is it possible to use a reference (like field name) provided by client in supabase api call in RLS policy instead of auth.uid()?

[devhandler]

in rls policy, for id check, generally we use auth.uid() = id, etc. but for other use cases, if a client provide a string with a key, say {key: 'value'}, how can we write a select RLS policy to check (e.g., for table A) sth like "key = A.key"?

thanks.

[GaryAustin1]

If it is not part of the your table as a column, then you need to pass it in a header.
You can read headers using this code: https://postgrest.org/en/stable/references/transactions.html?highlight=http%20headers#request-headers-cookies-and-jwt-claims

[devhandler]

thank you!

when you say pass it in a header, does this need to be manually created or can i use the supabase js client lib to do it? (there are some explicit constructor option listed in https://supabase.com/docs/reference/javascript/release-notes, but no examples.)

if it is part of the table as a column, then how the RLS should be written? say "key" is also the column name of the table i'd like to implement the rls policy

  const supabase = createClient(apiURL, apiKey, {
    db: {
      schema: 'public',
    },
    auth: {
      storage: AsyncStorage,
      autoRefreshToken: true,
      persistSession: true,
      detectSessionInUrl: true,
    },
    realtime: {
      channels,
      endpoint,
    },
    global: {
      fetch: customFetch,
      headers: DEFAULT_HEADERS,
    },
  })

[GaryAustin1]

In RLS you just refer to the column by name to test. Same as if you do auth.uid() = user_id where user_id is your column.

For the header, yes you can set in createClient like you show.