Supabase•2mo ago

"remote schema" revoking all actions on table!

I have created a schema that contains a table "organizations" that contains it's table insertion, a function to trigger updating the column and all the necessary RLS (attached). When migration and pushing to remote service, all works fine! However, as soon as I then later on do "supabase db pull" I get this schema:

revoke delete on table "public"."organization_details" from "anon";
revoke insert on table "public"."organization_details" from "anon";
revoke references on table "public"."organization_details" from "anon";
revoke select on table "public"."organization_details" from "anon";
revoke trigger on table "public"."organization_details" from "anon";
revoke truncate on table "public"."organization_details" from "anon";
revoke update on table "public"."organization_details" from "anon";
revoke delete on table "public"."organization_details" from "authenticated";
revoke insert on table "public"."organization_details" from "authenticated";
revoke references on table "public"."organization_details" from "authenticated";
revoke select on table "public"."organization_details" from "authenticated";
revoke trigger on table "public"."organization_details" from "authenticated";
revoke truncate on table "public"."organization_details" from "authenticated";
revoke update on table "public"."organization_details" from "authenticated";
revoke delete on table "public"."organization_details" from "service_role";
revoke insert on table "public"."organization_details" from "service_role";
revoke references on table "public"."organization_details" from "service_role";
revoke select on table "public"."organization_details" from "service_role";
revoke trigger on table "public"."organization_details" from "service_role";
revoke truncate on table "public"."organization_details" from "service_role";
revoke update on table "public"."organization_details" from "service_role";
alter table "public"."organization_details" add column "test" bigint;
set check_function_bodies = off;

revoke delete on table "public"."organization_details" from "anon";
revoke insert on table "public"."organization_details" from "anon";
revoke references on table "public"."organization_details" from "anon";
revoke select on table "public"."organization_details" from "anon";
revoke trigger on table "public"."organization_details" from "anon";
revoke truncate on table "public"."organization_details" from "anon";
revoke update on table "public"."organization_details" from "anon";
revoke delete on table "public"."organization_details" from "authenticated";
revoke insert on table "public"."organization_details" from "authenticated";
revoke references on table "public"."organization_details" from "authenticated";
revoke select on table "public"."organization_details" from "authenticated";
revoke trigger on table "public"."organization_details" from "authenticated";
revoke truncate on table "public"."organization_details" from "authenticated";
revoke update on table "public"."organization_details" from "authenticated";
revoke delete on table "public"."organization_details" from "service_role";
revoke insert on table "public"."organization_details" from "service_role";
revoke references on table "public"."organization_details" from "service_role";
revoke select on table "public"."organization_details" from "service_role";
revoke trigger on table "public"."organization_details" from "service_role";
revoke truncate on table "public"."organization_details" from "service_role";
revoke update on table "public"."organization_details" from "service_role";
alter table "public"."organization_details" add column "test" bigint;
set check_function_bodies = off;

28 Replies

PerelanOP•2mo ago

My schema:

PerelanOP•2mo ago

schema.sql

PerelanOP•2mo ago

Spent the whole day on this issue, it has resulted in me losing all the data in the database... But now at least I'm trying to setup the migration "correctly" I don't recall doing anything in the Supabase UI that causes that migration to appear The way I'm doing it now is: 1. Create the schema (as shown in attachment) 2. Run supabase db diff -f "create_organization_details" (see attachment below) 3. supabase migration up 4. supabase db push Then the only reason I do "supabase db pull" is to ensure that everything is sync between local and remote (I'm hoping it is, because the whole remote database is nuked...) Nonetheless, the "remote schema" that revoke access to the table is generated

PerelanOP•2mo ago

20250911211029_setup...

PerelanOP•2mo ago

The initial schemas I setup was weeks ago. So either something has happened behind the scenes in Supabase or I touched a setting in the UI today without knowing (please be so and tell me how to fix this headache 😓) Seems related to this thread too: https://discord.com/channels/839993398554656828/1412156678459359243 Looking at my commits, the last time I did "supabase db pull" was on 9th of September - the same day that thread you created was made... Something is up I did, however, today update my Supabase CLI version to "2.40.7"

Ryux411 ·•2mo ago

Perelan, the revoke lines aren’t your doing. They come from a Supabase CLI change (2.40.x) where db pull now includes explicit privilege revokes. Your schema is fine. The data loss came from db push, which overwrites to match local. If you want to avoid the noise, pin CLI ≤ 2.39 or manage grants explicitly in your migrations.

ND•2mo ago

This is a big issue for production level applications. we're facing release delay due to it at https://aicamp.so https://github.com/supabase/cli/issues/4068#issuecomment-3263704764

AICamp

AI platform for Teams

AICamp is your go-to platform for rolling out AI to every member of your organization.

