How do I enforce row-level security with user UUIDs in Supabase embeddings for an iOS app?

To enforce RLS by associating rows with a specific user, you need to ensure that the user id is inserted into the table along with the other document data. The Supabase Vector Store node only exposes the content (or data) and metadata fields, which means you cannot directly map an additional column (such as your uuid column) when inserting data.

Here are a couple of approaches you can consider:

1. Use the Postgres Node for Full Control

If you require precise control over which columns get inserted—including your new uuid (user id) column—you can use the Postgres node rather than the Supabase Vector Store node. The Postgres node lets you:

• Map each column manually so you can include the content, metadata, and the user id.
• Use an INSERT query where you bind values explicitly, for example:

SQLCopied
INSERT INTO documents (content, metadata, user_id)
VALUES ($1, $2, $3);

Then in the Query Parameters field, pass your document content, metadata, and the authenticated user's id.

2. Pass the User Id Within Metadata (if applicable)

If you prefer to keep using the Supabase Vector Store node and if your RLS and retrieval logic can be adapted, you might store the user id as part of the metadata object. For example, before passing data to the node, use a Set node to add a property to metadata:

JSONCopied
{
  "content": "your document content",
  "metadata": {
      "source": "ios-app",
      "user_id": "the-authenticated-user-uuid"
  }
}

Then your RLS policy can be modified to extract the user id from the metadata (if that makes sense for your security model), or you could later run a transformation or trigger that separates this metadata value into its own column in the database.

Recommended Approach

For strict enforcement of RLS where the user id is in its own column (which is best for security and clarity), the first approach using the Postgres node is recommended. This gives you the flexibility to control the insert query and make sure that the document row includes the correct user id. You can always retrieve or update rows later using similar custom SQL queries to ensure that users only see their own data.

Using the Postgres node also leverages query parameters and expression syntax in n8n securely, preventing SQL injection while fulfilling the requirement for column-level control.

By choosing one of these strategies, you can ensure that your documents table correctly stores the user id for RLS policies and that your users only access the data they have submitted.