Build a Multi-Tenant #Supabase Project + #FlutterFlow Role based app

0:00hey everybody welcome to another video

0:02on my channel and this one we're talking

0:03about building a multi-tenant

0:05application with ins side superbase now

0:07primarily I'm going to focus most of the

0:09attention of this particular video in

0:11superbase itself and kind of how we kind

0:13of set things up and then of course

0:15we're then going to turn our attention

0:16then to flood oflow where I've kind of

0:18pre-built a little mini application

0:20which as always I provide free with this

0:22particular content for you to download

0:24explore and see and get it up and

0:25running really kind of walk through this

0:27particular sample so you can kind of see

0:28it all in action and then hopefully

0:31you'll be able to then take these skills

0:33and then start applying those to your

0:34own project so as always I try to make

0:36things as beginner friendly as I

0:38possibly can for the content I deliver

0:40in my channel so without further Ado as

0:42always across all of my content let's

0:44get

0:46[Music]

0:50cracking okay so before we get started

0:52in this particular tutorial let's talk a

0:55little bit about a multi-tenant

0:57application now if we bring out the

0:59classic to do type application we've all

1:01seen them out in the wild they're kind

1:03of just like a task based application

1:04you can kind of create tasks you can

1:06read you can update tasks and you can

1:08delete tasks themselves now what we're

1:11going to do in this particular video is

1:12we're going to kind of do something very

1:13similar we're going to have a very very

1:14similar application but the difference

1:16here of course is that our applications

1:18going to be slightly different in that

1:20the whole idea of it really is that um a

1:23a user belongs to a particular company

1:25so we're going to want to make sure that

1:26in our application that is we separate

1:29company data we really don't want to see

1:31any kind of cross pollution of company

1:33data so all of our users are going to

1:35kind of be associated with a particular

1:37company and of course all of the users

1:39are going to want to do all of the usual

1:41create read update and delete activities

1:44on their particular to-dos now the key

1:46thing of course here is that what we're

1:48also allowing us to do is we're going to

1:49put some role based Security in there as

1:51well so quite simple but we're going to

1:53kind of have a user who's just going to

1:54be a regular user that's their role and

1:56then you're going to have an

1:58administrator and administrator is going

2:00to have a kind of separate or at least a

2:03a different set of permissions which

2:04going to allow them to also update these

2:07particular task inside the application

2:10so pretty well much got on screen here

2:12which is describing kind of what a

2:13multi-tenant application in its most

2:15simplest form so okay so what does that

2:18mean then what are we going to cover

2:19then in this particular video so the key

2:21thing I want to point out is that we're

2:22going to focus our attention in the

2:24superbase world so we're going to kind

2:25of get up and running with our superbase

2:27project we're going to kind of get

2:29ourselves in a position where we then

2:30can start creating the tables of our

2:32application there's going to be three

2:33tables in this particular application so

2:35really really straightforward but of

2:37course tables and their data is not

2:39going to be enough we're going to want

2:40to implement some particular security

2:42policies now these are going to be

2:43really important to our application

2:45because our our actual to-dos our tasks

2:47that we're actually creating are going

2:49to kind of be um pretty well much behind

2:51roow level security and what that really

2:53means is that as soon as we enable that

2:55inside our application we cannot get out

2:57that data from the outside world it's

2:59not kind of publicly accessible now in

3:02order to make that data accessible we're

3:03going to have to apply particular

3:05policies on our data so we're going to

3:07create four different policies in this

3:09particular application that's going to

3:11handle both the reading and the creating

3:12the updating and the deleting of that

3:15particular data so that's going to allow

3:18us at the server level to be able to

3:20control and kind of secure our data now

3:23there's different ways and different

3:24loads of different permutations of

3:26creating policies with inside super base

3:28of course there's going to be different

3:29and other ways to do this but we're

3:31going to kind of do this in a more simp

3:33simplistic form and hopefully you're

3:34going to be able to take that knowledge

3:35and of course build on that in your

3:37particular use case now of course once

3:39you've got the policies in place we're

3:40going to want to kind of demonstrate

3:41we're going to kind of test these rules

3:43out and what I've got here is I've got a

3:45pre-built flood of flow application

3:46which I will walk you through all of the

3:49elements of that particular flood of

3:50flow application so hopefully it should

3:52make all sense and then we'll test out

3:55and we'll show these policies in action

3:57and like I said the main thing is is

3:59that our d dat is kind of safe on the

4:01server and the policies are enforc on

4:03the server and our flerl application

4:05will do a little bit of checking for

4:07kind of visibility it will kind of store

4:09like a role in there so we know it's an

4:10administrator or user and that will

4:12control some visibility elements with

4:14inside our flood oflow application but

4:16the safest uh point to make is that our

4:18data is certainly still protected uh on

4:21the circuit on the actual uh database

4:23itself so of course we can make sure

4:25that um anybody who tries to circumvent

4:28if they're not using uh like a mobile

4:30application or they're trying to do that

4:31in the web browser then there'll be

4:33enough there on the server side there to

4:35stop users from kind of getting at that

4:37particular data so that is pretty well

4:40much it a nutshell let's now get into

