Added stashes with experimental row security policies. Added tag photos.

src/web/postgraphile.js

@@ -10,7 +10,13 @@ const PgOrderByRelatedPlugin = require('@graphile-contrib/pg-order-by-related');
 
 const { ActorPlugins, SitePlugins, ReleasePlugins } = require('./plugins/plugins');
 
-const connectionString = `postgres://${config.database.user}:${config.database.password}@${config.database.host}:5432/${config.database.database}`;
+const connectionString = `postgres://${config.database.query.user}:${config.database.query.password}@${config.database.query.host}:5432/${config.database.query.database}`;
+
+async function pgSettings(req) {
+	return {
+		'user.id': req.session.user?.id,
+	};
+}
 
 module.exports = postgraphile(
 	connectionString,
@@ -36,5 +42,6 @@ module.exports = postgraphile(
 			...SitePlugins,
 			...ReleasePlugins,
 		],
+		pgSettings,
 	},
 );

src/web/server.js

@@ -48,7 +48,6 @@ async function initServer() {
 	const router = Router();
 	const store = new KnexSessionStore({ knex });
 
-	app.use(pg);
 	app.set('view engine', 'ejs');
 
 	router.use('/media', express.static(config.media.path));
@@ -61,6 +60,8 @@ async function initServer() {
 	router.use(bodyParser.json({ strict: false }));
 	router.use(session({ ...config.web.session, store }));
 
+	router.use(pg);
+
 	router.use((req, res, next) => {
 		req.session.safeId = req.session.safeId || nanoid();