Rules on tables

A table has five actions, each with its own rule (Database access shows the Studio screen). This page is about writing the rules, and exactly what each action can read.

​

What each action sees

$auth, $credential, $request, $env and $now are available everywhere.

​

create: constrain what may be written

Rules on $input let the server enforce business constraints the client can’t skip.

• All of these rules pass:
  • Is signed in: yes
  • Compare values: $input.status is one of draft, submitted
  • Compare values: $input.quantity is at most 10

Because the table’s owner field is filled on create, you rarely need $input.owner_id equals$auth.user_id. Add it if you also allow servers or admins to set an owner, but want normal users to be unable to forge one.

​

update: old and new together

• All of these rules pass:
  • Owns the record (field) owner_id
  • Compare values: $record.locked equals no
  • Compare values: $input.owner_id does not equal null

Read this as: the owner, while the record isn’t locked, who isn’t trying to blank the owner. To stop someone changing a column at all, mark it read only (Columns); it is stricter than a rule.

​

delete: be conservative

Deleting is permanent. Common tightening: Choose All of: Record owner; Signed in with 2FA in the rule picker. or no delete at all plus a soft delete.

​

list and get should agree

If get is looser than list, people can read records they can’t list (by guessing ids); if list is looser than get, they see rows they can’t open. Use the same rule for both unless you have a reason. The Studio quick sets do this.

​

Designs

​

Rules and relations

An expand reads the related table under its own rules. Don’t rely on one table’s rule to protect another’s data; set rules on both.

​

Writes and side effects

Rules run before the write. A passing rule doesn’t mean the write will succeed: validation, unique constraints and database errors can still refuse it (ValidationError, ConflictError).

​

Test it

For every rule: allowed user, forbidden user, signed-out visitor, and the odd cases (missing owner, null org). See Testing.