4:42the main part of the

4:44video okay so the first thing that I'm

4:46going to do is set up a free superbase

4:49project so just hit new project within

4:50superbase here I'm going to choose my

4:52organization organization is training

4:54because this is where I kind of put all

4:55of my free accounts here I'm just going

4:58to call this one to do here I'm going to

5:00generate a password and I'm going to set

5:02the location to be West Europe which is

5:05where I am situated so you want to try

5:07and choose a region Which is closest to

5:09yourself hit create new project so we're

5:12going to let that do its thing we're

5:13going to get it to set up the project

5:15for us once it's kind of done everything

5:16for us here then we need to set up some

5:18other details in the project so we're

5:20going to set up some user accounts

5:21because we're going to need a variety of

5:23different user accounts to kind of be

5:26Associated to the table data that we're

5:28going to have and there's also a little

5:30configuration items as well when you set

5:31up a brand new project within super base

5:33and we'll come back and do that very

5:34shortly okay so next up let's head over

5:37to the authentication settings here on

5:39the left hand side just choose that and

5:41then what I'm going to do I'm going to

5:42go down to providers First now the first

5:44thing I'm going to do is just come into

5:46here and I'm just going to turn off

5:47these two toggles here just so it

5:49doesn't give us any trouble at all in

5:50terms of registering brand new users you

5:52might want to for example allow users in

5:55your uh front end application to kind of

5:58uh to create an account we you obviously

5:59want don't want to send any kind of

6:00confirmation emails or anything like

6:02that so keep it nice and straightforward

6:04hit save now what I'm also going to do

6:07is I'm going to move over to users and

6:08this is where I'm going to create now

6:10three user accounts now the first user

6:13account is going to have a specific role

6:15of just as a general user the second

6:17account that I'm going to create is

6:18going to be an administrator and then

6:20the third account is going to be a user

6:22again but I'm going to associate that

6:23with a different organization with

6:26inside my project just so we can then

6:28see the difference with data kind of

6:30loading and make sure we kind of got all

6:31of our kind of policies in place that

6:34prevents kind of data being displayed to

6:36the wrong organization so let's first

6:38create those here I'm going to go add

6:40user I'm going to create a brand new

6:41user here and I'm just going to Simply

6:43in here put a couple of digital Pro

6:45accounts in here and I'm just going to

6:46go ahead and do that just with um an

6:48email address and a password and then

6:50I'll show you those on

6:57screen okay so there we go then I've got

6:59all of my three accounts you can see I

7:01got digital Pro there with no number

7:02then I got a two and then I got a three

7:04so then we're going to be able to sign

7:05in now of these particular users just

7:07created kind of a a little dummy

7:08password the key thing to remember here

7:10though of course is I've got these kind

7:11of unique user IDs we're going to use

7:14those very very shortly we come back to

7:16our tables because we're going to create

7:17a users table in the public schema of

7:19our particular project that's going to

7:21kind of sit alongside all the other

7:23tables that we create and the key thing

7:24is is this user ID will be there as a

7:27key within that particular table itself

7:30so we can kind of Link the two up as we

7:32go throughout this particular set of

7:34videos okay so in our superbase project

7:36then we have no tables currently and we

7:38need to create three of them the first

7:39one that we're going to create is a

7:40company's table now that's going to have

7:43like a unique ID and it's going to have

7:44a simple name to represent a company now

7:47the good thing is that when we then

7:48create then users in our next table

7:51we're going to associate those

7:52particular users with a company now of

7:55course no to-do app is possible without

7:57to-dos themselves so we're going to have

7:59to to create a table to hold all of our

8:01to-dos and the key thing there is

8:03obviously we can have a title

8:04description and a Boolean indicator to

8:06demonstrate whether is completed or not

8:09but of course every to-do needs to be

8:10associated with a user the one who is

8:12creating it and also as well we need to

8:15associate that Todo with the company

8:17itself because we are obviously creating

8:19a multi-tenant application here we want

8:20to make sure that um the to-dos that are

8:23created by the users are completely

8:26separate in different companies we don't

8:27want them to kind of overlap so it's

8:29important that we associate the company

8:31ID as well so instead of creating these

8:34Tables by hand I've created a series of

8:37SQL scripts some SQL scripts that you

8:39can run with inside a superbase itself

8:42now if you are following along with

8:43inside the no code academy then I have

8:45an article which provides you with an

8:47easy copy and paste of all of those

8:49scripts and we're going to play those

8:51out very shortly but of course if you

8:53are following elsewhere then there'll be

8:54a link in the description where you'll

8:56be able to then download all of these

8:57particular scripts and then run them one

8:59by one okay so let me show you then

9:02these particular tables that we're going

9:03to create here so here is the SQL script

9:05now this is going to create the three

9:06tables let's have a look at the first

9:07one here you can see it's very

9:08straightforward it's going to create a

9:09table called companies it's going have

9:11an ID which is going to be its primary

9:12key and it's going to have a text field

9:14there just purely for the name then of

9:16course users is quite straightforward

9:18again we have a a uu ID which is kind of

9:21that long kind of list of numbers that I

9:22showed you when we created the users

9:24just a second ago that's going to be

