upsert() requires RLS SELECT operation?
I've got a public contact form that writes directly from client to a table. Since it's public, I allow everyone to INSERT and UPDATE but I'd prefer to disable SELECT. I'm using the
I am using
upsert() method since users can update fields (it's a multi-step form with incremental saves). It appears I have to enable a SELECT policy in order for the upsert() to work. Is this true? Any other way to secure the table data more?I am using
{ returning: 'minimal' } in my upsert() method but it still fails (violates row-level security policy) without the SELECT policy in place.