What does PERMISSIONS FULL mean on a SurrealDB table?

Table permissions FULL for writes

Warning: the statement succeeds, then writes fail, access changes, or the table is held up.

What happens

PERMISSIONS FULL on a table, or FOR create, update or delete FULL, lets every record user signed in through an access method write every record in the table, not only their own. Root, namespace and database users bypass table permissions, which is why tests run as root do not notice.

Why it is dangerous on a populated table

The more records the table holds, the more any record user can read, change or delete that is not theirs: FULL applies to every record, not only their own.

Fires on

DEFINE TABLE note SCHEMAFULL PERMISSIONS FULL;

The safe pattern

DEFINE TABLE note SCHEMAFULL PERMISSIONS FOR select, create, update, delete WHERE owner = $auth.id;

Fixtures

The rule ships with these files and the test suite runs them on every change: the first set must fire, the second must stay silent.

DEFINE TABLE note SCHEMAFULL PERMISSIONS FULL;

DEFINE TABLE note SCHEMAFULL PERMISSIONS FOR select WHERE owner = $auth.id FOR create, update FULL;

DEFINE TABLE secret SCHEMAFULL PERMISSIONS NONE;

DEFINE TABLE article SCHEMAFULL PERMISSIONS FOR select FULL FOR create, update, delete WHERE author = $auth.id;

DEFINE TABLE note SCHEMAFULL PERMISSIONS FOR select, create, update, delete WHERE owner = $auth.id;

How to check locally

npx bolvrk check migration.surql --engine=surrealdb