9:26unique for the user that's going to get

9:27created we're going to kind of populate

9:29that value here of course it's going to

9:30have an email address the company ID is

9:32going to link to just up to this

9:34particular ID here and then of course we

9:36then got this role so of course every

9:38single user can either be a user or it

9:41can be an ad an admin user so by default

9:44when we create a brand new row in this

9:45particular table the user is going to be

9:48defined with a role of just user so

9:50again a very very simple table and here

9:52is our to-dos again just a a kind of a a

9:55primary key there for its ID a title

9:57description whether the to-do is

10:00completed or not again this is going to

10:02reference the company just at the top

10:04here and then of course it's going to

10:05also reference the user ID and we just

10:07got to create at Tim stamp as well so

10:10super super simple now these all need to

10:12be created in order now I'm just going

10:13to simply just hit the the run here and

10:16that's going to execute all of those

10:18particular commands here the sqls uh

10:20sort of scripts and then I'm going to

10:21find that all of my tables are now

10:23created if I just move over here you can

10:25see I've got my companies to-dos and my

10:27users all created so next up I'm just

10:29going to create some sample data for the

10:32companies themselves I could have gone

10:33into the tables and just added a new row

10:35but here is a quick SQL statement here

10:37that's just going to create that for me

10:38I'm going to create two rows in my table

10:40called company a and Company B if I just

10:42run that move back over to the tables

10:45here go to then the companies and I just

10:47going to hit a quick refresh here and

10:49there is my company a and my company B

10:51so that's all set up quite nicely for us

10:53again we've got no to-dos here and we've

10:54got no users in here so what I'm now

10:57going to do is um it's going to be

10:58important that we firstly now create um

11:01the users that we have in this

11:02particular set of tables and I'm going

11:05to show you how to do that now so I'm

11:06going to carry out the next step for

11:08three of the users I'm going to show you

11:09how to do it once and if you just do the

11:11same thing again we're going to start

11:12with the first account that I created

11:14which is the digital Pro with no number

11:16this is just going to be my user so here

11:18you can see here this is the uid that I

11:20need so I'm just going to kind of copy

11:23that there and I'm now just going to

11:24move back over to my table editor going

11:27to go to users and I'm going to insert a

11:29new record insert row now the ID at the

11:31top there I'm just going to paste that

11:33value in here now I just need to match

11:35up my email address the digital

11:38Pro the digal al.com company name let's

11:41St the record now this this user is

11:43going to be associated with company a

11:45like that and the role is just going to

11:47be a user so that's it I'm just going to

11:49hit save now what I need to do now is

11:52the next the digital Pro 2 account that

11:55I'm going to create here it's going to

11:56be a roll admin and then the next

11:58account that I'm going to use is going

12:01to be then associated with the company 2

12:04but it's just going to be a user itself

12:06I'm just going to go away and create

12:07those now we'll come back and we'll just

12:08have a double check to see how this

12:19looks there we go then all the users are

12:21created you can see here that I've got

12:23my my first two accounts which is

12:25associated with a company one and then

12:27the top one here is Associated a company

12:30to and you see I've just got an admin

12:31user here this is going to be important

12:33when we kind of demonstrate this in our

12:34front end application where we be able

12:37to log in as these particular users

12:39we're going to see different data sets

12:40we're going to be able to do different

12:41things as well and a good thing about

12:43this is all going to be then restricted

12:45and controlled within superbase itself

12:47because we're going to move on very very

12:48shortly to creating kind of the security

12:51policies that we need to kind to enforce

12:53the rules on the back endend so next up

12:56we need to enable row level security on

12:59our database tables we want to kind of

13:01tighten things up completely by default

13:03so by doing this it means that we can't

13:06get our data um for any purpose

13:09whatsoever until we start creating

13:11what's called policies that kind of open

13:13up under various conditions so we can

13:16set um Road level security in a number

13:18of different places you can do it at

13:19table level so here I've just got the

13:21to-do selected I could hit the RLS

13:24disabled button here that would then

13:25enable Ro level security or of course I

13:28could do it into the SQL edit here and

13:29I've got this simple SQL query here

13:32which will alter the table to-dos and

13:34enable roow level security now in this

13:36particular kind of video series we're

13:38just going to Simply do it on the to-dos

13:39table but of course you're going to want

13:41to really consider setting roow level

13:42security up on other tables as well so

13:45this one we can do the to-dos I'm just

13:46going to run this particular statement

13:49here and of course you're not going to

13:50see anything as a result come back you

13:51just going to have to then assume that

13:53it's all done but there's one little

13:54simple check you can just make here you

13:56go back to the table editor and you can

13:57see now the little padlock the kind of

13:59unlocked padlock that you see here is

14:01now disappeared so we know that that one

14:03is now tightened up so the next bit that

14:05we need to work on then of course is the

14:07actual policies themselves so I'm going

14:09to kind of load up the SQL editor here

14:11with kind of all the policies we're

14:12going to run and I'll kind of walk you

14:14through what they

14:15mean okay then so in superbase you can

14:18create policies in a number of different

14:20ways we're going to keep True to this

