7 lines
392 B
SQL
7 lines
392 B
SQL
-- Tighten capa_update_owner RLS policy: remove department clause so only the
|
|
-- assigned owner can UPDATE their own CAPA row directly. Route-level auth
|
|
-- enforces field-level restrictions; this ensures DB-level enforcement matches.
|
|
DROP POLICY IF EXISTS "capa_update_owner" ON capa_actions;
|
|
CREATE POLICY "capa_update_owner" ON capa_actions FOR UPDATE
|
|
USING (owner_user_id = auth.uid());
|