diff --git a/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts b/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts
index b533e6779b9..3f3f3cf9754 100644
--- a/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts
+++ b/apps/docs/components/Navigation/NavigationMenu/NavigationMenu.constants.ts
@@ -607,6 +607,10 @@ export const auth = {
name: 'Column Level Security',
url: '/guides/auth/column-level-security',
},
+ {
+ name: 'Custom Claims & RBAC',
+ url: '/guides/auth/custom-claims-and-role-based-access-control-rbac',
+ },
],
},
{
diff --git a/apps/docs/content/guides/auth/auth-hooks.mdx b/apps/docs/content/guides/auth/auth-hooks.mdx
index f094433bcd6..c6a833b30fc 100644
--- a/apps/docs/content/guides/auth/auth-hooks.mdx
+++ b/apps/docs/content/guides/auth/auth-hooks.mdx
@@ -572,7 +572,7 @@ as $$
is_admin boolean;
begin
-- Check if the user is marked as admin in the profiles table
- select is_admin into is_admin from profiles where user_id = event->>'user_id'::uuid;
+ select is_admin into is_admin from profiles where user_id = (event->>'user_id')::uuid;
-- Proceed only if the user is an admin
if is_admin then
diff --git a/apps/docs/content/guides/auth/custom-claims-and-role-based-access-control-rbac.mdx b/apps/docs/content/guides/auth/custom-claims-and-role-based-access-control-rbac.mdx
new file mode 100644
index 00000000000..b1f22158f9b
--- /dev/null
+++ b/apps/docs/content/guides/auth/custom-claims-and-role-based-access-control-rbac.mdx
@@ -0,0 +1,278 @@
+---
+id: 'custom-claims-and-role-based-access-control-rbac'
+title: 'Custom Claims & Role-based Access Control (RBAC)'
+description: 'Use Auth Hooks to add custom claims for managing role-based access control.'
+---
+
+Custom Claims are special attributes attached to a user that you can use to control access to portions of your application. For example:
+
+```json
+{
+ "user_role": "admin",
+ "plan": "TRIAL",
+ "user_level": 100,
+ "group_name": "Super Guild!",
+ "joined_on": "2022-05-20T14:28:18.217Z",
+ "group_manager": false,
+ "items": ["toothpick", "string", "ring"]
+}
+```
+
+To implement Role-Based Access Control (RBAC) with `custom claims`, use a [Custom Access Token Auth Hook](/guides/auth/auth-hooks#hook-custom-access-token). This hook runs before a token is issued. You can use it to add additional claims to the user's JWT.
+
+This guide uses the [Slack Clone example](https://github.com/supabase/supabase/tree/master/examples/slack-clone/nextjs-slack-clone) to demonstrate how to add a `user_role` claim and use it in your [Row Level Security (RLS) policies](/guides/auth/row-level-security).
+
+## Create a table to track user roles and permissions
+
+In this example, you will implement two user roles with specific permissions:
+
+- `moderator`: A moderator can delete all messages but not channels.
+- `admin`: An admin can delete all messages and channels.
+
+```sql supabase/migrations/init.sql
+-- Custom types
+create type public.app_permission as enum ('channels.delete', 'messages.delete');
+create type public.app_role as enum ('admin', 'moderator');
+
+-- USER ROLES
+create table public.user_roles (
+ id bigint generated by default as identity primary key,
+ user_id uuid references public.users on delete cascade not null,
+ role app_role not null,
+ unique (user_id, role)
+);
+comment on table public.user_roles is 'Application roles for each user.';
+
+-- ROLE PERMISSIONS
+create table public.role_permissions (
+ id bigint generated by default as identity primary key,
+ role app_role not null,
+ permission app_permission not null,
+ unique (role, permission)
+);
+comment on table public.role_permissions is 'Application permissions for each role.';
+```
+
+
+
+ For the [full schema](https://github.com/supabase/supabase/blob/master/examples/slack-clone/nextjs-slack-clone/README.md), see the example application on [GitHub](https://github.com/supabase/supabase/tree/master/examples/slack-clone/nextjs-slack-clone).
+
+
+
+You can now manage your roles and permissions in SQL. For example, to add the mentioned roles and permissions from above, run:
+
+```sql supabase/seed.sql
+insert into public.role_permissions (role, permission)
+values
+ ('admin', 'channels.delete'),
+ ('admin', 'messages.delete'),
+ ('moderator', 'messages.delete');
+```
+
+## Create Auth Hook to apply user role
+
+The [Custom Access Token Auth Hook](/guides/auth/auth-hooks#hook-custom-access-token) runs before a token is issued. You can use it edit the JWT.