14:21particular series and continue to create

14:23them via SQL scripts but there is

14:25different ways in superbase you can do

14:26this so let's talk through each of the

14:29policies that we're going to we're going

14:31to put in place of Insider application

14:32now there's four policies that are

14:34applying here and they all apply to the

14:36to-do table okay now without these

14:39policies in place as I said before we

14:41won't be able to do anything with inside

14:42the data of our database so let's have a

14:45look at the first one allowing the

14:46viewing of to-dos now this um is quite

14:49simple you can see here that this

14:51particular policy is all related for the

14:53table of to-dos and it's for a select

14:56operations this is kind of reading back

14:58data and you can see here that I've got

15:00other ones here for insert of Records

15:02update of records and I've got one down

15:03here for delete so that's how we're

15:05differentiating between the policies so

15:08let's go back to the select then so what

15:10is this doing so we so each policy needs

15:12to return back either a true or a false

15:14okay if it's true then that operation is

15:16allowed if it's false and clearly it's

15:18not allowed so what we're really doing

15:20here is we're actually saying okay so do

15:23a look up inside our users table and you

15:26can see here I've got this ID equals or

15:28U ID so as an authenticated user who's

15:31making that request into superbase I'm

15:34going to carry a user ID okay so that is

15:36really really important that user ID

15:38needs to match the ID of the user of the

15:41table as you saw previously when I

15:43created a user we had that uu ID and of

15:47course that is going to match up to The

15:49UU ID that's going to be passed in

15:51during every single request so this is

15:53what I'm doing I'm saying right go into

15:55the users table match up the ID with the

15:58ID the user and return me back the

16:01actual Company ID now that Company ID is

16:03then going to be checked here for the

16:05actual Company ID itself with uh with

16:08inside the actual to-dos table so of

16:11course this is going to then make sure

16:13that I return back all of the records

16:15that are matching that particular

16:18Company ID so hopefully I'll tried to

16:20explain that quite well so of course if

16:22um if you got an ID of one or a two then

16:25clearly there's going to be different

16:26IDs but the user can only be part of one

16:28particular company so this just ensures

16:30that I'm getting that that that result

16:32set back that matches the company ID

16:34that I'm allowed or at least associated

16:36with the records where my user ID is

16:38already Associated so that's that's

16:40important for the viewing the to-dos now

16:42moving on to the adding of to-dos this

16:44is exactly the same for an insert our

16:46users can create records our users can

16:49view records this is exactly the same

16:51exactly the same check that is doing

16:53here on the to-dos okay so next up then

16:55we've got the update policy um there's a

16:56little bit more going on here that I can

16:58explain okay so the first bit is really

17:01just saying as a user am I allowed to

17:03perform this particular uh sort of

17:05operation so here we've got the same

17:06thing again Company ID that is exactly

17:08the same and then we kind of got this

17:10and going on and it's kind of doing this

17:12or check now in our application our

17:14to-dos can be updated by the user

17:16themselves so kind of this is what we're

17:18kind of matching up here is that true or

17:20false and then we kind of got this all

17:23and this is where we are allowing the

17:25users if they are an admin to be able to

17:27also update the actual uh the actual

17:31data themselves okay so that allows us

17:34by by a role to allow them to update the

17:36particular to do so this is kind of what

17:38this check is actually doing here now

17:40this particular bit is a little bit more

17:42different because we need to put this

17:43with check in here because what we're

17:44really just trying to say here is that

17:47at the time that the data is actually uh

17:49being written does it still actually

17:52comply with the policy itself and again

17:54it's doing exactly the same check so

17:56it's kind of like a a little double

17:57check going on there for this now that

17:59is allowing us obviously to update data

18:02now moving on to the actual delete

18:04itself again very very similar we we

18:07want to allow the users to delete their

18:09particular to-dos but of course we also

18:11want to allow the administrators to also

18:13delete as well so that's right again

18:15we've got exactly the same setup here

18:17where we're just doing that kind of or

18:19check with inside this and here so

18:22hopefully that kind of makes sense now

18:23what I'm going to do is I'm just going

18:24to Simply Now execute all of these

18:27particular policies um this should be

18:28valid and I should just be able to run

18:30these straight away and they should all

18:31correctly be successful and run so if I

18:34now go back to then the table editor and

18:38I go back to like companies sorry to the

18:40to-dos itself I can then go up to then

18:43the or policies up here and you can see

18:46that those policies have now all been

18:47creative insert select delete and update

18:49and of course I could go in here of

18:51course I could edit this particular

18:52policy um I can also disable RLS um I

18:55can do all that kind of stuff or delete

18:56the policies themselves if I just look

18:58into this inside

18:59you can see here this is very similar to

19:01what you had seen previously so

19:03hopefully that kind of makes sense um on

19:06terms of the policies being created they

19:09are now in place now which means that it

19:11pretty well much sets us up now to get

19:13into the front end side of our

19:14application and um I've created a

19:16front-end example here in flood oflow

19:18which will then I'll be able to

19:20demonstrate these policies kind of in

19:22full operations so let's head over to

19:24flood oflow now and let me walk you

19:26through the flood oflow project that you

19:28can also clone as well and you can get

