publishSession: {
code: '42501',
details: null,
hint: null,
message: 'new row violates row-level security policy for table "sessions"'
}
POST /api/sessions/publish 500 1203.073 ms - 37
!!!!!
Fto <role> clause), but the query might be performed using the authenticated role.
G!!
G!
!!
to <role>authenticatedconst jwt = require('jsonwebtoken')
const auth = (req, res, next) => {
try {
const h = req.get('authorization') || req.get('Authorization')
if (!h || !h.startsWith('Bearer ')) {
return res.status(401).json({ error: 'Token missing' })
}
const token = h.split(' ')[1]
const decoded = jwt.verify(token, process.env.SUPABASE_JWT_SECRET)
req.user = {
id: decoded.sub,
_id: decoded.sub,
email: decoded.email || null
}
next()
} catch (err) {
if (err.name === 'JsonWebTokenError') {
return res.status(401).json({ error: 'Invalid token' })
}
if (err.name === 'TokenExpiredError') {
return res.status(401).json({ error: 'Expired token' })
}
console.error('Auth error:', err)
res.status(500).json({ error: 'Authentication error' })
}
}
module.exports = authconst supabase = createClient(process.env.SUPABASE_URL, process.env.SUPABASE_ANON_KEY, {
auth: { autoRefreshToken: false,
persistSession: false,
detectSessionInUrl: false }
})exports.publishSession = async (req, res) => {
try {
const userId = req.user._id
const {
id,
title,
tags = [],
video_url = null,
description = '',
difficulty = 'Beginner'
} = req.body
if (!title || typeof title !== 'string') {
return res.status(400).json({ error: 'Title is required' })
}
const payload = {
user_id: userId,
title,
tags,
video_url,
description,
difficulty,
status: 'published'
}
let query
if (id) {
query = supabase
.from('sessions')
.update(payload)
.eq('id', id)
.eq('user_id', userId)
.select()
.single()
} else {
query = supabase
.from('sessions')
.insert(payload)
.select()
.single()
}
const { data: session, error } = await query
if (error) throw error
const profiles = await fetchProfilesForSessions([session])
res.status(id ? 200 : 201).json({ data: { session: mapRow(session, profiles) } })
} catch (err) {
console.error('publishSession:', err)
res.status(500).json({ error: 'Failed to publish session' })
}
}create table if not exists public.profiles (
id uuid primary key references auth.users(id) on delete cascade,
email text unique
);
-- Sessions table
create table if not exists public.sessions (
id uuid primary key default gen_random_uuid(),
user_id uuid not null references auth.users(id) on delete cascade,
title text not null,
tags text[] not null default '{}',
video_url text,
description text default '',
difficulty text not null default 'Beginner' check (difficulty in ('Beginner','Intermediate','Advanced')),
status text not null default 'draft' check (status in ('draft','published')),
created_at timestamptz not null default now(),
updated_at timestamptz not null default now()
);
-- RLS
alter table public.sessions enable row level security;
-- Read published sessions by anyone
drop policy if exists "read published sessions" on public.sessions;
create policy "read published sessions" on public.sessions
for select using (status = 'published');
-- Owners can do everything on their own rows
drop policy if exists "owner full access" on public.sessions;
create policy "owner full access" on public.sessions
for all
using (auth.uid() = user_id)
with check (auth.uid() = user_id);