RLS disabled on VIEW, what could go wrong
I have a jobs table that uses RLS and works perfectly, but I want to provide visibility into certain content from the jobs table and other tables that help build a job, such as jobs_skills, etc., and to certain categories of users, such as: Public (everyone should be able to see certain approved jobs).
To provide this type of access to the tables, I could use RPC functions or many other approaches, but they aren’t performant at all. The best option, however, seems to be a view, because it gives you good efficiency, high flexibility, you can build (virtual) foreign keys if you want, etc.
If I were to enable RLS on that view, then it would automatically inherit the RLS from the jobs table, and the whole thing wouldn’t make sense anymore. But if I leave it without RLS and use WHERE to limit access (just like I would in an RLS policy, where I’d also use SQL to construct the policy), then that would let me control access through those WHERE conditions. Still, I constantly see that red dot saying I haven’t added RLS and the “unrestricted” label.
What do you recommend I do?
To provide this type of access to the tables, I could use RPC functions or many other approaches, but they aren’t performant at all. The best option, however, seems to be a view, because it gives you good efficiency, high flexibility, you can build (virtual) foreign keys if you want, etc.
If I were to enable RLS on that view, then it would automatically inherit the RLS from the jobs table, and the whole thing wouldn’t make sense anymore. But if I leave it without RLS and use WHERE to limit access (just like I would in an RLS policy, where I’d also use SQL to construct the policy), then that would let me control access through those WHERE conditions. Still, I constantly see that red dot saying I haven’t added RLS and the “unrestricted” label.
What do you recommend I do?
