before_and_after_rls.java

/*
** ---- Without RLS ---- **

1. Check if user is a member of the org
  a. If so, execute the update query
  b. Else, return a 404
*/

Org update(userId, orgId, updatePayload) {
  if (dao.isOrgMember(userId, orgId)) {
    return dao.updateOrg(updatePayload);
  } else {
    throw new NotFoundException();
  }
}

/* -- DAO layer -- */

boolean isOrgMember(userId, orgId) {
  return query("EXISTS(SELECT 1 ...)");
}

Org updateOrg(updatePayload) {
  return query("UPDATE orgs SET ... RETURNING *");
}

/*
** ----- With RLS ---- **

1. Execute the update query
  a. If the org was returned from the db, return the org in the response
  b. Else, return a 404
*/

Org update(userId, orgId, updatePayload) {
    Optional<Org> maybeOrg = dao.updateOrg(updatePayload);
    if (maybeOrg.isPresent()) {
      return maybeOrg.get();
    } else {
       throw new NotFoundException();
    }
}

/* -- DAO layer -- */

Optional<Org> updateOrg(updatePayload) {
  return query("UPDATE orgs SET ... RETURNING *");
}