---
title: "Flutter Authorization with RLS"
description: "This tutorial extends a Flutter real-time chat app by adding authorization and one-to-one conversations backed by Supabase. It introduces a rooms page for starting conversations and listing existing rooms, while flutter_bloc coordinates profile and message data across the rooms and chats pages. The database changes add rooms and room_participants tables, connect messages to rooms, expose create_new_room for reusing or creating a two-user room, and register deep links for email confirmation on iOS and Android. SQL RLS policies then restrict room, participant, and message reads to participants and require message inserts to use the caller's profile ID, producing a real-time chat app with authentication and authorization."
---

# Flutter Authorization with RLS

[Supabase](https://yomu.fyi/company/supabase) · tyler\_shukert · Nov 22, 2022

**Type:** Tutorial

## Summary

This tutorial extends a Flutter real-time chat app by adding authorization and one-to-one conversations backed by Supabase. It introduces a rooms page for starting conversations and listing existing rooms, while flutter\_bloc coordinates profile and message data across the rooms and chats pages. The database changes add rooms and room\_participants tables, connect messages to rooms, expose create\_new\_room for reusing or creating a two-user room, and register deep links for email confirmation on iOS and Android. SQL RLS policies then restrict room, participant, and message reads to participants and require message inserts to use the caller's profile ID, producing a real-time chat app with authentication and authorization.

## Context

The existing chat app allowed signed-in users to view and send messages in a shared chat, but without Row Level Security users could see every user's rooms and all messages. The application also needed a rooms structure to support one-to-one conversations and a deep-link flow for returning users to the app after email confirmation.

## Approach / What changed

The tutorial adds rooms and room\_participants tables, associates messages with rooms, and defines create\_new\_room to create or reuse a room for two users. It adds flutter\_bloc for shared state between rooms and chat pages, configures the io.supabase.chat://login deep link for iOS, Android, and Supabase, and enables PostgreSQL RLS with policies based on an is\_room\_participant function.

## Takeaways

- The is\_room\_participant SQL function checks whether auth.uid() belongs to a specified room and is reused by RLS policies.
- The messages table receives a room\_id foreign key, while room\_participants relates profiles to rooms with a composite primary key.
- The article notes that injecting the Supabase instance into the cubit would make bloc\_test-based testing possible, and suggests Supabase Presence for showing users who are online.

**Tags:** [Android](https://yomu.fyi/topic/android), [Authentication](https://yomu.fyi/topic/authentication), [iOS](https://yomu.fyi/topic/ios), [Postgres](https://yomu.fyi/topic/postgres), [Testing](https://yomu.fyi/topic/testing)

- Source: [Supabase](https://supabase.com/blog/flutter-authorization-with-rls)
- Source URL: https://supabase.com/blog/flutter-authorization-with-rls
- Ingested by Yomu: 2026-08-29T01:14:52.596Z

[Read original post](https://supabase.com/blog/flutter-authorization-with-rls)