+
+
+
+
+```sql supabase/migrations/auth_hook.sql
+-- Create the auth hook function
+create or replace function public.custom_access_token_hook(event jsonb)
+returns jsonb
+language plpgsql
+immutable
+as $$
+ declare
+ claims jsonb;
+ user_role public.app_role;
+ begin
+ -- Check if the user is marked as admin in the profiles table
+ select role into user_role from public.user_roles where user_id = (event->>'user_id')::uuid;
+
+ claims := event->'claims';
+
+ if user_role is not null then
+ -- Set the claim
+ claims := jsonb_set(claims, '{user_role}', to_jsonb(user_role));
+ else
+ claims := jsonb_set(claims, '{user_role}', 'null');
+ end if;
+
+ -- Update the 'claims' object in the original event
+ event := jsonb_set(event, '{claims}', claims);
+
+ -- Return the modified or original event
+ return event;
+ end;
+$$;
+
+grant usage on schema public to supabase_auth_admin;
+
+grant execute
+ on function public.custom_access_token_hook
+ to supabase_auth_admin;
+
+revoke execute
+ on function public.custom_access_token_hook
+ from authenticated, anon;
+
+grant all
+ on table public.user_roles
+to supabase_auth_admin;
+
+revoke all
+ on table public.user_roles
+ from authenticated, anon;
+
+create policy "Allow auth admin to read user roles" ON public.user_roles
+as permissive for select
+to supabase_auth_admin
+using (true)
+```
+
+
+
+
+```sql supabase/migrations/auth_hook.sql
+-- Enable the "plv8" extension
+create extension plv8;
+
+-- Create the auth hook function
+create or replace function custom_access_token_hook(event jsonb)
+returns jsonb
+language plv8
+as $$
+ var user_role;
+
+ // Fetch the current user's user_role from the public user_roles table.
+ var result = plv8.execute("select role from public.user_roles where user_id = $1", [event.user_id]);
+ if (result.length > 0) {
+ user_role = result[0].role;
+ } else {
+ // Assign null
+ user_role = null;
+ }
+
+ // Check if 'claims' exists in the event object; if not, initialize it
+ if (!event.claims) {
+ event.claims = {};
+ }
+
+ // Update the level in the claims
+ event.claims.user_role = user_role;
+
+ return event;
+$$;
+
+grant usage on schema public to supabase_auth_admin;
+
+grant execute
+ on function public.custom_access_token_hook
+ to supabase_auth_admin;
+
+revoke execute
+ on function public.custom_access_token_hook
+ from authenticated, anon;
+
+grant all
+ on table public.user_roles
+to supabase_auth_admin;
+
+revoke all
+ on table public.user_roles
+ from authenticated, anon;
+
+create policy "Allow auth admin to read user roles" ON public.user_roles
+as permissive for select
+to supabase_auth_admin
+using (true)
+```
+
+
+
+
+### Enable the hook
+
+In the dashboard, navigate to [`Authentication > Hooks (Beta)`](/dashboard/project/_/auth/hooks) and select the appropriate PostgreSQL function from the dropdown menu.
+
+When developing locally, follow the [local development](/guides/auth/auth-hooks#local-development) instructions.
+
+
+
+To learn more about Auth Hooks, see the [Auth Hooks docs](/guides/auth/auth-hooks).
+
+
+
+## Accessing custom claims in RLS policies
+
+To utilize Role-Based Access Control (RBAC) in Row Level Security (RLS) policies, create an `authorize` method that reads the user's role from their JWT and checks the role's permissions:
+
+```sql supabase/migrations/init.sql
+create function public.authorize(
+ requested_permission app_permission,
+ user_id uuid
+)
+returns boolean as $$
+declare
+ bind_permissions int;
+begin
+ select count(*)
+ from public.role_permissions
+ where role_permissions.permission = authorize.requested_permission
+ and role_permissions.role = (auth.jwt() ->> 'user_role')::public.app_role
+ into bind_permissions;
+
+ return bind_permissions > 0;
+end;
+$$ language plpgsql security definer set search_path = public;
+```
+
+
+
+You can read more about using functions in RLS policies in the [RLS guide](/guides/auth/row-level-security#using-functions).
+
+
+
+You can then use the `authorize` method within your RLS policies. For example, to enable the desired delete access, you would add the following policies:
+
+```sql
+create policy "Allow authorized delete access" on public.channels for delete using ( authorize('channels.delete', auth.uid()) );
+create policy "Allow authorized delete access" on public.messages for delete using ( authorize('messages.delete', auth.uid()) );
+```
+
+## Accessing custom claims in your application
+
+The auth hook will only modify the access token JWT but not the auth response. Therefore, to access the custom claims in your application, e.g. your browser client, or server-side middleware, you will need to decode the `access_token` JWT on the auth session.
