Ravine · ADR 0004

4.Row-level security, in the database.!

The problem

Guests and signed-in people save places, write private notes and later follow each other. The wrong query must return nothing, not someone else's notes.

The options

Filter by user in every query and trust every call site, forever; Postgres row-level policies, so the database refuses what the code forgets.

The move

Policies. When following people arrived, new read-only policies opened exactly the shared tables, saves and collections, and nothing else; notes, taste and reminders stayed closed.

What we accepted

A session variable to set on every connection, and a test whose only job is to fail if a policy is loosened.

When we would revisit

If a query pattern needs a bypass, that is the moment to redesign the policy, not to add a role that skips it.

Back to Ravine