19:30yourself up and running in this

19:31particular example okay so my front end

19:34tool of choice is going to be flood

19:35oflow for this particular sample but of

19:38course the rules are running in the

19:40super base project of course so kind of

19:42any front end that you kind of put on

19:44this you should still see very very

19:46similar results so how do we get this

19:48project set up so the link is in the

19:49description please do go and clone this

19:51particular project but there's a little

19:53bit of kind of a plumbing that we need

19:54to do we need to kind of get this

19:55project set up to your particular

19:57superbase project cly if you are

19:59following along in this particular

20:01Series so what we need to do is we need

20:03to head over to then the little Cog here

20:04we need to move down to superbase

20:06integration just make sure that you got

20:08use super base V1 turned off now of

20:10course that is going to be deprecated uh

20:12maybe by the time you watch this

20:13particular video and it will probably be

20:15defaulting to V2 of superbase we need to

20:17get the API out and the anonymous key

20:19from our superbase project so let's just

20:21head over there now to super base let's

20:23move down here then to project settings

20:26and I'm just going to move down here in

20:27fact I'll go to then the API which is

20:30the best option here and then you can

20:31see I've got the project URL so just hit

20:33copy let's move back over to our project

20:36let's just paste that in here move back

20:38over to super base and we've got this

20:40Anonymous public key so we just need to

20:42grab that here the API key and we're

20:44just going to paste that in there just

20:47hit get schema hit yes so that's going

20:50of course means that all of your schema

20:51is going to come in here so you kind of

20:53got all of that now made available to

20:54your flood oflow project which you can

20:56of course apply that throughout the rest

20:58of your project so that's kind of like

21:00the super base setup part okay so I've

21:03pre-built this particular application so

21:05you can explore in your own time but let

21:07me walk you through how it works how it

21:10functions and the bits I need to make

21:11you aware of in order for this to work

21:14so it's a really really simple

21:15application there is nothing special

21:16going on it's not going to a win any

21:18awards in terms of design because what

21:20I'm trying to demonstrate here is I'm

21:22trying to demonstrate the use of

21:24bringing back the data adding new data

21:28and then also been able to delete and

21:30also update as well so just kind of got

21:32some a variety of different actions that

21:34actually perform those operations now

21:37the the key bits to point out of course

21:39is that I've got no ability here to

21:40create user accounts this is going to

21:42assume obviously that the users are

21:44already created and they are already

21:47Associated to a company with inside the

21:50actual database itself as you know

21:53previously we created those users and we

21:55associated associated them with a

21:57company so um if we look here I've just

21:59got a signin page um there's a little

22:01bit going on that's slightly different

22:02here because what we're doing is is

22:04we're kind of assigning the user in and

22:06then what we're doing is is we're then

22:08making an additional query into our

22:10superbase database to return back the

22:13user data that we want to associate and

22:16persist with inside application we're

22:17going to want to make sure that we keep

22:19hold of the role we can keep hold of the

22:21user ID if we wanted to um and perhaps

22:23an email address although I'm not

22:24particularly too worried here in the

22:26application I'm just displaying the

22:27email address um at the top of the page

22:30once you're actually logged in so let me

22:32show you how that bit works first so I

22:33just need to move over here then to then

22:36the data types bit because I'm just

22:37creating this kind of data type called

22:39user and I've just set up the company ID

22:41an email and the role itself now I've

22:43set that up the here very simple integer

22:46string string that's fine and what I've

22:48then done is I've then created then an

22:50appstate variable called user which is

22:53of that particular data type and now

22:54that's really straightforward just go to

22:56add appstate variable you can choose the

22:58data type of user that I've created and

23:00then that allows me then to set various

23:02Fields so I've created that and it's

23:04just called user now what I'm going to

23:05do is I'm going to log the user in and

23:08then I'm going to do that query as I

23:09said I did before quickly retrieve those

23:11values and persist those in the App

23:13State now of course because it's an

23:15Abate variable that's then going to be

23:17available throughout the whole of my

23:19application so what I'm going to now do

23:21go back over to the widget Tre let's

23:22have a look at this particular sign in

23:24action there's a couple of little

23:25differences here to perhaps how you

23:26might do this very simply in flood oflow

23:29if I open up the action flow editor

23:31let's have a look and see what's going

23:32on here so I've Got The Irregular off

23:34action here now the key thing with this

23:36off action is I've taken off this and

23:38navigate automatically because by

23:40keeping that to to on which is normally

23:42by default as soon as the user is logged

23:44in they'll be redirected back they're

23:46redirected to the homepage of the

23:48application so of course we want to we

23:50don't want to navigate automatically we

23:51want to do that additional kind of check

23:53so here I'm saying is the user logged in

23:56so again just again another little check

23:58check here we've got this Global

23:59property called is user logged in um

24:01typically if they've typed in the

24:02username and password and it's correct

24:04they'll head in this particular

24:05direction so here this is where I'm kind

24:08of doing that back that backend call

24:10into superbase into the users table that

24:13we created earlier and I'm trying to