+
+In a JavaScript client application you can for example use the [`jwt-decode` package](https://www.npmjs.com/package/jwt-decode):
+
+```js
+import { jwtDecode } from 'jwt-decode'
+
+const { subscription: authListener } = supabase.auth.onAuthStateChange(async (event, session) => {
+ if (session) {
+ const jwt = jwtDecode(session.access_token)
+ const userRole = jwt.user_role
+ }
+})
+```
+
+For server-side logic you can use packages like [express-jwt](https://github.com/auth0/express-jwt), [koa-jwt](https://github.com/stiang/koa-jwt), [PyJWT](https://github.com/jpadilla/pyjwt), [dart_jsonwebtoken](https://pub.dev/packages/dart_jsonwebtoken), [Microsoft.AspNetCore.Authentication.JwtBearer](https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.JwtBearer), etc.
+
+## Conclusion
+
+You now have a robust system in place to manage user roles and permissions within your database that automatically propagates to Supabase Auth.
+
+## More resources
+
+- [Auth Hooks](/guides/auth/auth-hooks)
+- [Row Level Security](/guides/auth/row-level-security)
+- [RLS Functions](/guides/auth/row-level-security#using-functions)
+- [Next.js Slack Clone Example](https://github.com/supabase/supabase/tree/master/examples/slack-clone/nextjs-slack-clone)
diff --git a/examples/slack-clone/nextjs-slack-clone/README.md b/examples/slack-clone/nextjs-slack-clone/README.md
index 6041b6b84ea..183701a7358 100644
--- a/examples/slack-clone/nextjs-slack-clone/README.md
+++ b/examples/slack-clone/nextjs-slack-clone/README.md
@@ -115,173 +115,8 @@ When you start a Postgres database on Supabase, we populate it with an `auth` sc
When a user logs in, they are issued a JWT with the role `authenticated` and their UUID.
We can use these details to provide fine-grained control over what each user can and cannot do.
-Full schema here with role-based access control:
-
-```sql
---
--- For use with https://github.com/supabase/supabase/tree/master/examples/slack-clone/nextjs-slack-clone
---
-
--- Custom types
-create type public.app_permission as enum ('channels.delete', 'messages.delete');
-create type public.app_role as enum ('admin', 'moderator');
-create type public.user_status as enum ('ONLINE', 'OFFLINE');
-
--- USERS
-create table public.users (
- id uuid not null primary key, -- UUID from auth.users
- username text,
- status user_status default 'OFFLINE'::public.user_status
-);
-comment on table public.users is 'Profile data for each user.';
-comment on column public.users.id is 'References the internal Supabase Auth user.';
-
--- CHANNELS
-create table public.channels (
- id bigint generated by default as identity primary key,
- inserted_at timestamp with time zone default timezone('utc'::text, now()) not null,
- slug text not null unique,
- created_by uuid references public.users not null
-);
-comment on table public.channels is 'Topics and groups.';
-
--- MESSAGES
-create table public.messages (
- id bigint generated by default as identity primary key,
- inserted_at timestamp with time zone default timezone('utc'::text, now()) not null,
- message text,
- user_id uuid references public.users not null,
- channel_id bigint references public.channels on delete cascade not null
-);
-comment on table public.messages is 'Individual messages sent by each user.';
-
--- USER ROLES
-create table public.user_roles (
- id bigint generated by default as identity primary key,
- user_id uuid references public.users on delete cascade not null,
- role app_role not null,
- unique (user_id, role)
-);
-comment on table public.user_roles is 'Application roles for each user.';
-
--- ROLE PERMISSIONS
-create table public.role_permissions (
- id bigint generated by default as identity primary key,
- role app_role not null,
- permission app_permission not null,
- unique (role, permission)
-);
-comment on table public.role_permissions is 'Application permissions for each role.';
-
--- authorize with role-based access control (RBAC)
-create function public.authorize(
- requested_permission app_permission,
- user_id uuid
-)
-returns boolean as $$
-declare
- bind_permissions int;
-begin
- select count(*)
- from public.role_permissions
- inner join public.user_roles on role_permissions.role = user_roles.role
- where role_permissions.permission = authorize.requested_permission
- and user_roles.user_id = authorize.user_id
- into bind_permissions;
-
- return bind_permissions > 0;
-end;
-$$ language plpgsql security definer;
-
--- Secure the tables
-alter table public.users enable row level security;
-alter table public.channels enable row level security;
-alter table public.messages enable row level security;
-alter table public.user_roles enable row level security;
-alter table public.role_permissions enable row level security;
-create policy "Allow logged-in read access" on public.users for select using ( auth.role() = 'authenticated' );
