. Step 2: Eliminate wrong options

   Options with FOR UPDATE or FOR DELETE are for other operations; USING is for row filtering on SELECT or DELETE.

3. Final Answer:

   CREATE POLICY "Insert policy" ON table_name FOR INSERT TO public WITH CHECK (true); -> Option C

4. Quick Check:

   Insert policy syntax uses WITH CHECK [OK]

Hint: Insert policies need WITH CHECK clause [OK]

Common Mistakes:

• Using FOR UPDATE or FOR DELETE instead of FOR INSERT
• Using USING instead of WITH CHECK for insert
• Omitting the TO clause

3. Given this insert policy:

CREATE POLICY "Allow user insert" ON messages FOR INSERT TO authenticated WITH CHECK (auth.uid() = user_id);

What happens if a user tries to insert a message with user_id different from their own auth.uid()?

medium

A. The insert fails because the WITH CHECK condition is not met

B. The insert succeeds but the user_id is overwritten automatically

C. The insert succeeds because the policy allows all authenticated users

D. The insert fails because the policy syntax is invalid

Solution

1. Step 1: Understand WITH CHECK condition

   The policy allows insert only if auth.uid() equals the user_id in the new row.

2. Step 2: Analyze user insert attempt

   If user_id differs from auth.uid(), the condition fails, so the insert is rejected.

3. Final Answer:

   The insert fails because the WITH CHECK condition is not met -> Option A

4. Quick Check:

   WITH CHECK enforces insert data validity [OK]

Hint: WITH CHECK must be true for insert to succeed [OK]

Common Mistakes:

• Assuming all authenticated users can insert any user_id
• Thinking Supabase overwrites user_id automatically
• Confusing WITH CHECK with USING clause

4. You wrote this insert policy:

CREATE POLICY "Insert policy" ON orders FOR INSERT TO public USING (true);

Why does this policy not allow any inserts?

medium

A. Because the TO clause should be 'authenticated' not 'public'

B. Because insert policies require WITH CHECK, not USING, to validate inserts

C. Because the policy name cannot contain spaces

D. Because RLS must be disabled for inserts to work

Solution

1. Step 1: Identify correct clause for insert validation

   Insert policies use WITH CHECK to validate new rows, not USING.

2. Step 2: Understand effect of USING clause

   USING filters rows for SELECT, UPDATE, DELETE but does not validate inserts.

3. Final Answer:

   Because insert policies require WITH CHECK, not USING, to validate inserts -> Option B

4. Quick Check:

   Insert policies need WITH CHECK, not USING [OK]

Hint: Use WITH CHECK for insert policies, not USING [OK]

Common Mistakes:

• Using USING instead of WITH CHECK for insert
• Thinking TO public disables inserts
• Believing RLS must be off for inserts

5. You want to allow users to insert rows only if the created_by column matches their user ID and the status column is always set to 'pending'. Which insert policy correctly enforces this?

hard

A. CREATE POLICY "User insert" ON tasks FOR INSERT TO authenticated WITH CHECK (created_by = auth.uid() AND status = 'pending');

B. CREATE POLICY "User insert" ON tasks FOR INSERT TO authenticated USING (created_by = auth.uid() AND status = 'pending');

C. CREATE POLICY "User insert" ON tasks FOR INSERT TO authenticated WITH CHECK (created_by = auth.uid());

D. CREATE POLICY "User insert" ON tasks FOR INSERT TO authenticated WITH CHECK (status = 'pending');

Solution

1. Step 1: Identify conditions for insert validation

   Both created_by must match auth.uid() and status must be 'pending' for insert to be allowed.

2. Step 2: Choose correct clause and conditions

   WITH CHECK is required for insert validation; USING is incorrect here.

3. Step 3: Verify all conditions included

   CREATE POLICY "User insert" ON tasks FOR INSERT TO authenticated WITH CHECK (created_by = auth.uid() AND status = 'pending'); includes both conditions combined with AND in WITH CHECK clause.

4. Final Answer:

   CREATE POLICY "User insert" ON tasks FOR INSERT TO authenticated WITH CHECK (created_by = auth.uid() AND status = 'pending'); -> Option A

5. Quick Check:

   Insert policy WITH CHECK enforces all conditions [OK]

Hint: Combine all insert conditions in WITH CHECK clause [OK]

Common Mistakes:

• Using USING instead of WITH CHECK for insert
• Checking only one condition, missing the other
• Forgetting to match user ID with auth.uid()