buildPolicyExpression() — supabase Function Reference

Architecture documentation for the buildPolicyExpression() function in Policies.utils.ts from the supabase codebase.

Function typescript ContentManagement MediaManagement called by 1

Entity Profile

ContentManagement→ MediaManagement→ buildPolicyExpression() — supabase Function Reference

Dependency Diagram

graph TD
  12f30a10_8c77_dfc2_4c89_6857f9e2229c["buildPolicyExpression()"]
  0f79b9f8_05d2_1b6f_0b8b_79c7b67cf61d["buildPoliciesForPath()"]
  0f79b9f8_05d2_1b6f_0b8b_79c7b67cf61d -->|calls| 12f30a10_8c77_dfc2_4c89_6857f9e2229c
  style 12f30a10_8c77_dfc2_4c89_6857f9e2229c fill:#6366f1,stroke:#818cf8,color:#fff

Relationship Graph

Source Code

apps/studio/components/interfaces/Auth/Policies/Policies.utils.ts lines 273–307

const buildPolicyExpression = (path: Relationship[]): string => {
  if (path.length === 0) return ''

  // Direct FK to auth.users
  if (path.length === 1) {
    return `(select auth.uid()) = ${ident(path[0].source_column_name)}`
  }

  // Indirect path - build EXISTS with JOINs
  const [first, ...rest] = path
  const firstTarget = `${ident(first.target_table_schema)}.${ident(first.target_table_name)}`
  const source = `${ident(first.source_schema)}.${ident(first.source_table_name)}`
  const last = path[path.length - 1]

  const joins = rest
    .slice(0, -1)
    .map((r) => {
      const targetSchema = ident(r.target_table_schema)
      const targetTable = ident(r.target_table_name)
      const targetColumn = ident(r.target_column_name)

      const sourceSchema = ident(r.source_schema)
      const sourceTable = ident(r.source_table_name)
      const sourceColumn = ident(r.source_column_name)
      return `join ${targetSchema}.${targetTable} on ${targetSchema}.${targetTable}.${targetColumn} = ${sourceSchema}.${sourceTable}.${sourceColumn}`
    })
    .join('\n  ')

  return `exists (
  select 1 from ${firstTarget}
  ${joins}
  where ${firstTarget}.${ident(first.target_column_name)} = ${source}.${ident(first.source_column_name)}
  and ${ident(last.source_schema)}.${ident(last.source_table_name)}.${ident(last.source_column_name)} = (select auth.uid())
)`
}