RLS Update Own Profile - Denied

I am following the Public Access example in the docs to allow "User can update own profile" (https://supabase.com/docs/guides/auth/managing-user-data)

I am getting access denied for the policy:

create policy "Users can update own profile."
  on profiles for update
  using ( auth.uid() = id );

create policy "Users can update own profile."
  on profiles for update
  using ( auth.uid() = id );

create policy "Users can update own profile."
  on profiles for update
  using ( auth.uid() = id );

create policy "Users can update own profile."
  on profiles for update
  using ( auth.uid() = id );

using this update statement with the supabase js client:

const { data, error } = await supabase
  .from('profiles')
  .update({
    ...formValues,
  })
  .match({ id: user?.id });

const { data, error } = await supabase
  .from('profiles')
  .update({
    ...formValues,
  })
  .match({ id: user?.id });

const { data, error } = await supabase
  .from('profiles')
  .update({
    ...formValues,
  })
  .match({ id: user?.id });

const { data, error } = await supabase
  .from('profiles')
  .update({
    ...formValues,
  })
  .match({ id: user?.id });

any idea why? This is on a nextjs page where the user is authenticated

Screen_Shot_2022-08-25_at_11.49.45_PM.png

lucasbOP•8/26/22, 3:56 AM

pic of policy

jensen•8/26/22, 4:04 AM

Where are you making the request?

jensen•8/26/22, 4:05 AM

In a useEffect on client?

garyaustin•8/26/22, 4:08 AM

For update to work you must also have a valid select policy.
A quick test I recommend to check when you can't see the the authorization header in the network tab (to see if you have the user jwt) is to set your policy to true and your role to anon. If that works, then you do not actually have a valid user jwt when you make the update call.

jensen•8/26/22, 4:10 AM

Ah right. This is addressed by the change for v2 where it no longer automatically selects after update?

garyaustin•8/26/22, 4:10 AM

No update still requires select RLS always by Postgres, that was mainly an insert thing.

jensen•8/26/22, 4:10 AM

Ok thanks

jensen•8/26/22, 4:11 AM

I don’t use postgrest very much, find it quite limiting.

jensen•8/26/22, 4:11 AM

So I’m still learning the nuances

garyaustin•8/26/22, 4:11 AM

Not even a postgrest thing, but Postgres RLS requires you be able to pass select to do an update (add: with filter/where)

jensen•8/26/22, 4:12 AM

I understand that. Thanks.

Jjensen Where are you making the request?

lucasbOP•8/26/22, 1:15 PM

This is being made in an onSubmit function for a form to update the users profile.

lucasbOP•8/26/22, 1:15 PM

I can see the request in the network tab, let me check

lucasbOP•8/26/22, 1:15 PM

Currently, i also have this RLS set up

create policy "Public profiles are viewable by everyone."
  on profiles for select
  using ( true );

create policy "Public profiles are viewable by everyone."
  on profiles for select
  using ( true );

lucasbOP•8/26/22, 1:17 PM

Screen_Shot_2022-08-26_at_9.17.24_AM.png

garyaustin•8/26/22, 1:18 PM

In the network tab, if the authorization header value (after bearer) matches your anon key (apikey and authorization key match?) then you do not have a logged in user set at the call.

lucasbOP•8/26/22, 1:21 PM

hmm okay.. not sure why they wouldn't be logged in.. the user is authenticated and this is a nextjs page wrapped in the withPageAuthwithPageAuth hoc https://supabase.github.io/auth-helpers/modules/nextjs_utils_withPageAuth.html

nextjs/utils/withPageAuth | @supabase/supabase-auth-helpers

Documentation for @supabase/supabase-auth-helpers

garyaustin•8/26/22, 1:22 PM

Do they match?

lucasbOP•8/26/22, 1:22 PM

checking.. sorry was digging that link up

garyaustin•8/26/22, 1:23 PM

They look like they will as normally the user token is much longer than the apikey(anon) token

lucasbOP•8/26/22, 1:23 PM

weird so yeah the Authorization Bearer is the same as my anon key

garyaustin•8/26/22, 1:26 PM

So for whatever reason your helpers/next.js code is not setting/logging in the user.
I'm not much use on that since I don't use either. Maybe jensen will come back.

lucasbOP•8/26/22, 1:28 PM

interesting.. yeah hopefully he can provide some guidance. I am essentially following the auth-helpers library docs from supabase. This is the login function i'm using.

import { supabaseClient } from '@supabase/auth-helpers-nextjs';

<button
  className='btn btn-outline btn-sm'
  onClick={(e) => {
    e.preventDefault();
    return supabaseClient.auth.signIn({
      provider: 'google',
    });
  }}
>
  Sign In
</button>

import { supabaseClient } from '@supabase/auth-helpers-nextjs';

