One row-level security policy as pg_policy holds it. It holds the name,
the table, the command it applies to, and the USING and WITH CHECK
expressions as the database renders them.
Two names are the adapter's business, and the migration helpers write
both. mediate_scope_<operation> is a SELECT policy that narrows the
rows of that operation. The helper guards it on
current_setting('mediate.operation', true), so two operations on one
table never widen each other. mediate_gate_<operation> is an UPDATE
policy. check reads its USING expression before a write, and the
database applies its WITH CHECK expression to the write itself.
A policy under any other name belongs to whoever wrote it, and kind/1
answers :other for it.
Summary
Functions
The command letter polcmd carries, as an atom.
The policies a version's text carries, back as structs. An expression the database renders runs over several lines. So the line that begins a policy holds a table, a name, and a command, and nothing else. Every other line belongs to the expression above it.
The name of the gate policy of an operation.
What the policy is to the adapter: the scope of an operation, its gate, or none of its business.
The name of the scope policy of an operation.
The statement that writes the policy. The version carries no role list, because the helpers write none. A policy of this package applies to every role and names the role it admits inside its expression.
The policy as the text a policy version carries.
Types
@type command() :: :all | :select | :insert | :update | :delete
The command a policy applies to, as polcmd spells it.
@type t() :: %Mediate.Postgres.Policy{ command: command(), name: String.t(), table: String.t(), using: String.t() | nil, with_check: String.t() | nil }
One policy as pg_policy holds it.
Functions
The command letter polcmd carries, as an atom.
The policies a version's text carries, back as structs. An expression the database renders runs over several lines. So the line that begins a policy holds a table, a name, and a command, and nothing else. Every other line belongs to the expression above it.
The name of the gate policy of an operation.
What the policy is to the adapter: the scope of an operation, its gate, or none of its business.
The name of the scope policy of an operation.
The statement that writes the policy. The version carries no role list, because the helpers write none. A policy of this package applies to every role and names the role it admits inside its expression.
The policy as the text a policy version carries.