Problems with create policy of update - postgresql

Question

I want to use row level security to create a policy for update, tb.idx never could update to less than 2 if cls = 'great2':
create table tb (
idx integer,
cls text);
create role user1;
grant all on tb to user1;
......
create policy up_p on tb for update
using(true)
with check (idx >2 and cls='great2');
output:
set role user1;
select * from tb;
update tb set idx=1 cls='great2'
There are two problems:
when using select * from tb, it shows an empty table.
it allows update with idx=1 cls='great2'.

Answer 1

it shows an empty table.
Quote from the manual
If row-level security is enabled for a table, but no applicable policies exist, a “default deny” policy is assumed, so that no rows will be visible or updatable.
So you need to create a policy that allows selecting:
create policy tb_select on tb
for select
using (true);
it allows update with idx=1 cls='great2'.
Quote from the manual
Existing table rows are checked against the expression specified in USING, while new rows that would be created via INSERT or UPDATE are checked against the expression specified in WITH CHECK
As you created the policy with using (true) that means all rows can be updated.
So you need:
create policy up_p on tb
for update
using (idx > 2 and cls='great2');
Assuming there is a row with (1, 'great2') the following update would not update anything:
update stuff.tb
set cls = 'great2'
where idx = 1;
Note, that for the policy to actually be active you also need:
alter table tb enable row level security;
However, if you simply want to ensure that values for idx are always greater than 2 for rows with cls = 'great2', a check constraint might be the better option:
create table tb
(
idx integer,
cls text,
constraint check_idx check ( (idx > 2 and cls = 'great2') or (cls <> 'great2'))
);
insert into tb
values
(10, 'great2'),
(1, 'foo');
Now running:
update tb
set idx = 1
where idx = 10
results in:
ERROR: new row for relation "tb" violates check constraint "check_idx"
Detail: Failing row contains (1, great2).
the same happens if you change the cls value for a row with idx <= 2
update tb
set cls = 'great2'
where idx = 1;