Profile not saving (RLS or code issue?)

Question (tl;dr):
After logging in to my Supabase-powered webapp (iOS PWA), users can’t save their profile — I get an error when trying to update the profiles table. Public member profiles load fine, so I suspect it’s an RLS or policy issue, but I’m not sure.

Goal:
• Display member profiles publicly (

working).
• Let users edit their own profile after logging in (

not working).
• Profiles should be updated with the profile editor after login from dashboard. (independently from the is_visible value)

Problem:
• Users log in successfully via Supabase Auth.
• When trying to update an existing profile, I get error
• The profile doesn’t get updated into the profiles table.
• I don’t know if it’s due to RLS policy, schema setup, or client-side code.

Table Structure (profiles):
• id: UUID (user ID from auth.uid())
• created_at, updated_at: timestamps
• full_name, email, phone, etc.
• is_visible: boolean
• status: text (e.g. 'active')
• is_admin: boolean (just one profile has it set to true)
(Plus many optional JSON fields like services, address, business hours, etc.)

matteoxt24mtOP•7/22/25, 11:42 AM

RLS Policies:

-- Enable RLS on the profiles table
ALTER TABLE "public"."profiles" ENABLE ROW LEVEL SECURITY;

-- 1) Admins can do everything on profiles
CREATE POLICY "Admins can do everything on profiles" 
ON "public"."profiles" 
FOR ALL 
TO public 
USING (is_admin() OR (auth.uid() = id)) 
WITH CHECK (is_admin() OR (auth.uid() = id));

-- 2) Public profiles are viewable by everyone
CREATE POLICY "Public profiles are viewable by everyone" 
ON "public"."profiles" 
FOR SELECT 
TO public 
USING ((is_visible = true) AND (status = 'active'::text));

-- 3) Users can create their own profile
CREATE POLICY "Users can create their own profile" 
ON "public"."profiles" 
FOR INSERT 
TO public 
WITH CHECK (auth.uid() = id);

-- 4) Users can update their own profile
CREATE POLICY "Users can update their own profile" 
ON "public"."profiles" 
FOR UPDATE 
TO public 
USING (auth.uid() = id);

-- 5) Users can view their own profile
CREATE POLICY "Users can view their own profile" 
ON "public"."profiles" 
FOR SELECT 
TO public 
USING (auth.uid() = id);

-- Enable RLS on the profiles table
ALTER TABLE "public"."profiles" ENABLE ROW LEVEL SECURITY;

-- 1) Admins can do everything on profiles
CREATE POLICY "Admins can do everything on profiles" 
ON "public"."profiles" 
FOR ALL 
TO public 
USING (is_admin() OR (auth.uid() = id)) 
WITH CHECK (is_admin() OR (auth.uid() = id));

-- 2) Public profiles are viewable by everyone
CREATE POLICY "Public profiles are viewable by everyone" 
ON "public"."profiles" 
FOR SELECT 
TO public 
USING ((is_visible = true) AND (status = 'active'::text));

-- 3) Users can create their own profile
CREATE POLICY "Users can create their own profile" 
ON "public"."profiles" 
FOR INSERT 
TO public 
WITH CHECK (auth.uid() = id);

-- 4) Users can update their own profile
CREATE POLICY "Users can update their own profile" 
ON "public"."profiles" 
FOR UPDATE 
TO public 
USING (auth.uid() = id);

-- 5) Users can view their own profile
CREATE POLICY "Users can view their own profile" 
ON "public"."profiles" 
FOR SELECT 
TO public 
USING (auth.uid() = id);

Any help appreciated!
It’s been days that I’ve been trying to solve this without success, and I’m really stuck.
Happy to post the solution once I get it working — thanks for reading and helping me troubleshoot!

garyaustin•7/22/25, 1:13 PM

What is your error?
What is your operation code that is failing?
Check the API Gateway log for your update operation. Look at the details to see if you see an authenticated user's info or the role as anon instead.

