Using auth.uid() in policies in Supabase - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding auth.uid() in Row Level Security

In Supabase, when you use auth.uid() inside a Row Level Security (RLS) policy, what does it represent?

A The unique identifier of the first user who signed up in the project.

B The unique identifier of the currently authenticated user making the request.

C A random session ID generated for each query.

D The unique identifier of the database administrator.

💡 Hint

Think about who the policy needs to check permissions for during a request.

auth.uid() returns the unique ID of the user currently logged in and making the request. This allows policies to restrict access based on the user's identity.

❓ service_behavior

intermediate

Effect of auth.uid() in a SELECT Policy

Given a table tasks with a column owner_id, which policy condition correctly allows users to SELECT only their own tasks using auth.uid()?

A Using <code>owner_id = auth.uid()</code> in the policy condition.

B Using <code>owner_id != auth.uid()</code> in the policy condition.

C Using <code>auth.uid() IS NULL</code> in the policy condition.

D Using <code>owner_id IS NOT NULL</code> in the policy condition.

💡 Hint

Think about how to match the task owner with the current user.

The condition owner_id = auth.uid() ensures that only tasks owned by the logged-in user are accessible.

❓ security

advanced

Preventing Unauthorized Updates Using auth.uid()

You want to create an UPDATE policy on a profiles table so users can only update their own profile. Which policy condition correctly enforces this using auth.uid()?

A Using <code>user_id = auth.uid()</code> in the policy condition.

B Using <code>auth.uid() = user_id</code> in the policy condition.

C Using <code>user_id != auth.uid()</code> in the policy condition.

D Using <code>auth.uid() IS NULL</code> in the policy condition.

💡 Hint

Remember the correct syntax for comparing columns and functions in SQL.

The condition user_id = auth.uid() correctly compares the user_id column to the current user's ID, allowing updates only on their own profile.

❓ Architecture

advanced

Combining auth.uid() with Additional Conditions in Policies

You have a documents table with columns owner_id and is_public. You want a SELECT policy that allows users to see their own documents or any document marked as public. Which condition correctly implements this using auth.uid()?

A <code>auth.uid() = owner_id AND is_public = false</code>

B <code>owner_id != auth.uid() AND is_public = false</code>

C <code>owner_id = auth.uid() OR is_public = true</code>

D <code>is_public = false OR owner_id != auth.uid()</code>

💡 Hint

Think about allowing access if either condition is true.

The condition owner_id = auth.uid() OR is_public = true allows users to see documents they own or any document that is public.

✅ Best Practice

expert

Best Practice for Using auth.uid() in Insert Policies

When creating an INSERT policy on a comments table that has a user_id column, what is the best practice to ensure users can only insert comments as themselves using auth.uid()?

A Use <code>auth.uid()</code> only in SELECT policies, not INSERT.

B Allow any <code>user_id</code> value in the INSERT without checking <code>auth.uid()</code>.

C Set <code>user_id</code> to NULL in the policy to prevent inserts.

D Require the <code>user_id</code> column to be set to <code>auth.uid()</code> in the policy's WITH CHECK expression.

💡 Hint

Think about how to prevent users from inserting comments as other users.

By requiring user_id = auth.uid() in the INSERT policy, you ensure users can only insert comments attributed to themselves, preventing impersonation.

Practice

1.

What does auth.uid() represent in Supabase row-level security policies?

easy

A. The current logged-in user's unique ID

B. The database server's ID

C. The table's primary key

D. The user's email address

Solution

1. Step 1: Understand the purpose of auth.uid()

   auth.uid() is a function that returns the unique identifier of the currently logged-in user in Supabase.

2. Step 2: Identify what auth.uid() is not

   It does not return server or table IDs, nor user email addresses directly.

