admin/info-share-spot
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Terminal

Browse Source
This commit is contained in:
admin
2026-08-07 20:47:23 +00:00
parent e64789d705
commit 9442d03f63
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
supabase/migrations/20260807002000_reporting_view_fixes.sql
+4 -2
View File
@@ -27,10 +27,12 @@ LANGUAGE sql STABLE SECURITY DEFINER SET search_path = public AS $$
WHERE s.id = _student WHERE s.id = _student
-- SECURITY DEFINER bypasses the students policy, so the entitlement is -- SECURITY DEFINER bypasses the students policy, so the entitlement is
-- re-checked here. Without this an authenticated caller could resolve any -- re-checked here. Without this an authenticated caller could resolve any
-- student's name by guessing uuids. -- student's name by guessing uuids. The service_role arm keeps server-side
-- rendering working, since it holds no app role and would otherwise get NULL.
AND (public.can_access_student(_student) AND (public.can_access_student(_student)
OR public.is_billing_admin() OR public.is_billing_admin()
OR public.is_auditor()); OR public.is_auditor()
OR pg_has_role(current_user, 'service_role', 'MEMBER'));
$$; $$;
GRANT EXECUTE ON FUNCTION public.student_display_name(UUID) TO authenticated; GRANT EXECUTE ON FUNCTION public.student_display_name(UUID) TO authenticated;