RLS with one-to-one relationship always filters both tables

[willayd]

I have a model with a one-to-one relationship between two tables, one which is a bridge table and another table which has sensitive information. Let's call these tables Bridge and Sensitive_Info respectively.

There is a one-to-one relationship between the two. When I apply RLS to Sensitive_Info, it appears that this filters the Bridge table as well. Note that "Apply security filter in both directions" is NOT checked though the Cross filter direction is both (only option for one-to-one cardinality).

Is this a bug that the RLS filters both tables without any other option? Or is there some other way to ensure that the RLS only gets applied to the Sensitive_Info table but not the Bridge table?

[Icey]

Hi @willayd ,

Does my reply make sense? 

If it does, please consider Accept it as the solution to help the other members find it more quickly.

If not, please let me know.

Best Regards,

Icey

[willayd]

Unfortunately not. If I understand correctly you are asking me to do what I called out in the first comment, but that is hacking the cardinality rather than solving the issue

[Icey]

Hi @willayd ,

For One - to - One relationship, the only direction is Both. This means the two tables can be regarded as one table. So, RLS will be applied on Bridge table, too.

If you change the relationship to Many ('Sensitive_Info') - to - One ('Bridge'). The single direction will from Bridge to Sensitive_Info. Bridge table's fields could filter Sensitive_Info table. The opposite is not possible. So, RLS will not be applied on Bridge table.

Best Regards,

Icey

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[willayd]

Note that I can "work around" this issue by manually forcing the relationship between Bridge and Sensitive_Info to be one-to-many. This isn't technically correct though so I'm wary of what side impacts that may have and how well it will be maintained in the future