Skip to content

Commit

Permalink
Merge pull request #32 from maevsi/fix/contact/delete
Browse files Browse the repository at this point in the history
fix(contact): account for null in inequality check
  • Loading branch information
dargmuesli authored Jun 23, 2023
2 parents 86160bd + 72fd095 commit 54ed437
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 3 deletions.
2 changes: 1 addition & 1 deletion schema/schema.definition.sql
Original file line number Diff line number Diff line change
Expand Up @@ -3225,7 +3225,7 @@ ALTER TABLE maevsi.contact ENABLE ROW LEVEL SECURITY;
-- Name: contact contact_delete; Type: POLICY; Schema: maevsi; Owner: postgres
--

CREATE POLICY contact_delete ON maevsi.contact FOR DELETE USING (((author_account_username = current_setting('jwt.claims.username'::text, true)) AND (account_username <> current_setting('jwt.claims.username'::text, true))));
CREATE POLICY contact_delete ON maevsi.contact FOR DELETE USING (((author_account_username = current_setting('jwt.claims.username'::text, true)) AND (account_username IS DISTINCT FROM current_setting('jwt.claims.username'::text, true))));


--
Expand Down
4 changes: 2 additions & 2 deletions src/deploy/table_contact_policy.sql
Original file line number Diff line number Diff line change
Expand Up @@ -33,11 +33,11 @@ CREATE POLICY contact_update ON maevsi.contact FOR UPDATE USING (
author_account_username = current_setting('jwt.claims.username', true)::TEXT
);

-- Only allow deletes for contacts authored by the invoker's account.
-- Only allow deletes for contacts authored by the invoker's account except for the own account's contact.
CREATE POLICY contact_delete ON maevsi.contact FOR DELETE USING (
author_account_username = current_setting('jwt.claims.username', true)::TEXT
AND
account_username != current_setting('jwt.claims.username', true)::TEXT
account_username IS DISTINCT FROM current_setting('jwt.claims.username', true)::TEXT
);

COMMIT;

0 comments on commit 54ed437

Please sign in to comment.