git.example.com/danawhitfield/lesson-planner ↗
Teachers create courses with lessons and share them with colleagues. Windsurf generated the schema: courses, lessons, shares. I'm worried about how sharing is modeled and whether RLS covers the shared case.
The model is fine. The RLS is not: lessons only checks owner_id, so a colleague you shared with cannot read them. You need a policy that joins through shares:
create policy "shared read" on lessons for select using (
exists (select 1 from shares s where s.course_id = lessons.course_id and s.user_id = auth.uid()));And index shares (user_id, course_id) or that policy gets slow.
Mira covered reading. Look at who can write to shares too. In your migration the insert policy is with check (auth.uid() is not null), so any signed-in teacher can insert a row sharing any course with themselves, and the shared-read policy then happily lets them read it.
Only the course owner should be able to share it:
create policy "owner shares" on shares for insert with check (
exists (select 1 from courses c where c.id = shares.course_id and c.owner_id = auth.uid()));Sharing tables are the side door around read policies. Check the write side every time you add one.