buildPoliciesForPath() — supabase Function Reference

Architecture documentation for the buildPoliciesForPath() function in Policies.utils.ts from the supabase codebase.

Function typescript ContentManagement AccessControl calls 1 called by 1

Entity Profile

ContentManagement→ AccessControl→ buildPoliciesForPath() — supabase Function Reference

Dependency Diagram

graph TD
  0f79b9f8_05d2_1b6f_0b8b_79c7b67cf61d["buildPoliciesForPath()"]
  410a28a1_15c2_42bc_2aea_d86ef79842fa["generateProgrammaticPoliciesForTable()"]
  410a28a1_15c2_42bc_2aea_d86ef79842fa -->|calls| 0f79b9f8_05d2_1b6f_0b8b_79c7b67cf61d
  12f30a10_8c77_dfc2_4c89_6857f9e2229c["buildPolicyExpression()"]
  0f79b9f8_05d2_1b6f_0b8b_79c7b67cf61d -->|calls| 12f30a10_8c77_dfc2_4c89_6857f9e2229c
  style 0f79b9f8_05d2_1b6f_0b8b_79c7b67cf61d fill:#6366f1,stroke:#818cf8,color:#fff

Relationship Graph

Source Code

apps/studio/components/interfaces/Auth/Policies/Policies.utils.ts lines 310–344

const buildPoliciesForPath = (
  table: { name: string; schema: string },
  path: Relationship[]
): GeneratedPolicy[] => {
  const expression = buildPolicyExpression(path)
  const targetCol = path[0].source_column_name

  return (['SELECT', 'INSERT', 'UPDATE', 'DELETE'] as const).map((command) => {
    const name = `Enable ${command.toLowerCase()} access for users based on ${ident(targetCol)}`
    const base = `CREATE POLICY "${name}" ON ${ident(table.schema)}.${ident(table.name)} AS PERMISSIVE FOR ${command} TO authenticated`

    const sql =
      command === 'INSERT'
        ? `${base} WITH CHECK (${expression});`
        : command === 'UPDATE'
          ? `${base} USING (${expression}) WITH CHECK (${expression});`
          : `${base} USING (${expression});`

    // Structured data for mutation API
    const definition = command === 'INSERT' ? undefined : expression
    const check = command === 'SELECT' || command === 'DELETE' ? undefined : expression

    return {
      name,
      sql,
      command,
      table: table.name,
      schema: table.schema,
      definition,
      check,
      action: 'PERMISSIVE' as const,
      roles: ['authenticated'],
    }
  })
}