1+ -- Enable Row Level Security for all relevant tables
2+ ALTER TABLE users ENABLE ROW LEVEL SECURITY;
3+ ALTER TABLE addresses ENABLE ROW LEVEL SECURITY;
4+ ALTER TABLE carts ENABLE ROW LEVEL SECURITY;
5+ ALTER TABLE cart_items ENABLE ROW LEVEL SECURITY;
6+ ALTER TABLE orders ENABLE ROW LEVEL SECURITY;
7+ ALTER TABLE order_items ENABLE ROW LEVEL SECURITY;
8+ ALTER TABLE products ENABLE ROW LEVEL SECURITY;
9+ ALTER TABLE categories ENABLE ROW LEVEL SECURITY;
10+
11+ -- Force RLS for table owners (recommended by Supabase)
12+ ALTER TABLE users FORCE ROW LEVEL SECURITY;
13+ ALTER TABLE addresses FORCE ROW LEVEL SECURITY;
14+ ALTER TABLE carts FORCE ROW LEVEL SECURITY;
15+ ALTER TABLE cart_items FORCE ROW LEVEL SECURITY;
16+ ALTER TABLE orders FORCE ROW LEVEL SECURITY;
17+ ALTER TABLE order_items FORCE ROW LEVEL SECURITY;
18+ ALTER TABLE products FORCE ROW LEVEL SECURITY;
19+ ALTER TABLE categories FORCE ROW LEVEL SECURITY;
20+
21+
22+ -- Policies for 'users' table
23+ -- Users can select their own data
24+ CREATE POLICY " Allow individual select access" ON users FOR SELECT
25+ USING (auth .uid () = id);
26+ -- Users can update their own data
27+ CREATE POLICY " Allow individual update access" ON users FOR UPDATE
28+ USING (auth .uid () = id)
29+ WITH CHECK (auth .uid () = id);
30+
31+ -- Policies for 'addresses' table
32+ -- Users can manage their own addresses fully
33+ CREATE POLICY " Allow full access to owner" ON addresses FOR ALL
34+ USING (auth .uid () = user_id)
35+ WITH CHECK (auth .uid () = user_id);
36+
37+ -- Policies for 'carts' table
38+ -- Users can manage their own cart fully
39+ CREATE POLICY " Allow full access to owner" ON carts FOR ALL
40+ USING (auth .uid () = user_id)
41+ WITH CHECK (auth .uid () = user_id);
42+
43+ -- Policies for 'cart_items' table
44+ -- Users can manage items only if they own the corresponding cart
45+ CREATE POLICY " Allow access based on cart owner" ON cart_items FOR ALL
46+ USING ( EXISTS (SELECT 1 FROM carts WHERE carts .id = cart_items .cart_id AND carts .user_id = auth .uid ()) )
47+ WITH CHECK ( EXISTS (SELECT 1 FROM carts WHERE carts .id = cart_items .cart_id AND carts .user_id = auth .uid ()) );
48+
49+ -- Policies for 'orders' table
50+ -- Users can select their own orders
51+ CREATE POLICY " Allow select access to owner" ON orders FOR SELECT
52+ USING (auth .uid () = user_id);
53+ -- Users can insert orders (user_id check ensures they insert for themselves)
54+ CREATE POLICY " Allow insert for authenticated users" ON orders FOR INSERT
55+ WITH CHECK (auth .uid () = user_id);
56+ -- (No UPDATE/DELETE policies initially - managed by API logic)
57+
58+ -- Policies for 'order_items' table
59+ -- Users can select items belonging to their own orders
60+ CREATE POLICY " Allow select based on order owner" ON order_items FOR SELECT
61+ USING ( EXISTS (SELECT 1 FROM orders WHERE orders .id = order_items .order_id AND orders .user_id = auth .uid ()) );
62+ -- (No INSERT/UPDATE/DELETE policies initially)
63+
64+ -- Policies for 'products' table
65+ -- Allow public read access to products
66+ CREATE POLICY " Allow public select access" ON products FOR SELECT
67+ USING (true);
68+ -- Allow authenticated users to manage products (can be restricted to admin later)
69+ CREATE POLICY " Allow modification for authenticated users" ON products FOR ALL
70+ USING (auth .role () = ' authenticated' -- Allow reading existing rows if authenticated
71+ WITH CHECK (auth .role () = ' authenticated' -- Check applies to INSERT/UPDATE
72+
73+ -- Policies for 'categories' table
74+ -- Allow public read access to categories
75+ CREATE POLICY " Allow public select access" ON categories FOR SELECT
76+ USING (true);
77+ -- Allow authenticated users to manage categories (can be restricted to admin later)
78+ CREATE POLICY " Allow modification for authenticated users" ON categories FOR ALL
79+ USING (auth .role () = ' authenticated' -- Allow reading existing rows if authenticated
80+ WITH CHECK (auth .role () = ' authenticated' -- Check applies to INSERT/UPDATE
0 commit comments