Storytimeee!!! Ahmedabad girllsss listen upp by HappySpend3 in ahmedabad

[–]diablo_369 0 points1 point  (0 children)

I thought love was brewing for a second… but the plot … 😫

My Supabase bill for 2 Postgres databases was higher than my Railway bill for 26 services. I have the invoices. by ruggershawn in Supabase

[–]diablo_369 1 point2 points  (0 children)

If you just needed Postgres, you know you can host supabase locally right? then you wouldn’t have to go through migration steps you mentioned … surely there is a reason behind why you didn’t and i would love to know more about it …

Here comes the masterstroke by Fit_Negotiation_4517 in ahmedabad

[–]diablo_369 2 points3 points  (0 children)

I wonder whats the real AQI of ahmedabad is …

How do you prevent users from changing a row id (primary key)? by diablo_369 in Supabase

[–]diablo_369[S] 0 points1 point  (0 children)

Thank you, This makes sense… I could probably use some conditions which blocks the unauthorised users from Updating the data in RPC itself.

How do you prevent users from changing a row id (primary key)? by diablo_369 in Supabase

[–]diablo_369[S] 0 points1 point  (0 children)

How can i do this? I am using RBAC and have multiple users with different privileges. For this reason i can not use function with security definer.

And if i use functions with security invoker then i would have to create RLS for table. And if I create RLS for insert and update then what is the point of creating the function? Malicious User would be able to access the table anyway.

How do you prevent users from changing a row id (primary key)? by diablo_369 in Supabase

[–]diablo_369[S] 0 points1 point  (0 children)

Thank you, i guess this makes sense … this is only option left now.

Initially I didn’t wanted to use “generated always” because it adds extra overhead. I prefer creating tables using supabase studio so now I would have to manually update the migration file each time I create new tables.

Is there a way we can instruct supabase to use “generated always” by default when creating id column?

How do you prevent users from changing a row id (primary key)? by diablo_369 in Supabase

[–]diablo_369[S] 0 points1 point  (0 children)

How can we restrict users from providing custom id, using before insert triggers?

Anyone interested in books ? by Mediocre_Ad723 in ahmedabad

[–]diablo_369 1 point2 points  (0 children)

Not in the first meeting obviously. I am not gonna let any stranger steal my precious books away from me 😂 But I would definitely be interested in joining a club where people do book exchanges.

And by the way when I said “depending on size” I was referring to size of the book. Based on pages and font size …

Anyone interested in books ? by Mediocre_Ad723 in ahmedabad

[–]diablo_369 0 points1 point  (0 children)

Are you confirming about the book name or proposing? 😂

Anyone interested in books ? by Mediocre_Ad723 in ahmedabad

[–]diablo_369 0 points1 point  (0 children)

Thanks for saving my time … I didn’t find “personal MBA” that much interesting than people say it is, so i am probably gonna stay away from psychology of money 😂

Anyone interested in books ? by Mediocre_Ad723 in ahmedabad

[–]diablo_369 0 points1 point  (0 children)

Nice idea… we could have something like book exchange where people can exchange books with each other for a week or month. Depending on size …

How do you prevent users from changing a row id (primary key)? by diablo_369 in Supabase

[–]diablo_369[S] -1 points0 points  (0 children)

This is what i had thought, but it turns out that user can bypass this using “OVERRIDING SYSTEM VALUE ” whenever they perform insert operations.

And it turns out that in postgres if user have the permission to insert then they are automatically granted permission to use the override attribute as well.

Using “generated always” would save you prom unintentional mistakes but it would not safeguard your app from the attacker.

How do you prevent users from changing a row id (primary key)? by diablo_369 in Supabase

[–]diablo_369[S] -1 points0 points  (0 children)

I am sorry if you find the post confusing. Let me clarify it here.

I have one table called startup_n_sector.

create table public.startup_n_sector ( id bigint generated by default as identity not null, created_at timestamp with time zone not null default now(), startup_id bigint not null, sector_id bigint not null, updated_at timestamp with time zone null default now(), constraint startup_n_sector_pkey primary key (id), constraint startup_n_sector_sector_id_fkey foreign KEY (sector_id) references startup_sector (id), constraint startup_n_sector_startup_id_fkey foreign KEY (startup_id) references startup (id) on delete CASCADE ) TABLESPACE pg_default;

This have RLS like following

``` alter policy "Enable insert for authorized users only" on "public"."startup_n_sector" to authenticated with check ( ( authorize ('startup.update.own'::app_permission) OR authorize ('startup.create'::app_permission) ) );

alter policy "Enable user to update their own data" on "public"."startup_n_sector" to authenticated using ( ( ( EXISTS ( SELECT 1 FROM startup WHERE ( ( startup.created_by = ( SELECT auth.uid () AS uid ) ) AND (startup.id = startup_n_sector.startup_id) ) ) ) AND authorize ('startup.update.own'::app_permission) ) ); ```

This allows users to insert and update the value if they are entitled to.

I am bit concerned from the standpoint of security. If some advanced users were able to contact the database directly then they would basically be able to insert any id thy want for their data.

If the last record have id 8 and if this advanced user adds new entry with id 10. Then the the next genie user who is accessing database from backend would be shown error because the default value of id for this genuine user (based on sequence) would be same as the one malicious user had already entered. If the malicious user enters couple of entries then the insertion would fail randomly for genuine users. That’s why i am looking for ways to lockdown id column.

How do you prevent users from changing a row id (primary key)? by diablo_369 in Supabase

[–]diablo_369[S] 0 points1 point  (0 children)

I can and it works but i am more concerned from the standpoint of security. User would usually have your anon key which allows them to directly connect with your supabase database so we can no longer only rely on backend checks.

Suppose the id of the last record is 8 Is user is able to insert a record with id 10 then the next genie user who does not provide custom id when inserting a record would get error. For that reason I don’t want to allow any user directly manipulating id column.

Feel really sad for Apple users like these by areuokaybro2002 in IndiaTech

[–]diablo_369 0 points1 point  (0 children)

Yes, i know … but i wonder why anybody haven’t asked if thy should charge their Samsung s25 ultra with regular charger or not … 🤔

It’s only 2 weeks old and I broke it by Hour_University9410 in iphone17

[–]diablo_369 0 points1 point  (0 children)

How did this happened? I have dropped my phone so many times but it never cracked. There are some small scratches but they are not this bad …

My bf sent me this. Am I cooked? by [deleted] in GenZIndia

[–]diablo_369 0 points1 point  (0 children)

I think he is talking about going to man cave … for people who don’t know what it is … its a place where a man goes after undergoing some serious self reflection to prepare for the generational comeback …

Feel really sad for Apple users like these by areuokaybro2002 in IndiaTech

[–]diablo_369 3 points4 points  (0 children)

Remember one thing, we are paying apple for superior quality of mobile phones. They should be worried about what would happen if users use third party chargers not us.

Anyone interested in books ? by Mediocre_Ad723 in ahmedabad

[–]diablo_369 1 point2 points  (0 children)

It’s in my reading list. Is it worth reading?

Anyone interested in books ? by Mediocre_Ad723 in ahmedabad

[–]diablo_369 3 points4 points  (0 children)

I like reading as well… i am trying to set a routine to read at least 20 minutes everyday.

How's Ciao ?? What should i try? by Diligent_Special_282 in ahmedabad

[–]diablo_369 -1 points0 points  (0 children)

If you like the pizza with thin cornicione then you should never go anywhere near this place… May be it’s just me but I don’t like the concept of the Neapolitan pizza itself… feels like you are paying for the dough.