You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: pkgs/client/SECURITY.md
+17-13Lines changed: 17 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -22,11 +22,13 @@ pgflow ships with NO permissions. The SQL below is a **convenience snippet** tha
22
22
23
23
> [!CAUTION]
24
24
> This SQL grants BROAD permissions! After running this, ANY authenticated user can:
25
+
>
25
26
> - Start ANY flow
26
27
> - View ANY run (if they know the run_id)
27
28
> - See ALL flow definitions
28
-
>
29
+
>
29
30
> It is YOUR responsibility to:
31
+
>
30
32
> - Tailor these permissions to your specific needs
31
33
> - Implement Row Level Security policies
32
34
> - Add proper access controls
@@ -51,40 +53,42 @@ This is suitable for development and trusted environments only.
51
53
Since pgflow doesn't handle security yet, you might want to:
52
54
53
55
1.**Add Row Level Security**
54
-
56
+
55
57
The key to implementing RLS with pgflow is to include a `user_id` field in your flow's input object. This allows you to create policies that check if the current user matches the user who started the flow.
56
-
58
+
57
59
First, include user_id in your flow input type:
60
+
58
61
```typescript
59
62
import { Flow } from'@pgflow/dsl';
60
-
63
+
61
64
// Define input type with user_id
62
65
typeMyFlowInput= {
63
-
user_id:string; // <<<<< Add this field
66
+
user_id:string; // <<<<< Add this field
64
67
data:string;
65
68
// ... other fields
66
69
};
67
-
70
+
68
71
exportconst MyFlow =newFlow<MyFlowInput>({
69
-
slug: 'my_secure_flow',
70
-
})
72
+
slug: 'mySecureFlow',
73
+
});
71
74
// ... rest of flow definition
72
75
```
73
-
76
+
74
77
Then create RLS policies and an index for performance:
FOR SELECT USING ((SELECTauth.uid())::text= input->>'user_id');
86
90
```
87
-
91
+
88
92
For more details about the pgflow schema and the `runs` table structure, see the [Schema Design section](../core/README.md#schema-design) in the core documentation.
89
93
90
94
2.**Track User Attribution**
@@ -93,4 +97,4 @@ Since pgflow doesn't handle security yet, you might want to:
93
97
94
98
## Questions?
95
99
96
-
If you have security concerns or suggestions, please share them in the [GitHub discussions](https://github.com/pgflow-dev/pgflow/discussions).
100
+
If you have security concerns or suggestions, please share them in the [GitHub discussions](https://github.com/pgflow-dev/pgflow/discussions).
0 commit comments