24:14retrieve that particular value so here

24:16I'm going to go to filters my ID is

24:18going to be equal to then the user ID

24:21now this is going to be of the

24:22authenticated user if I just hit the

24:23little pen pen here you can see that

24:25I've got this very convenient kind of

24:27source here called uh authenticated user

24:30and I'm grabbing hold of the user ID so

24:31once we've got that user ID of course we

24:33can then be returning back all of those

24:35records throughout our application so

24:37that's really really important so what

24:39this is going to do is this is going to

24:41return this this action output variable

24:42called DB user so the result set is

24:45going to come back from the database I'm

24:46going to store that into a variable

24:47called DB user and then I can now use

24:49that um elsewhere in the next action and

24:52I'll show you that now if I just scroll

24:53up here we then got update App State and

24:56here I'm just doing the update fields of

24:57the user so again I'm just choosing the

24:59UP State variable user I've got my

25:01update field which is going to be update

25:03user and this is really where I'm just

25:05setting okay what is the company ID what

25:07is the email what is the role that's

25:09that that's the values that's come back

25:10from that DB user that you saw just up

25:12here and you do that by going to the

25:14values here and then what I'm saying is

25:16is if I just can show you here I've got

25:18the available options here I can say

25:20here's the DB user variable I'm getting

25:22the item at the index the first row that

25:25that has come back and here I'm just

25:26pulling out the super base row field you

25:28see other fields are available here but

25:30here I've just choose Company ID and hit

25:32confirm I'm doing the same thing for the

25:34email and I'm doing the same thing for

25:36the r I'm just persisting those values

25:38as come back and storing those in my app

25:40State variable and then of course once

25:42that's done I'm then just going to do

25:44the Navigator the homepage because here

25:46I'm down in the true path I know my user

25:49is authenticated I've persisted the

25:50values that I need in the App State

25:52variable and now I'm navigating to the

25:54homepage so that sets us up then quite

25:57nicely and then can then move on to the

25:59homepage okay so what exciting things

26:00have we got on the homepage then well

26:02you can see here that I've kind of got

26:04this to-do column this could be the list

26:05view but I just made it a column here

26:07now that is doing a database query so if

26:10I just move up here I can now see I've

26:12got this query into superbase and what

26:14I'm doing is I'm just ringing it really

26:16all I'm doing is I'm just bringing back

26:17all of the rows of the to-dos and I'm

26:19filtering just purely on whether they're

26:21completed or not so I'm saying complet

26:23it is not equal to true so of course my

26:26application is going to allow me to hit

26:27that little tick button there it's going

26:29to do an update in my database and it's

26:32going to mark that as true so then

26:34typically what would then happen is I'll

26:36do a refresh of the the actual database

26:38query itself and of course that will

26:40then be marked as true in the database

26:42and it will be hidden from site so that

26:44is kind of my update operation now that

26:47is just going to be carried out my by me

26:49just hitting on this little check here

26:50if I move up to then the actions open up

26:53that here you can see that I'm doing my

26:54back inkle I'm updating my rows and

26:56really all I'm doing is I'm saying right

26:58let's let match on the ID of the actual

27:01row itself so I can just go in here and

27:03I can say to-do's row ID hit confirm is

27:06that equal then to then the ID itself so

27:11that is that allows me to then uh filter

27:14on that particular row and then of

27:15course all I'm doing here is I'm then

27:16setting the completed to be true and

27:19then once I've done that of course that

27:20will then be persisted in the database

27:22and then of course I'm doing a refresher

27:23I'm reind of loading that query here by

27:26saying please do a refresh of the to-do

27:28column that's going to execute that

27:30backend query on that to-do column and

27:32then I'll see the latest update that

27:34comes back so that's what the action is

27:36is actually doing the delete is doing

27:38something very very similar open up the

27:40action flow editor here I'm just

27:42carrying out a super base query here to

27:44delete the row again I'm kind of doing

27:46the match here I'm making sure that me

27:48ID is equal to the the actual row that

27:50I've kind of got selected here and then

27:52the row is going to be deleted and of

27:54course I'm just going to refresh again

27:56that to-do column which going to execute

27:57that backend query again so that keeps

27:59all of this all nicely in check now in

28:02here of course I've got the title this

28:03is really just showing the title of the

28:05actual to-do here I can click on this

28:07here and you can see I'm saying get row

28:09field is the super base row of title and

28:12that's simply just display that as a

28:13text label on the

28:16UI so what am I doing down here I've got

28:18this add option here if I just select

28:20this again really really simple again

28:22it's just insert in a row and really all

28:24I'm doing is I'm just setting some

28:25Fields I'm saying right okay carry an

28:27insert row on my to-do table I'm going

28:29to set the title I've done a text

28:31combination here I've just said it's

28:32test and I've got this random number

28:34that's going to get created every time I

28:36add it's going to create a random number

28:38and that's all it's going to do that's

28:39going to set the title now the key this

28:41is the key bit that's really really

28:42important we also need to set the

28:44company ID and the user ID so this is

28:47quite important because what we're kind

28:49of saying here is that um when we create

28:52these brand new records um when we

28:54create that insert of course superbase

28:56doesn't know anything about who the

