24 lines
1.2 KiB
SQL
24 lines
1.2 KiB
SQL
-- Realtime evaluates these same SELECT policies for every INSERT/UPDATE event.
|
|
-- Players may read their own appeal history; only active staff may read others.
|
|
grant select on public.account_appeals to authenticated;
|
|
create policy "Players and active staff read account appeals"
|
|
on public.account_appeals for select to authenticated using (
|
|
owner_id=(select auth.uid()) or exists (
|
|
select 1 from public.profiles p
|
|
where p.id=(select auth.uid()) and p.role in ('moderator','admin') and p.account_status='active'
|
|
)
|
|
);
|
|
|
|
-- Standalone SQL test databases do not configure the hosted Realtime publication.
|
|
do $$ begin
|
|
if exists(select 1 from pg_publication where pubname='supabase_realtime') then
|
|
if not exists(select 1 from pg_publication_tables where pubname='supabase_realtime' and schemaname='public' and tablename='account_appeals') then
|
|
alter publication supabase_realtime add table public.account_appeals;
|
|
end if;
|
|
-- The existing own_profile policy restricts status changes to the owner.
|
|
if not exists(select 1 from pg_publication_tables where pubname='supabase_realtime' and schemaname='public' and tablename='profiles') then
|
|
alter publication supabase_realtime add table public.profiles;
|
|
end if;
|
|
end if;
|
|
end $$;
|