<button
  className='btn btn-outline btn-sm'
  onClick={(e) => {
    e.preventDefault();
    return supabaseClient.auth.signIn({
      provider: 'google',
    });
  }}
>
  Sign In
</button>

garyaustin•8/26/22, 1:30 PM

A typical issue that comes up is when a sign in comes back to the app from the redirectTo, it takes some time to set up the user/session variable. If you make the call before checking the session variable or waiting for the signIn event then you won't have a user. I think auth-helpers has a framework to avoid that though.

lucasbOP•8/26/22, 1:33 PM

Gotcha.. thanks for your help.. I'll post my pkg version numbers for jensen when he's back:

"@supabase/auth-helpers-nextjs": "0.2.7",
"@supabase/auth-helpers-react": "0.2.3",
"@supabase/supabase-js": "1.35.6",
"next": "12.1.5",

"@supabase/auth-helpers-nextjs": "0.2.7",
"@supabase/auth-helpers-react": "0.2.3",
"@supabase/supabase-js": "1.35.6",
"next": "12.1.5",

jensen•8/26/22, 5:55 PM

Hey, I went to bed.

jensen•8/26/22, 5:57 PM

For the update you are doing <Form onSubmit={() => supabase update here}><Form onSubmit={() => supabase update here}>?

jensen•8/26/22, 5:59 PM

The reason I'm asking this question, is that it with SSR it can matter where the request is being made. If it is on the client, then supabase js should take care of setting the access token for the session. If it is on the back end, then there is a auth.setAuthauth.setAuth call to make sure that the server requests are authenticated with the user access_token, rather than anon.

jensen•8/26/22, 5:59 PM

So if this is definitely a client query (done directly in an event handler, or useEffect), then we would need to find out why the access_token in supabase js isn't updated.

garyaustin•8/26/22, 6:02 PM

@jensen So if auth helpers does not do anything on the client side (not saying either way) then the typical try and hit the database before the SB client has finished setting up would still exist? Not that there is enough info so far in this case to know where the update is being done.

jensen•8/26/22, 6:09 PM

With event handlers, it seems unlikely a request would be made before the token is set in the client. A useEffect could definitely surface that. As long as the JS library has a chance to change the auth state then I expect the client to have the correct session stored. Reloading the app would use the updated version in localStorage and should work.

jensen•8/26/22, 6:11 PM

I have spent some time debugging these libraries in node and in the browser. I just don't know what to suggest here other than following the flow in supabase-js that sets the token (and causes the auth state change emit)

jensen•8/26/22, 6:12 PM

Adding a console.log(event, session)console.log(event, session) here in the library https://github.com/supabase/auth-helpers/blob/171f993b0f6bde61923fac2c5e8ad19078ee1a5f/packages/react/src/components/UserProvider.tsx#L132

would give us an idea if it is even getting to that point or not without having to load the debugger.

lucasbOP•8/27/22, 1:33 AM

Hey jensen, thanks for the reply. Here is a slimmed down gist of my nextjs page where this is happening. It's worth noting, if I disable RLS on the table the update goes through (obviously, just wanted to make it clear the update works without RLS) https://gist.github.com/lsbyerley/b59bb88de4ccf048f9758498ec74827b

Gist

Supabase Update Function on Form Submit

Supabase Update Function on Form Submit. GitHub Gist: instantly share code, notes, and snippets.

lucasbOP•8/27/22, 1:35 AM

So you think i should add that console log in the auth-helpers library in node_modules to debug more?

garyaustin•8/27/22, 1:43 AM

Are you sure you can just use the normal client...

For row level security to work properly when fetching data client-side, you need to make sure to import the { supabaseClient } from # @supabase/auth-helpers-nextjs and only run your query once the user is defined client-side in the useUser() hook:

For row level security to work properly when fetching data client-side, you need to make sure to import the { supabaseClient } from # @supabase/auth-helpers-nextjs and only run your query once the user is defined client-side in the useUser() hook:

lucasbOP•8/27/22, 1:49 AM

@garyaustin great point! ... i just realized the supabase client is from @/lib/supabase@/lib/supabase and not @supabase/auth-helpers-nextjs@supabase/auth-helpers-nextjs .. switching this up and the authorization: Bearer token is different from anon key and the update works.

lucasbOP•8/27/22, 1:50 AM

thank you! i should have posted a gist earlier haha thanks again for your alls time

lucasbOP•8/27/22, 1:53 AM

i have recently switched over from the next-auth library to the supabase auth-helpers lib and i guess there were some leftovers

jensen•8/27/22, 1:54 AM

Excellent

jensen•8/27/22, 1:55 AM

Just finished dinner so thought Id check in

lucasbOP•8/27/22, 1:55 AM

nice!

RLS Update Own Profile - Denied

Similar Threads

Similar Threads

Similar Threads