User-owned data

This recipe covers building an app where users own their own data and no-one else can see it, covering schema, permissions, querying, and inserting.

Schema

There's no need to add an explicit owner column — Jazz tracks who created each row automatically via $createdBy.

schema.ts
const schema = {
  todos: s.table(
    {
      title: s.string(),
      done: s.boolean(),
    },
    {},
  ),
};
​
type AppSchema = s.Schema<typeof schema>;
export const app: s.App<AppSchema> = s.defineApp(schema);

See Defining tables for the full schema DSL.

Permissions

Match $createdBy.account to session.user.account to validate whether the current user is the one who created the data. Because $createdBy is set automatically, we can declare insert explicitly with .always().

permissions.ts
s.definePermissions(app, ({ policy, session }) => {
  policy.todos.allowRead.where({ "$createdBy.account": session.user.account });
  policy.todos.allowInsert.always();
  policy.todos.allowUpdate.where({ "$createdBy.account": session.user.account });
  policy.todos.allowDelete.where({ "$createdBy.account": session.user.account });
});

These rules are enforced on the server. See Permissions for combinators, allowedTo, and more complex options.

Querying

The table's permissions already scope results to the current user, so queries don't need a separate owner filter.

MyTodos.tsx
export function MyTodos() {
  const { data: todos, isLoading, error } = useAll(app.todos.where({ done: false }));
​
  if (isLoading) return <p>Loading…</p>;
  if (error) return <p>Something went wrong!</p>;
​
  return (
    <ul>
      {todos.map((todo) => (
        <li key={todo.id}>{todo.title}</li>
      ))}
    </ul>
  );
}

See Queries for subscriptions, one-shot queries, and durability tiers.

Inserting

$createdBy is set automatically on insert, so we don't need to set an owner.

AddTodo.tsx
export function AddTodo() {
  const db = useDb();
​
  function handleAdd(title: string) {
    db.insert(app.todos, { title, done: false });
  }
​
  return <button onClick={() => handleAdd("Buy milk")}>Add</button>;
}

schema.ts
const schemaExplicit = {
  todos: s.table(
    {
      title: s.string(),
      done: s.boolean(),
      owner_id: s.uuid(),
    },
    {},
  ),
};
​
type ExplicitAppSchema = s.Schema<typeof schemaExplicit>;
export const explicitApp: s.App<ExplicitAppSchema> = s.defineApp(schemaExplicit);

permissions.ts
s.definePermissions(explicitApp, ({ policy, session }) => {
  policy.todos.allowRead.where({ owner_id: session.user.account });
  policy.todos.allowInsert.always();
  policy.todos.allowUpdate.whereOld({ owner_id: session.user.account });
  policy.todos.allowDelete.where({ owner_id: session.user.account });
});