28:57company is or who the user ID is we need

28:59to set them ourselves so remember I did

29:01that query and set the App State

29:03variable that's going to hold the

29:04company ID this is exactly what I'm

29:06doing here is I'm popping into the

29:08appstate variable here you can see it's

29:10App State it's the user I'm getting a

29:13data structure filled and I'm pulling

29:14out the company ID because I know that's

29:16available to me so I'm going to save

29:17that with my

29:19record and then here is my user id where

29:22can the user ID come from it could come

29:24from the appstate variable I wanted to

29:26because I was kind of uh persisting that

29:28um but here I'm just going to put out

29:29the authenticated user again there's a

29:31nice convenient function here with

29:32inside uh flood oflow you can say

29:34authenticated user and you can say user

29:36ID that's all that I need to do so I can

29:38associate that with my record so that's

29:40really all I'm adding to my to-do now

29:42that's going to create my record it's

29:44going to insert it and then all I'm

29:45doing here doing exactly the same thing

29:46previously and doing a bit of a refresh

29:50hit close so that is going to add a

29:52random record here logout is just going

29:55to Simply allow me to just quickly fire

29:57one action here which is off log out and

29:59and out of the application I go so that

30:02is as simple as it comes in terms of

30:05doing the kind of the create read the

30:07update and delete

30:09operations there's only one more bit to

30:11show you and that is the conditional

30:14visibility now of course these

30:16particular sort of icons are being

30:18displayed depending on the user

30:21themselves so for example if I just hit

30:24on the say completed icon here if I move

30:26over here I've got this conditional

30:28visibility here so I just select that

30:30here and really I'm kind of saying that

30:32I only want to display the uh the check

30:37if the user role is equal admin so again

30:39as we said previously admins can kind of

30:42do updates or they can do deletes um in

30:45terms of our application so this is kind

30:47of allowing the the checkbox to be

30:49displayed or of course if the user ID is

30:52equal to the user ID so we just want to

30:54make sure that um all users have the

30:57ability to mark their their to-dos as

31:00complete so again I'm just making sure

31:02that I'm just really using kind of

31:03database values here or state based V

31:06values here to kind of control the

31:08visibility of certain things on the UI

31:10and that's exactly the same for this

31:13deletion icon as well the same rules

31:15apply here the same conditional

31:16visibility rules so the key takeaway

31:19from this point is that we are kind of

31:22when our user logs in we're kind of

31:24setting the role of that particular user

31:27we're saying he's this he or she is an

31:29admin user or they are just a general

31:32user and then the the the setting of

31:35that can then control the visibility of

31:37particular widgets throughout the user

31:39interface and that's something that you

31:41should get used to when you're building

31:42these type of applications in terms of

31:44controlling the kind of the visibility

31:46of certain widgets based on what they

31:48can and cannot do um so but this is just

31:50a really simple way to kind of

31:51demonstrate that and finally just really

31:53at the top here I'm just explain the

31:55email address of the user and of course

31:57the role of that particular user as well

31:59just so we can kind of preview that here

32:01so now that is um pretty much a nice

32:03little walkth through then what I'm

32:04going to do is I'm going to fire up this

32:06particular application and we can start

32:07to see some of this stuff come to life

32:09in terms of the rules that we've got set

32:11with inside a super base itself let's

32:13head over to the test mode now okay so

32:16up and running in test mode then um here

32:18is the first user account of company a

32:21so I'm just going to sign in here this

32:23is going to take me to the homepage you

32:24see here I've got my colomy email

32:26address up here and I've got a of user

32:28you can see I've got no records here at

32:30all so let's create our first record if

32:32I hit add I've got this random record

32:35that's now being created and you can if

32:37I just pop over there to superbase and I

32:39move over the to-dos you can kind of see

32:41I've got that created of course it's

32:42just false it's got It's a company of

32:44one there is my user ID and there's a

32:46time stamp that I've actually created it

32:48with the title so um it's all there

32:50created and of course I can come along

32:51and I can create another one and I'm

32:53just going to hit another one and I'm

32:54just creating all of those additional

32:56random rows and of course I can do

32:58everything that I'm allowed to do here

32:59is I can kind of like hit delete I can

33:02start deleting these out so um we're

33:05going to have to make an assumption at

33:06this particular point that my policies

33:07are kicking into place that I can

33:09actually uh I'm allowed to delete those

33:11particular records let's just add a few

33:13more random ones in here as well and of

33:16course I can mark one of them as

33:18completed so you can see here I'm just

33:20going to check this one here test 89 if

33:22I check that that's now going to

33:24disappear if I just move back over to my

33:25database let just hit a little re ref

33:27fresh here you can see now I've got the

33:29four records here test 89 is now set as

33:32completed is true so that is looking

33:35like um my policies are being applied

33:37and it's it's important to not because

33:39clearly I've got my road level security

33:42that is set so I must be getting through

33:44those particular policies which is a

33:46good start now I'm going to Now log in

33:48as the administrator and I'm I should

33:50then also be able to carry out these

33:52particular functions now if I just head

33:54back over here let's hit log out let's

33:57now login now as that particular user

34:00hit sign

34:01in okay so now I'm the admin there is