Ggaryaustin What is your error? What is your operation code that is failing? Check the API G...

matteoxt24mtOP•7/22/25, 2:28 PM

Error: UPDATE operation returns empty array ([]) with no error, but no rows are actually updated in the database.

const { data, error } = await supabaseClient
  .from('profiles')
  .update({ 
    business: "test",
    updated_at: new Date().toISOString()
  })
  .eq('id', user.id)
  .select('*');

// Results:
// data: [] (empty array)
// error: null
// No actual database update occurs

...catches, logs, etc...

const { data, error } = await supabaseClient
  .from('profiles')
  .update({ 
    business: "test",
    updated_at: new Date().toISOString()
  })
  .eq('id', user.id)
  .select('*');

// Results:
// data: [] (empty array)
// error: null
// No actual database update occurs

...catches, logs, etc...

This is the the log:

🧪 Testing simple update after RLS fix...
🆔 User ID: ddc9a336-......
❌ Simple test failed: Error: Update returned no data - RLS policy still blocking

🧪 Testing simple update after RLS fix...
🆔 User ID: ddc9a336-......
❌ Simple test failed: Error: Update returned no data - RLS policy still blocking

Additional Context:

User can READ their own profile successfully (RLS read policy works)
User is authenticated
Profile exists in database and is readable
UPDATE returns success but doesn't actually update any rows
Using createClientComponentClient() in Next.js client component

garyaustin•7/22/25, 2:34 PM

Look in the Patch entry for details. You are not meeting RLS.
In the details, as I said it should show the role and if authenticated a user id. If the role is anon then it will fail like you see.

garyaustin•7/22/25, 2:36 PM

Most likely you don't have a user session at the point you are doing this update.

Ggaryaustin Look in the Patch entry for details. You are not meeting RLS. In the details, a...

matteoxt24mtOP•7/24/25, 2:31 PM

Thank you! Yes, I can see it's showing anon role in the logs. What's the best approach you'd recommend for handling auth and session management? Should I be checking the user session before every database operation, or is there a better pattern to ensure the user stays authenticated throughout their session?

garyaustin•7/24/25, 2:35 PM

No you should not need to check in a working app. Your code is doing something wrong.
You would need to determine what goes wrong from sign in or up to the point of this call. It could be you signup and run this code before the user gets a session from the callback. Could be you have multiple createClients (server side stuff?) that are not communicating properly with cookies.

I don't recall your environment and you don't show the createClient in relation to the update.

-- Enable RLS on the profiles table ALTER TABLE "public"."profiles" ENABLE ROW LEVEL SECURITY; -- 1) Admins can do everything on profiles CREATE POLICY "Admins can do everything on profiles" ON "public"."profiles" FOR ALL TO public USING (is_admin() OR (auth.uid() = id)) WITH CHECK (is_admin() OR (auth.uid() = id)); -- 2) Public profiles are viewable by everyone CREATE POLICY "Public profiles are viewable by everyone" ON "public"."profiles" FOR SELECT TO public USING ((is_visible = true) AND (status = 'active'::text)); -- 3) Users can create their own profile CREATE POLICY "Users can create their own profile" ON "public"."profiles" FOR INSERT TO public WITH CHECK (auth.uid() = id); -- 4) Users can update their own profile CREATE POLICY "Users can update their own profile" ON "public"."profiles" FOR UPDATE TO public USING (auth.uid() = id); -- 5) Users can view their own profile CREATE POLICY "Users can view their own profile" ON "public"."profiles" FOR SELECT TO public USING (auth.uid() = id);

const { data, error } = await supabaseClient .from('profiles') .update({ business: "test", updated_at: new Date().toISOString() }) .eq('id', user.id) .select('*'); // Results: // data: [] (empty array) // error: null // No actual database update occurs ...catches, logs, etc...

Profile not saving (RLS or code issue?)

Similar Threads

Similar Threads

Similar Threads