The realtime backend for agent-native apps

RLS is dead. Database-only rules get complex fast. Substrate controls access across every feature and client.

import { definePermissions } from "@substratedb/permissions";

export default definePermissions((p) => {
  const owns = p.fn("owns", (ownerId) =>
    p.user.signedIn().and(ownerId.eq(p.user.id)),
  );

  const isProjectMember = p.fn("isProjectMember", (projectId) =>
    p.user.signedIn().and(
      p.db.query.projectMembers
        .where((member) =>
          member.project.eq(projectId).and(member.userId.eq(p.user.id)),
        )
        .exists(),
    ),
  );

  return p.define(
    p.table("tasks").allow({
      create: ({ value }) => owns(value.ownerId),
      read: ({ row }) => owns(row.ownerId),
      update: ({ row, value }) => owns(row.ownerId).and(owns(value.ownerId)),
      delete: ({ row }) => owns(row.ownerId),
    }),
    p.objectStore("taskAttachments").path("task").allow({
      read: ({ params }) => isProjectMember(params.projectId),
      upload: ({ params }) => isProjectMember(params.projectId),
      delete: ({ params }) => isProjectMember(params.projectId),
    }),
  );
});