GitHub

Missing grants in generated migration generated with version 2.33.0...

Describe the bug When generating database migrations, Supabase CLI 2.33.0 output's is very different from previous version: does not include GRANT on the newly created table revoke existing pri...

PerelanOP•2mo ago

@Ryux411 · thanks for reply! I'll ping my CLI! Nontheless, I'd like to understand what you mean with "manage grants explicitly in your migrations.". I tried explicity setting the grants in my schema, as such:

-- Grants: allow roles to use the table through RLS
grant select, insert, update, delete on table public.organization_details to authenticated;
grant all on table public.organization_details to service_role;
-- Uncomment below if you want public (anon) read access:
-- grant select on table public.organization_details to anon;

-- Grants: allow roles to use the table through RLS
grant select, insert, update, delete on table public.organization_details to authenticated;
grant all on table public.organization_details to service_role;
-- Uncomment below if you want public (anon) read access:
-- grant select on table public.organization_details to anon;

However, it still get overriden with revoking when pulling the remote schema.

silentworks•2mo ago

This is a breaking change if this is what is happening now. I'm going try and get the attention of someone in the Supabase CLI team to look into this.

PerelanOP•2mo ago

@silentworks It indeed is a breaking change on a minor package bump :/ It's caused a lot of "outburst" in the issue on github as well: https://github.com/supabase/cli/issues/4068

GitHub

Missing grants in generated migration generated with version 2.33.0...

Describe the bug When generating database migrations, Supabase CLI 2.33.0 output's is very different from previous version: does not include GRANT on the newly created table revoke existing pri...

silentworks•2mo ago

I've alerted the CLI team and pointed them to that issue on GitHub

PerelanOP•2mo ago

Also while I have you here, ever since the update, the local CLI has been timing a lot too! I have found a work around by including the "--debug" flag. For example, "supabase db diff -f xxx" times out without that flag

silentworks•2mo ago

Note I'm not a Supabase staff. I'm only a mod on here. I would suggest you open a GitHub issue on the CLI repo about this. Also have you tried with an older version to see if this issue persists?

PerelanOP•2mo ago

I already did! Though, I might have miscategorized it as I didn't find any category for "CLI". It's behaving way more snappier on the previous versions, yes.

PerelanOP•2mo ago

PerelanOP•2mo ago

It fails like this If Include --debug, it passes

silentworks•2mo ago

For now roll back to the previous version and hopefully the CLI team will review this soon. Also you can try the beta version to see if it has been fixed already. npx supabase@beta start

PerelanOP•2mo ago

I'll give it a try - tysm!

patito1009•2mo ago

@Perelan this has been a problem for dome days now, the thing it's happening to me but in the storage schema. Other people are having the same problem but there's no answer yet. I created an issue in GitHub for it and I see you already found the other issue related to the revokes problem. Here is the link the my opened issue if you want to give it some support and let's pray for the devs to see it. https://github.com/supabase/cli/issues/4107

GitHub

Privileges revoked from all storage tables after pull of storage sc...

Describe the bug When using supabase db pull --schema storage the migration file contains lots of revoke statements that remove all privileges of all storage stables from all database users (anon, ...

silentworks•2mo ago

@Perelan @patito1009 can one of you send me your project ref so I can get someone in the Supbase CLI team to look into it please?

patito1009•2mo ago

yes, no problem

silentworks•2mo ago

You can DM it to me if you don't want to share it publicly

patito1009•2mo ago

I'll dm you

PerelanOP•2mo ago

@silentworks I ended up running "supabase migration down --linked" like an idiot (thanks to cursor) so I don't have those migration files anymore. Luckly I'm in the eargly stage of the startup, so no harm done. (also gave me chance to write some nicer migration files hehe)

Ryux411 ·•2mo ago

Happy debugging

silentworks•2mo ago

I can see there is work being done on this at the moment. Hopefully they should have a fix out in the beta channel of the CLI soon. I will keep you informed here.

PerelanOP•2w ago

“@silentworks Reaching out again - the ticket (https://github.com/supabase/cli/issues/4068) was closed, but the issue still persists. Could you please flag this with the Supabase team? Thanks!

GitHub

Missing grants in generated migration generated with version 2.33.0...

Describe the bug When generating database migrations, Supabase CLI 2.33.0 output's is very different from previous version: does not include GRANT on the newly created table revoke existing pri...

silentworks•2w ago

There is already someone on the Supabase team in that issue replying to messages so no need to flag it.

Gaming

Programming

"remote schema" revoking all actions on table!

Did you find this page helpful?