SpacetimeDB
SpacetimeDB copied to clipboard
RLS: Add support for parameterized queries
Support the @sender parameter as defined by the RLS proposal.
/// A user only has access to their row
#[spacetimedb::client_visibility_filter]
const USER_FILTER: Filter = Filter::Sql("
SELECT * FROM user WHERE identity = @sender
");
P1 - Need to support @sender
This will be implemented initially as syntactic sugar meaning that we will resolve the @sender parameter at parse time.
Implications:
- This changes the semantics of sql string comparison
- Two clients can submit byte-wise equivalent, but not semantically equivalent sql queries
- Will have to review everywhere that we compare or hash sql strings
- One place that I know of is when a new subscription is made
Required tests:
@senderquery@sendersubscription@sendersubscriptions (byte-wise equal) from two different clients
Closed by #2483