RLS Policies That Actually Work

export default defineTable(todos, {
  firewall: { organization: {}  },
  guards: {
    createable: ["title", "content"],
    updatable: ["title", "content"],
    protected: { status: ["complete"] },
  },
  crud: {
    list:   { access: { roles: ["member", "admin"] } },
    create: { access: { roles: ["member", "admin"] } },
    update: { access: { roles: ["member", "admin"] } },
    delete: { access: { roles: ["admin"] } },
  },
});

-- Generated by Quickback Compiler

-- Firewall: org isolation
CREATE POLICY "todos_org_isolation" ON "todos"
  FOR ALL USING (
    organization_id = auth.jwt() ->> 'org_id'
  );

-- Access: list + select
CREATE POLICY "todos_select" ON "todos"
  FOR SELECT USING (
    auth.jwt() ->> 'role' IN ('member', 'admin')
  );

-- Access + Guards: insert (title, content only)
CREATE POLICY "todos_insert" ON "todos"
  FOR INSERT WITH CHECK (
    auth.jwt() ->> 'role' IN ('member', 'admin')
  );

-- Access + Guards: update (title, content only)
CREATE POLICY "todos_update" ON "todos"
  FOR UPDATE USING (
    auth.jwt() ->> 'role' IN ('member', 'admin')
  );

-- Guards: restrict writable columns
CREATE FUNCTION todos_guard_columns()
  RETURNS TRIGGER AS $$
BEGIN
  IF TG_OP = 'INSERT' THEN
    -- createable: title, content
    NEW.status := NULL;
  ELSIF TG_OP = 'UPDATE' THEN
    -- updatable: title, content
    -- protected: status (action-only)
    NEW.status := OLD.status;
  END IF;
  RETURN NEW;
END; $$ LANGUAGE plpgsql;

-- Access: delete (admin only)
CREATE POLICY "todos_delete" ON "todos"
  FOR DELETE USING (
    auth.jwt() ->> 'role' = 'admin'
  );