zlacker

>>saisri+(OP)
Do what it’s worth supabase definitely feels slow to me. Neon, in contrast, feels lightning fast for my workloads.

>>gkapur+6m
for what it's worth i use supabase because it's the fastest way to get from 0-1 for app development. most backend stuff for getting off the ground is not very interesting so getting the graphql api, oauth integration, db migrations, some user authorization story for free is what i'm looking for from supabase.

>>kbar13+sp
I’m using Supabase for similar reasons but there’s one specific situation I’m trying to sort out.

Say you have a user “profile” which includes their privileges - like say a column named “privileges” which is some JSON object denoting what they can/can’t do.

Even with RLS, how do you ensure that a user can’t simply make a curl call with their own JWT to elevate their own privileges?

Basically, how to enforce column level security?

The best thing I can think of is to place “privileges” in a child table and only let the service account update that table.

>>Sai_+1A1
Have you checked out this repo: https://github.com/supabase-community/supabase-custom-claims?

The "raw_app_meta_data" stored for a user is not writeable by the user, so you can store roles and/or privileges in there.