34:04the new email address you can see I go

34:06all those rows come back and of course

34:08as administrator I can now check to see

34:10if I can sort of do stuff let's hit

34:12delete that all goes let's just hit the

34:14little check here and I can also do that

34:16as well now if I just uh pop back over

34:18to super base let's just do a little

34:20refresh here and you can see now I've

34:22got those couple this Mars completed so

34:24it looks like that particular rule is

34:26actually working for me now of course

34:28this is a multi- application so as a

34:31different company um or at least a user

34:33that's associated of a different company

34:35we're going to kind of want to log into

34:36our application but we don't want to see

34:37this particular data so if I now head

34:40back here let's Now log out so if I now

34:42sign back in now as that admin as that

34:44another user you can see now I'm not

34:46getting any data coming back and of

34:48course I can add here I can add a few

34:50more in here Etc let's go back over to

34:53super base and let's hit a little

34:54refresh and you can see here I've got

34:56records now that are part of Company 2

34:59so you can clearly see now we' got kind

35:01of like a separation there of the

35:03company

35:05records now of course it can get a

35:07little bit more interesting as well so

35:08if I go back here now I'm going to just

35:11log back out here now um what I'm going

35:14to do is I'm just going to log now in is

35:16put an eight in there there we go so

35:19what I'm going to do now is um I'm just

35:20as this particular I'm in fact what I'm

35:22going to do is I'm just going to pop

35:24over here to super base here let's go

35:26back to the users now what I'm going to

35:28do is I'm going to Mark the digital Pro

35:302 here which is part of Still Company

35:32I'm just going to take this off of admin

35:34and I'm just going to Now set that as a

35:37user so let's now head back over here

35:41now I'm just going to carry on as the

35:43first user I'm just going to carry on

35:44creating a load of Records so this is

35:46kind of my own now if I log back out and

35:48if I now log back in now I'm Ling as

35:51user two now and you can now see that I

35:54can't do nothing with these particular

35:56records because there are still

35:57associated with my company because the

35:59rules of this application is that I can

36:01see all company data but of course there

36:03a different there a different selection

36:05of user data that I I can't I don't want

36:07I shouldn't be allowed to manipulate

36:08which is what this is now restricting me

36:11from from actually doing so if I hit add

36:14here you can see now I've got my own

36:15data that is now coming in so of course

36:17I can do everything I was allowed to do

36:19on my own data but of course I can't

36:20manipulate other users data now you

36:24might be thinking well how can you prove

36:26that because you put a conditional

36:27visibility rules inside the UI that is

36:30uh kind of like hiding the icons in the

36:32first place now if I head back over to

36:33flutter flow I'll take off the

36:35conditional visibility rules of those

36:38particular icons and then we'll try

36:40seeing if we can actually now then

36:42delete those particular rows so let me

36:44just head back over to flood oflow now

36:46okay so here I am back in flood of flow

36:47let's quickly turn these off let's just

36:49turn these conditional Vis visibility

36:52rules off let's just wait for this to

36:54finish doing it syncing let's pop back

36:56over to then test okay so here I am now

36:58and you can see I've now got all of

37:00those icons now available now we know

37:01the first set of Records don't belong to

37:03me if I try deleting these you can see

37:06that it's not allowing it's not

37:08happening nothing is being deleted same

37:09with the updates as well and that is

37:11because those policies are clearly

37:13blocking everything that's happening

37:15behind the scenes so hopefully that's a

37:17good little demonstrator there um I

37:19don't want to keep these kind of set

37:20like this I want to go back into me

37:21application update them so then I've got

37:23a good sample to to present to you guys

37:25but hopefully that makes sense

37:28so there you go hopefully you enjoyed

37:30this particular video I can't stress

37:31enough how important row level security

37:34is to your super base projects It's

37:36always important that you kind of uh

37:38lock down your data you certainly don't

37:40want people coming in and uh pulling

37:42data out that they're not allowed to see

37:44or at least manipulate as well and that

37:46means you can then Focus your attention

37:48on making sure that you are building

37:49beautiful looking front end applications

37:53now of course um the other thing as well

37:54is of course if you're using something

37:55like Firebase you need to make sure you

37:57also apply the rules in there as well to

37:59ensure you're doing something very very

38:00similar to what we're kind of doing in

38:02this particular project but of course

38:04that is for another video so there you

38:06go um my name is Steve I'm the digital

38:08Pro I'm a flood oflow Ambassador for

38:10Europe you'll see that on my YouTube

38:12channel I certainly cover a lot of flood

38:14oflow content and of course the digital

38:16Pros no code academy is designed for yes

38:19people who enjoy flood oflow content but

38:21it's also as well other kind of content

38:23that you might find it useful as well so

38:24please do come and join the link is in

38:26the description it's got

38:28great Community lots of sample

38:29applications code libraries are you name

38:31is there please do come and have a look

38:33around as well so of course you want to

38:35keep on YouTube that's absolutely fine

38:37please do subscribe to the channel and

38:39of course please do like the video as

38:40well because that does get it out to the

38:42masses and I see a lot of people who

38:43kind of watch my content and not

38:45necessarily are subscribers as well so

38:47uh please do become a member of the

38:49academy on YouTube so there we go so

38:51until the next video I'll see you soon

38:56[Music]

38:58he