Select policies for read access in Supabase - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to allow read access to all users.

Supabase

create policy "Allow read access" on [1] for select using (true);

Drag options to blanks, or click blank then click option'

Atable

Bpublic

Cschema

Dfunction

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'public' or 'schema' instead of 'table'.

The policy must be created on a table to control read access.

2fill in blank

medium

Complete the code to restrict read access to authenticated users only.

Supabase

create policy "Allow authenticated read" on users for select using (auth.uid() = [1]);

Drag options to blanks, or click blank then click option'

Aid

Buser_id

Cuid

Dauth_id

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect column names like 'user_id' or 'auth_id'.

The column id typically stores the user identifier to match with auth.uid().

3fill in blank

hard

Fix the error in the policy condition to allow read access only if the user's role is 'reader'.

Supabase

create policy "Role-based read access" on documents for select using (auth.role() = [1]);

Drag options to blanks, or click blank then click option'

AROLE_READER

Breader

C"reader"

D'reader'

Attempts:

3 left

💡 Hint

Common Mistakes

Using unquoted or double-quoted strings causing syntax errors.

String values in SQL conditions must be enclosed in single quotes, so use 'reader'.

4fill in blank

hard

Fill both blanks to create a policy that allows read access only if the user is authenticated and the record is not marked private.

Supabase

create policy "Authenticated non-private read" on posts for select using (auth.uid() IS NOT NULL AND [1] = [2]);

Drag options to blanks, or click blank then click option'

Ais_private

Bfalse

Ctrue

Dprivate

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'true' or 'private' instead of 'false'.

The condition checks that the is_private column is false to allow read access.

5fill in blank

hard

Fill all three blanks to create a policy that allows read access if the user is the owner or the post is public.

Supabase

create policy "Owner or public read" on posts for select using ([1] = auth.uid() OR [2] = [3]);

Drag options to blanks, or click blank then click option'

Aowner_id

Bis_public

Ctrue

Duser_id

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong column names or boolean values.

The policy checks if the owner_id matches the user or if is_public is true.

Practice

1. What is the main purpose of a SELECT policy in Supabase?

easy

A. To control who can read data from a table

B. To control who can write data to a table

C. To create new tables in the database

D. To delete data from a table

Solution

1. Step 1: Understand the role of SELECT policies

   SELECT policies define rules for reading data from tables.

2. Step 2: Differentiate from other policies

   Write policies control data insertion or updates, not reading.

3. Final Answer:

   To control who can read data from a table -> Option A

4. Quick Check:

   SELECT policy = read access control [OK]

Hint: SELECT policies = rules for reading data only [OK]

Common Mistakes:

• Confusing SELECT with INSERT or UPDATE policies
• Thinking SELECT policies create or delete tables
• Assuming SELECT policies control write access

2. Which of the following is the correct syntax to create a read policy allowing all users to select from a table named profiles?

easy

A. CREATE POLICY "Allow all" ON profiles FOR UPDATE USING (true);

B. CREATE POLICY "Allow all" ON profiles FOR INSERT USING (true);

C. CREATE POLICY "Allow all" ON profiles FOR SELECT USING (true);

D. CREATE POLICY "Allow all" ON profiles FOR DELETE USING (true);

Solution

1. Step 1: Identify the correct command for read access

   FOR SELECT is used to allow read (select) operations.

2. Step 2: Confirm the condition for allowing all users

   USING (true) means no restriction, so all users can read.

3. Final Answer:

   CREATE POLICY "Allow all" ON profiles FOR SELECT USING (true); -> Option C

4. Quick Check:

   FOR SELECT + USING (true) = allow all read [OK]

Hint: FOR SELECT + USING (true) allows all reads [OK]

Common Mistakes:

• Using FOR INSERT instead of FOR SELECT
• Forgetting the USING clause
• Using FOR DELETE or UPDATE for read access

3. Given the policy:

CREATE POLICY "User can read own profile" ON profiles FOR SELECT USING (auth.uid() = user_id);

What will happen if a user tries to select a profile where user_id is different from their auth.uid()?

medium

A. The user will be able to read the profile

B. The user will get an empty result (no rows)

C. The query will cause a syntax error

D. The user will be able to update the profile

Solution

1. Step 1: Understand the policy condition

   The policy allows reading only if auth.uid() equals user_id.

2. Step 2: Analyze the case when user_id differs

   If user_id is different, the condition fails, so no rows are returned.

3. Final Answer:

   The user will get an empty result (no rows) -> Option B

4. Quick Check:

   Condition false = no rows returned [OK]

Hint: Read allowed only if auth.uid() matches user_id [OK]

Common Mistakes:

• Assuming user can read all profiles
• Expecting an error instead of empty result
• Confusing read with update permissions

4. You wrote this policy:

CREATE POLICY "Allow read" ON orders FOR SELECT USING (user_id = auth.uid);

But users cannot read their orders. What is the problem?

medium

A. USING clause should be omitted

B. The policy should use FOR UPDATE instead of FOR SELECT

C. The table name is incorrect

D. auth.uid should be called as a function: auth.uid()

Solution

1. Step 1: Check the usage of auth.uid

   auth.uid is a function and must be called with parentheses: auth.uid()

2. Step 2: Understand impact of missing parentheses

   Without (), the condition is invalid and blocks access.

3. Final Answer:

   auth.uid should be called as a function: auth.uid() -> Option D

4. Quick Check:

   auth.uid() is required for correct condition [OK]

Hint: Always call auth.uid() with parentheses [OK]

Common Mistakes:

• Using auth.uid without parentheses
• Confusing FOR SELECT with FOR UPDATE
• Removing USING clause mistakenly

5. You want to allow users to read only their own messages from a messages table. The table has columns id, content, and owner_id. Which policy correctly enforces this read access?

hard

A. CREATE POLICY "Read own messages" ON messages FOR SELECT USING (owner_id = auth.uid());

B. CREATE POLICY "Read own messages" ON messages FOR SELECT USING (owner_id != auth.uid());

C. CREATE POLICY "Read own messages" ON messages FOR SELECT USING (true);

D. CREATE POLICY "Read own messages" ON messages FOR UPDATE USING (owner_id = auth.uid());

Solution

1. Step 1: Identify correct condition for own data

   Users should read rows where owner_id equals their auth.uid()

2. Step 2: Confirm correct policy type and condition

   FOR SELECT with USING (owner_id = auth.uid()) restricts reads properly.

3. Final Answer:

   CREATE POLICY "Read own messages" ON messages FOR SELECT USING (owner_id = auth.uid()); -> Option A

4. Quick Check:

   owner_id = auth.uid() restricts read to own rows [OK]

Hint: Use owner_id = auth.uid() in USING for own read access [OK]

Common Mistakes:

• Using != instead of = in condition
• Allowing all reads with USING (true)
• Using FOR UPDATE instead of FOR SELECT