‫So right now everyone could still fetch
‫and mutate data from our API
‫even if they cannot log into the applications UI
‫that we have been building.
‫And so let's now fix that
‫by implementing authorization also on Supabase itself
‫by updating all our row level security policies.
‫So again, right now, any malicious actor
‫could very easily find out the URL to our API
‫even if they cannot see this graphical user interface.
‫So just from reading our front end code,
‫they could figure that out and then they could,
‫for example, delete all of our bookings,
‫or all of our cabins, and really destroy our entire app.
‫And so of course we don't want that,
‫and therefore we need to now update
‫the role level security policies.
‫But first, let me actually show you an action
‫how that could be possible.
‫So let's log out here, now.
‫And so on this page, we are, of course, no longer logged in.
‫So let's now come here to the login page.
‫And then here we can still include,
‫for example, the cabin table.
‫So this component which will read
‫all the cabins from our API,
‫and that should work just fine.
‫So let's wait for the data to arrive.
‫And indeed, here it is.
‫So even without being logged into the application,
‫we can still see this cabin data,
‫and we could even edit or delete them.
‫And so this, of course, doesn't make any sense at all.
‫So we need to protect this
‫and also enable authorization right on the server side.
‫But luckily for us, that's not very difficult.
‫So we just need to come back here to our policies
‫and then update all of them
‫to only apply to authenticated users.
‫So let's click here on Edit.
‫And then here, we don't have to change anything.
‫All we need to do is to set the target role
‫to authenticate it, and that's it.
‫So we could also change here the name
‫but there's no need to do that,
‫that just takes too much time.
‫So, we have to do all of this for all of them now.
‫So, that's gonna be a bit boring.
‫So, I will just fast forward the video
‫right after doing this one.
‫Okay, so you can pause the video now,
‫and do all of this on your own now.
‫Okay, and there we go.
‫So, all of them are only now for authenticated users.
‫And of course if you were building
‫some other kind of application, then for example,
‫the select part here might be available for all users
‫but then inserting or deleting or updating
‫might only be for authenticated users.
‫So you don't always have to choose exactly these roles here,
‫but for this application, this is what makes sense.
‫All right, and if we now come back here,
‫then it actually says no cabins could be found.
‫So, if we reload that manually
‫then indeed we get the same result
‫because again at this place here,
‫we are not authenticated.
‫And so we are then no longer allowed
‫to see this data right here.
‫So, let's remove that, log in,
‫and so the rest should, of course, still work.
‫And indeed, here we have our bookings and cabins.
‫And so that works
‫because here we are, of course, authenticated.
‫Great, and so with this
‫we also protected our data right in our Supabase database.
‫And with this, we are almost finished
‫with this whole authentication part.
‫The only thing that we want to do next
‫is to also allow each user to update their password,
‫maybe even their name, and also to upload an avatar.
‫And so let's do that over the next few lectures
‫in order to really wrap up this part.