-create policy "Allow individual insert access" on public.users for insert with check ( auth.uid() = id );
-create policy "Allow individual update access" on public.users for update using ( auth.uid() = id );
-create policy "Allow logged-in read access" on public.channels for select using ( auth.role() = 'authenticated' );
-create policy "Allow individual insert access" on public.channels for insert with check ( auth.uid() = created_by );
-create policy "Allow individual delete access" on public.channels for delete using ( auth.uid() = created_by );
-create policy "Allow authorized delete access" on public.channels for delete using ( authorize('channels.delete', auth.uid()) );
-create policy "Allow logged-in read access" on public.messages for select using ( auth.role() = 'authenticated' );
-create policy "Allow individual insert access" on public.messages for insert with check ( auth.uid() = user_id );
-create policy "Allow individual update access" on public.messages for update using ( auth.uid() = user_id );
-create policy "Allow individual delete access" on public.messages for delete using ( auth.uid() = user_id );
-create policy "Allow authorized delete access" on public.messages for delete using ( authorize('messages.delete', auth.uid()) );
-create policy "Allow individual read access" on public.user_roles for select using ( auth.uid() = user_id );
-
--- Send "previous data" on change
-alter table public.users replica identity full;
-alter table public.channels replica identity full;
-alter table public.messages replica identity full;
-
--- inserts a row into public.users and assigns roles
-create function public.handle_new_user()
-returns trigger as $$
-declare is_admin boolean;
-begin
- insert into public.users (id, username)
- values (new.id, new.email);
-
- select count(*) = 1 from auth.users into is_admin;
-
- if position('+supaadmin@' in new.email) > 0 then
- insert into public.user_roles (user_id, role) values (new.id, 'admin');
- elsif position('+supamod@' in new.email) > 0 then
- insert into public.user_roles (user_id, role) values (new.id, 'moderator');
- end if;
-
- return new;
-end;
-$$ language plpgsql security definer;
-
--- trigger the function every time a user is created
-create trigger on_auth_user_created
- after insert on auth.users
- for each row execute procedure public.handle_new_user();
-
-/**
- * REALTIME SUBSCRIPTIONS
- * Only allow realtime listening on public tables.
- */
-
-begin;
- -- remove the realtime publication
- drop publication if exists supabase_realtime;
-
- -- re-create the publication but don't enable it for any tables
- create publication supabase_realtime;
-commit;
-
--- add tables to the publication
-alter publication supabase_realtime add table public.channels;
-alter publication supabase_realtime add table public.messages;
-alter publication supabase_realtime add table public.users;
-
--- DUMMY DATA
-insert into public.users (id, username)
-values
- ('8d0fd2b3-9ca7-4d9e-a95f-9e13dded323e', 'supabot');
-
-insert into public.channels (slug, created_by)
-values
- ('public', '8d0fd2b3-9ca7-4d9e-a95f-9e13dded323e'),
- ('random', '8d0fd2b3-9ca7-4d9e-a95f-9e13dded323e');
-
-insert into public.messages (message, channel_id, user_id)
-values
- ('Hello World 👋', 1, '8d0fd2b3-9ca7-4d9e-a95f-9e13dded323e'),
- ('Perfection is attained, not when there is nothing more to add, but when there is nothing left to take away.', 2, '8d0fd2b3-9ca7-4d9e-a95f-9e13dded323e');
-
-insert into public.role_permissions (role, permission)
-values
- ('admin', 'channels.delete'),
- ('admin', 'messages.delete'),
- ('moderator', 'messages.delete');
-```
+- For the full schema refer to [full-schema.sql](./full-schema.sql).
+- For documentation on Role-based Access Control, refer to the [docs](https://supabase.com/docs/guides/auth/custom-claims-and-role-based-access-control-rbac).
## Authors
diff --git a/examples/slack-clone/nextjs-slack-clone/components/Layout.js b/examples/slack-clone/nextjs-slack-clone/components/Layout.js
index a592e0d83be..46da4ce13dc 100644
--- a/examples/slack-clone/nextjs-slack-clone/components/Layout.js
+++ b/examples/slack-clone/nextjs-slack-clone/components/Layout.js
@@ -5,7 +5,7 @@ import { addChannel, deleteChannel } from '~/lib/Store'
import TrashIcon from '~/components/TrashIcon'
export default function Layout(props) {
- const { signOut, user, userRoles } = useContext(UserContext)
+ const { signOut, user } = useContext(UserContext)
const slugify = (text) => {
return text
@@ -60,7 +60,6 @@ export default function Layout(props) {
key={x.id}
isActiveChannel={x.id === props.activeChannelId}
user={user}
- userRoles={userRoles}
/>
))}
@@ -73,13 +72,13 @@ export default function Layout(props) {
)
}
-const SidebarItem = ({ channel, isActiveChannel, user, userRoles }) => (
+const SidebarItem = ({ channel, isActiveChannel, user }) => (
<>