Row Level Security with multiple columns

Requirement
Allow users of an organisation to view all rows where their organisation is involved, where involvement is specified by the org name in one of three columns

table structure
id, original_organisation, partner_organisation, active_organisation, customer

Current RLS table
UserName, original_organisation, partner_organisation, active_organisation, customer
test user, test_company, test_company, test_company, β€œβ€

Issue: Unable to see any data as the organisation is never the same for all 3 values

  1. Is there a way to change the RLS so that any column condition matching is sufficient per row?

  2. Is there a way to look for the column value in a list of values stored in a column?
    (I could add a calculated value with a list of involved organisations)

Hello @Ted, I just want to confirm that I understand the data that is being returned in the dataset you are applying this to. Are you saying that values in a row for a single ID will never contain the value for the original_org, partner_org, and active_org, all at once? If that is the case, are the remaining columns returning a null value?

With that information, my first thought is you should return 3 rows per UserName. In each row return a value for 1 of the 3 columns and set up your RLS that way to ensure it isn’t directly looking for all 3 of them to match on a single row. I think that would bypass the issue you are currently facing.

Alternatively, it may be worth considering updating your dataset to return all 3 values in each row to simplify the RLS process and improve filtering capabilities on the dashboard. I hope this helps!

1 Like

Hi Dylan,

That’s great - multiple rows per username in the RLS rules table is the way to go.

The original_organisation and partner_organisation will never be the same, and the active_organisation will always be one of the previous two.

With this in mind I created an RLS rules table as below:

UserName, original_organisation, partner_organisation
JohnDoe, org1, NULL
JohnDoe, NULL, org1
DonJoe, org2, NULL
DonJoe, NULL, org2

This has solved the problem

1 Like

Hello @Ted, that is great! I appreciate the quick feedback as well. I am glad it is working how you expected. Thank you!

1 Like