双用户预约权限：具体输入

create table public.bookings (
  id uuid primary key default gen_random_uuid(),
  owner_id uuid not null references auth.users(id) on delete cascade,
  service text not null,
  booking_day date not null
);
alter table public.bookings enable row level security;
revoke all on table public.bookings from anon, authenticated;
grant usage on schema public to authenticated;
grant select, insert, update, delete on table public.bookings to authenticated;
create policy "owner_select" on public.bookings for select to authenticated using ((select auth.uid()) = owner_id);
create policy "owner_insert" on public.bookings for insert to authenticated with check ((select auth.uid()) = owner_id);
create policy "owner_update" on public.bookings for update to authenticated using ((select auth.uid()) = owner_id) with check ((select auth.uid()) = owner_id);
create policy "owner_delete" on public.bookings for delete to authenticated using ((select auth.uid()) = owner_id);

[
  {
    "identity": "A",
    "action": "read own / insert own",
    "expected": "allowed",
    "actual": "NOT RUN"
  },
  {
    "identity": "A",
    "action": "read B / change owner to B",
    "expected": "empty or rejected",
    "actual": "NOT RUN"
  },
  {
    "identity": "B",
    "action": "read own / insert own",
    "expected": "allowed",

未创建或连接 Supabase 项目，未执行双用户数据库测试。图中是测试矩阵与本地数据说明，不是 RLS 已验证的结果。