forked from wangziqi/gongxue-base
23 lines
775 B
PL/PgSQL
23 lines
775 B
PL/PgSQL
-- Backend platform-admin flows only need to validate a supplied Auth UUID. Do
|
|
-- not grant the API role direct access to auth.users or its profile metadata.
|
|
create or replace function app.auth_user_exists(target_user_id uuid)
|
|
returns boolean
|
|
language sql
|
|
stable
|
|
security definer
|
|
set search_path = ''
|
|
as $$
|
|
select exists (
|
|
select 1
|
|
from auth.users auth_user
|
|
where auth_user.id = target_user_id
|
|
)
|
|
$$;
|
|
|
|
revoke all on function app.auth_user_exists(uuid)
|
|
from public, anon, authenticated, service_role, tiku_api, tiku_worker;
|
|
grant execute on function app.auth_user_exists(uuid) to tiku_api;
|
|
|
|
comment on function app.auth_user_exists(uuid) is
|
|
'Minimal Auth boundary for the trusted API role; returns existence only and exposes no auth.users profile fields.';
|