Supabase
Replies: 11 comments 6 replies
-
|
The assistant is not very tuned and somewhat random in approach to RLS including one bad policy for a simple task. "allow only authenticated users to select"
"allow select only to authenticated users"
"allow only authorized users to select" This is similar query with a different answer that will run successfully, but would be very bad for security if the user does not know the TO field to spot the error. I guess it could be argued that because I used authorized instead of authenticated any user with an api key is authorized. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks Gary — great feedback. Out of curiosity — under AI Settings there, are you opted in or out here? 
|
Beta Was this translation helpful? Give feedback.
-
|
I thought it was on from the SQL AI, but it was off. Not sure if it got reset with new stuff, or at some point I turned it off after testing the SQL AI. That should fix the odd table it came up with. Might want to have some indicator about that (or maybe I should read instructions....) |
Beta Was this translation helpful? Give feedback.
-
|
Ha. Seems to like this bad method... |
Beta Was this translation helpful? Give feedback.
-
|
Actually seems to do better if you use authenticated now. So I guess it did not know the postgres roles either. It got the TO correct on tests with the exact role name. So you really should have that setting on, or it is pretty useless on RLS. Edit: Or not. Seems random, but did the TO at least once.
|
Beta Was this translation helpful? Give feedback.
-
|
A couple of users saying their schema is too large: Similar to this one: |
Beta Was this translation helpful? Give feedback.
-
|
I didn't try it very long, I just found it less usable than the existing solution. I would like it more if the AI assistant suggested the rules within the existing editor, so that the table name is already defined. Becuase then I had to ask 'for X table, create an rls policy for...' which is cumbersome for long table names. I've only ever made RLS policies through your editor so I'm not sure how much boilerplate you add to the query, and I like that I don't have to worry about that |
Beta Was this translation helpful? Give feedback.
-
|
Great feedback, thanks @hamishjohnson |
Beta Was this translation helpful? Give feedback.
-
|
Yeah, second this. I really want some AI to help as I also have little RLS experiences (and SQL writing for that matter). Even simple stuff like changing ALL SELECT DELETE w/o needing to delete and re-add a query. (Or writing the correct query to make that change yourself). Related feature request. I find myself pasting in RLS policies into an LLM and asking for anything im missing, any loopholes, vulternabilities etc. Could be nice to have some AI "'checking"" of policies. I understand its tricky to know peoples policy goals/needs though. Thanks |
Beta Was this translation helpful? Give feedback.
-
|
basic things like asking for how to add RLS based on an authenticated users' phone number doesn't work. |
Beta Was this translation helpful? Give feedback.
-
|
Just had a look at this.
I would much rather something which could auto copy and paste from one table to another (not even duplicating a table does this). Seems it is still faster to copy from one table (manually) and add to the next. Perhaps it would be better either so we can set our own defaults (with a variable column which is for the current table we are adding rls to) or that we can 'copy' from another and use the same format (and auto replace the table name with the new one and provide it for review). |
Beta Was this translation helpful? Give feedback.
-
|
everything I generated with it was invalid SQL |
Beta Was this translation helpful? Give feedback.
-
|
Most of the time I try to generate or update an existing policy with the AI assistant it does not work, always have errors. Trying to make the assistant handling the errors but does not work either. Had to go back to the new old way: chatgpt |
Beta Was this translation helpful? Give feedback.
-
|
5 out of 5 times did not work |
Beta Was this translation helpful? Give feedback.
-
|
Closing this in favour of a new iteration: https://github.com/orgs/supabase/discussions/19594 |
Beta Was this translation helpful? Give feedback.
-
|
I have enable this feature but want to roll back. How to disable it? |
Beta Was this translation helpful? Give feedback.
-
|
I’m sorry but the AI feature in supabase is totally useless. I think it would be better if you removed it than just have it there for the sake of jumping on the bandwagon! Very disappointing compared to some databade AI tools out there. |
Beta Was this translation helpful? Give feedback.
-
Please see updated discussion for v2 feedback:
https://github.com/orgs/supabase/discussions/19594
You've been asking for a better way to create RLS policies for a while now. During LWX in December 2023, we're happy to release Supabase Assistant. This tool brings the text-to-sql feature inside the SQL Editor to the RLS editor. We think AI can really help speed up the process of creating security policies. We'd love to know what you think.
What do you like most about it? Least?
How are the AI responses?
Are there any kinds of prompts that the Assistant struggles with?
Anything you think could be improved?
Anything you think is missing?
Beta Was this translation helpful? Give feedback.
All reactions