Database > Row-Level Security
Database > Row-Level SecurityKroxt BaaS SDK v1.0.5

Row-Level Security

Secure access scopes at the document level. When setting up a collection, specify RLS parameters:

Public

Read and write access is open using the Public API Key header.

Authenticated

Only verified logged-in users with a valid Bearer token can access.

Owner Only

Users can read and write only documents matching their user ID.

Configuring RLS Rules in Collection Schemas:

Specify RLS scopes for read/write behaviors inside your collection schema configurations. Supported scopes are "public", "authenticated", and "owner":

rules.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
{
  "name": "posts",
  "rules": {
    "read": "public",        // Anyone can read posts
    "write": "authenticated"  // Only logged-in users can write posts
  }
}

{
  "name": "user_profiles",
  "rules": {
    "read": "owner",         // Only the profile owner can read
    "write": "owner"         // Only the profile owner can modify
  }
}

RLS Enforcement Code Examples

1. Public Access (Open to all visitors):
public.ts
1
2
3
4
5
6
// RLS Rule: read = "public", write = "public"
// Anyone can write to this feedback collection without signing in
const newFeedback = await baas.collection("feedbacks").create({
  email: "anonymous@user.com",
  message: "Love the speed!",
});
2. Owner Only Access (Requires logged-in session, user matches ownerId):
owner.ts
1
2
3
4
5
6
7
8
// RLS Rule: read = "owner", write = "owner"
// When creating documents, Kroxt automatically assigns the current user ID as ownerId
const privateNote = await baas.collection("private_notes").create({
  content: "Strictly confidential notes",
});

// Querying owner collections returns only documents owned by the logged-in user
const myNotes = await baas.collection("private_notes").get();
Client-side Forbidden Write Error:

If an unauthenticated client triggers an action blocked by RLS rules, the request is rejected with a `403 Forbidden` error:

error.ts
1
2
3
4
5
6
7
try {
  // Attempting write to an Authenticated/Owner collection without login:
  await baas.collection("protected_data").create({ text: "Hello" });
} catch (error: any) {
  console.error("Status:", error.status); // 403
  console.error("Message:", error.message); // "RLS: Forbidden on write"
}