Multi Tenant Architecture - PostgreSQL Row Level Security (RLS) Questions

[Apple]

Unfortunately, Wappler has a non-ideal permission system and your concerns are totally valid.

There’s really no easy way to make the security “forgot-proof”. I don’t know about RLS, JonL will probably comment soon

You can see my past concern here in this topic:

Do we really need to Server Restrict every single Server Action we want to protect?

Do we really need to apply server restrict to each server action we want to protect? e.g.: /admin/user/delete Wouldn’t it be better to just apply the server restrict to a group of routes? e.g. /admin Am I missing something? It feels like Wappler didn’t nail this right yet. In other frameworks we have middlewares, so we can apply common logic to a group of routes instead of manually going to every possible page/server action we want to protect Manually protecting every single Server Action is …

In my own projects I’m using Global steps to perform the check at each URL, but I wouldn’t consider it to be the “ideal” solution either (mistakes can still happen)