3. Final Answer:

   The current logged-in user's unique ID -> Option A

4. Quick Check:

   auth.uid() = current user ID [OK]

Hint: auth.uid() always means the logged-in user's ID [OK]

Common Mistakes:

• Thinking auth.uid() returns email
• Confusing auth.uid() with table keys
• Assuming auth.uid() is server ID

2.

Which of the following is the correct syntax to allow a user to select only their own rows in a table with a user_id column?

CREATE POLICY "Select own rows" ON my_table FOR SELECT USING ( ... );

easy

A. user_id = current_user()

B. auth.uid() = user_email

C. user_id == auth.uid()

D. user_id = auth.uid()

Solution

1. Step 1: Check correct equality operator in policies

   Supabase policies use single equals = for comparison, not double equals ==.

2. Step 2: Match user_id with auth.uid()

   The correct way is to compare the table's user_id column to auth.uid().

3. Final Answer:

   user_id = auth.uid() -> Option D

4. Quick Check:

   Use single = and compare user_id to auth.uid() [OK]

Hint: Use single = to compare user_id with auth.uid() [OK]

Common Mistakes:

• Using double equals == in policy
• Comparing auth.uid() to email column
• Using current_user() instead of auth.uid()

3.

Given this policy on orders table:

CREATE POLICY "Users can select own orders" ON orders FOR SELECT USING (user_id = auth.uid());

What happens if a user with auth.uid() = 'abc123' runs a query to select orders?

medium

A. They see only orders where user_id is 'abc123'

B. They see all orders regardless of user_id

C. They get a syntax error

D. They see no orders at all

Solution

1. Step 1: Understand the policy condition

   The policy allows selecting rows where user_id equals the current user's ID.

2. Step 2: Apply the policy to the user's query

   The user with ID 'abc123' will only see rows where user_id is 'abc123'.

3. Final Answer:

   They see only orders where user_id is 'abc123' -> Option A

4. Quick Check:

   Policy filters rows by user_id = auth.uid() [OK]

Hint: Policy filters rows to match auth.uid() user_id [OK]

Common Mistakes:

• Thinking user sees all rows
• Expecting syntax error from correct policy
• Assuming no rows are returned

4.

Identify the error in this policy that aims to restrict updates to a user's own rows:

CREATE POLICY "Update own rows" ON profiles FOR UPDATE USING (user_id = auth.uid);

medium

A. user_id should be user_email

B. Wrong operator, should use == instead of =

C. Missing parentheses after auth.uid

D. Policy name cannot have spaces

Solution

1. Step 1: Check the usage of auth.uid()

   auth.uid is a function and must be called with parentheses: auth.uid().

2. Step 2: Verify other parts of the policy

   The operator = is correct, user_id is the right column, and policy names can have spaces.

3. Final Answer:

   Missing parentheses after auth.uid -> Option C

4. Quick Check:

   auth.uid() needs parentheses to call function [OK]

Hint: Always call auth.uid() with parentheses [OK]

Common Mistakes:

• Forgetting () after auth.uid
• Using == instead of = in policies
• Changing user_id to email incorrectly

5.

You want to create a policy that allows users to update their own profile only if their email is verified. The profiles table has columns user_id and email_verified (boolean). Which policy condition correctly enforces this?

hard

A. email_verified = true

B. user_id = auth.uid() AND email_verified = true

C. auth.uid() = user_id AND email_verified = false

D. user_id = auth.uid() OR email_verified = true

Solution

1. Step 1: Combine user ownership and email verification

   The policy must check both that the row belongs to the user and that their email is verified.

2. Step 2: Use AND to require both conditions

   Using AND ensures both user_id = auth.uid() and email_verified = true must be true.

3. Final Answer:

   user_id = auth.uid() AND email_verified = true -> Option B

4. Quick Check:

   Use AND to combine user_id and email_verified checks [OK]

Hint: Use AND to require both user_id and email_verified true [OK]

Common Mistakes:

• Using OR instead of AND
• Checking email_verified = false
• Omitting user_id check