Using auth.uid() in policies in Supabase - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the policy condition to allow access only to the authenticated user.

Supabase

CREATE POLICY "Allow user access" ON profiles FOR SELECT USING (user_id = [1]);

Drag options to blanks, or click blank then click option'

Auser()

Bauth.uid()

Csession_user

Dcurrent_user

Attempts:

3 left

💡 Hint

Common Mistakes

Using database functions like current_user which do not return the auth user ID.

Using session_user which is unrelated to Supabase auth.

The function auth.uid() returns the ID of the authenticated user, which is used to restrict access to their own data.

2fill in blank

medium

Complete the policy to allow updates only if the authenticated user matches the record owner.

Supabase

CREATE POLICY "Allow update by owner" ON posts FOR UPDATE USING (owner_id = [1]);

Drag options to blanks, or click blank then click option'

Aauth.uid()

Buser_id()

Ccurrent_user

Dsession_user

Attempts:

3 left

💡 Hint

Common Mistakes

Using non-existent functions like user_id().

Confusing database user functions with Supabase auth functions.

The auth.uid() function returns the authenticated user's ID, ensuring only the owner can update their posts.

3fill in blank

hard

Fix the error in the policy condition to correctly check the authenticated user ID.

Supabase

CREATE POLICY "Allow delete by owner" ON comments FOR DELETE USING (user_id = [1]);

Drag options to blanks, or click blank then click option'

Asession_user

Bcurrent_user

Cauth.uid()

Duser()

Attempts:

3 left

💡 Hint

Common Mistakes

Using database functions that do not reflect the authenticated user.

Forgetting to use parentheses with auth.uid().

The correct function to get the authenticated user's ID in Supabase policies is auth.uid(). Other options do not return the correct user ID.

4fill in blank

hard

Fill both blanks to create a policy allowing inserts only if the authenticated user matches the new record owner.

Supabase

CREATE POLICY "Allow insert by owner" ON tasks FOR INSERT WITH CHECK (owner_id = [1] AND [2] IS NOT NULL);

Drag options to blanks, or click blank then click option'

Aauth.uid()

Bnew.owner_id

Dold.owner_id

Attempts:

3 left

💡 Hint

Common Mistakes

Using old.owner_id which refers to the existing record, not the new one.

Not checking if the new owner_id is set.

The policy checks that the owner_id matches the authenticated user ID using auth.uid(), and that the new record's owner_id is not null.

5fill in blank

hard

Fill all three blanks to create a policy that allows updates only if the authenticated user owns the record and the new status is 'completed'.

Supabase

CREATE POLICY "Allow update to completed" ON orders FOR UPDATE USING (user_id = [1]) WITH CHECK (status = [2] AND [3] = 'completed');

Drag options to blanks, or click blank then click option'

Aauth.uid()

Bnew.status

Cstatus

Dold.status

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up old and new record references.

Not using auth.uid() for user ID.

The policy uses auth.uid() to check ownership, status to check the current status, and new.status to ensure the new status is 'completed'.

Practice

1.

What does auth.uid() represent in Supabase row-level security policies?

easy

A. The current logged-in user's unique ID

B. The database server's ID

C. The table's primary key

D. The user's email address

Solution

1. Step 1: Understand the purpose of auth.uid()

   auth.uid() is a function that returns the unique identifier of the currently logged-in user in Supabase.

2. Step 2: Identify what auth.uid() is not

   It does not return server or table IDs, nor user email addresses directly.

3. Final Answer:

   The current logged-in user's unique ID -> Option A

4. Quick Check:

   auth.uid() = current user ID [OK]

Hint: auth.uid() always means the logged-in user's ID [OK]

Common Mistakes:

• Thinking auth.uid() returns email
• Confusing auth.uid() with table keys
• Assuming auth.uid() is server ID

2.

Which of the following is the correct syntax to allow a user to select only their own rows in a table with a user_id column?

CREATE POLICY "Select own rows" ON my_table FOR SELECT USING ( ... );

easy

A. user_id = current_user()

B. auth.uid() = user_email

C. user_id == auth.uid()

D. user_id = auth.uid()

Solution

1. Step 1: Check correct equality operator in policies

   Supabase policies use single equals = for comparison, not double equals ==.

2. Step 2: Match user_id with auth.uid()

   The correct way is to compare the table's user_id column to auth.uid().

3. Final Answer:

   user_id = auth.uid() -> Option D

4. Quick Check:

   Use single = and compare user_id to auth.uid() [OK]

Hint: Use single = to compare user_id with auth.uid() [OK]

Common Mistakes:

• Using double equals == in policy
• Comparing auth.uid() to email column
• Using current_user() instead of auth.uid()

3.

Given this policy on orders table:

CREATE POLICY "Users can select own orders" ON orders FOR SELECT USING (user_id = auth.uid());

What happens if a user with auth.uid() = 'abc123' runs a query to select orders?

medium

A. They see only orders where user_id is 'abc123'

B. They see all orders regardless of user_id

C. They get a syntax error

D. They see no orders at all

Solution

1. Step 1: Understand the policy condition

   The policy allows selecting rows where user_id equals the current user's ID.

2. Step 2: Apply the policy to the user's query

   The user with ID 'abc123' will only see rows where user_id is 'abc123'.

3. Final Answer:

   They see only orders where user_id is 'abc123' -> Option A

4. Quick Check:

   Policy filters rows by user_id = auth.uid() [OK]

Hint: Policy filters rows to match auth.uid() user_id [OK]

Common Mistakes:

• Thinking user sees all rows
• Expecting syntax error from correct policy
• Assuming no rows are returned

4.

Identify the error in this policy that aims to restrict updates to a user's own rows:

CREATE POLICY "Update own rows" ON profiles FOR UPDATE USING (user_id = auth.uid);

medium

A. user_id should be user_email

B. Wrong operator, should use == instead of =

C. Missing parentheses after auth.uid

D. Policy name cannot have spaces

Solution

1. Step 1: Check the usage of auth.uid()

   auth.uid is a function and must be called with parentheses: auth.uid().

2. Step 2: Verify other parts of the policy

   The operator = is correct, user_id is the right column, and policy names can have spaces.

3. Final Answer:

   Missing parentheses after auth.uid -> Option C

4. Quick Check:

   auth.uid() needs parentheses to call function [OK]

Hint: Always call auth.uid() with parentheses [OK]

Common Mistakes:

• Forgetting () after auth.uid
• Using == instead of = in policies
• Changing user_id to email incorrectly

5.

You want to create a policy that allows users to update their own profile only if their email is verified. The profiles table has columns user_id and email_verified (boolean). Which policy condition correctly enforces this?

hard

A. email_verified = true

B. user_id = auth.uid() AND email_verified = true

C. auth.uid() = user_id AND email_verified = false

D. user_id = auth.uid() OR email_verified = true

Solution

1. Step 1: Combine user ownership and email verification

   The policy must check both that the row belongs to the user and that their email is verified.

2. Step 2: Use AND to require both conditions

   Using AND ensures both user_id = auth.uid() and email_verified = true must be true.

3. Final Answer:

   user_id = auth.uid() AND email_verified = true -> Option B

4. Quick Check:

   Use AND to combine user_id and email_verified checks [OK]

Hint: Use AND to require both user_id and email_verified true [OK]

Common Mistakes:

• Using OR instead of AND
• Checking email_verified = false
• Omitting user_id check