Supabase is an open source Firebase alternative. Start your project with a Postgres database, Authentication, instant APIs, Edge Functions, Realtime subscriptions, and Storage.

Supabase

anyone else experiencing issues while adding new columns to tables?

Are you adding the fields from the studio ui or cli?

but also tried through SQL and didn't work

Hi <:vmathi:812484657547313212> Please use <#843999948717555735>'s channel next time when asking a question. Thanks you.

Hey thanks for the feedback,

I actually did initially and after not having received a reply by anyone, I went on and uploaded the same question on general.
Then I got my reply.

I will keep this in mind but at the same time, guidance must be provided for people that want to use Supabase and to be honest I see a lot of people's questions not being answered in this server while at a competitor's server there is probably a lot more engagement... (Appwrite)

Of course some questions might be silly for most of others in here but still, some guidance would be appreciated. This is a funnel to a paid product and Supabase wants more customers I would assume right?

Thanks for your input.

Edit: spelling

I totally understand your issue, it's the case in a lot of community. If i'm right, Supabase has less users on the discord than Appwrite, and provides a lot of more tools/ways than it (rust, flutter, js, python and more), meaning it becomes more complicated to help all users. Last time i asked about a docker issue i got with Appwrite, i didn't get the help i needed, and i got this issue again and again in a lot of discord dev communities (vitejs, windicss....).
I agree the <#843999948717555735> doesn't provide enough help, it's something we need to work on. We often recommend to ask the same question in the ``/discussions`` tab on Github, it's often more active on that way

Anyway, i reported this problem to the staff, thank you for taking the time to point this out to me <@456226577798135808>  <:vmatpray:865065777081090069>

Thanks for the tip.

Appwrite - active 675 | total - 6835 
Supabase - active - 823 | total - 4756

Hey no problem I am just saying, because this is a funnel to a paid service no worries thanks again. <#843999948717555735> it is.

If you're paying the service, you also can contact the support via mail (``support@supabase.io``), but i agree this is not nice, we gonna see how improve this part of the server.
And yeah, as i can see, Appwrite has ~ 3000 members more than us, so it can explains a lot

That would  be 2079 more members not around 3000 with about 150 less active as of right now 🙂

The difference in these numbers is not overly significant. 
Plus less people less help requests so it balances out.

Of course there could be a company culture difference right? 

Anyway. 

You don't have to justify your personal position in every message, 
I only provide my personal opinion (whatever that costs) for the company overall, not you personally, except if you feel responsible for some reason. 
If you are volunteering (and even if not) I don't think it's on your shoulders to run things at 100% capacity all the time.

Take care.

<@456226577798135808> there is no funnel on the platform to get people to become paid customers in the sense that you have mentioned. This discord is community run while the Appwrite one is actually run by the company itself (I know this because I was a part of the Appwrite community and have communicated with the creator before).

The difference here is that many people are in different timezones and when you post a question it might not get answered in the time you want it to also the experience level varies amongst users on here. We try and help everyone as much as we can but some questions are repeat questions which if you do a search in discord you may find the answer or better yet use the GitHub discussions where a lot of questions have been answered. https://github.com/supabase/supabase/discussions

I don't think we should continue opening a closed discussion.

Regardless of time zones still a lot of questions remain unanswered for days (or forever).

Yes you are right, obviously it's the right thing to do to look for the answer on discussions and in here on the top-right search bar before you become just another "one of those posters".

And yes this is a funnel, because if you keep giving me a bad impression as a culture because you want to be "right" no matter what and "win" in the chat, then simply you are pushing me the potential CUSTOMER away fromk Supabase.
You know that potential customers are allowed on this server right? 

This is not a war on interpretation here. Please carry on.

I'm unsure what you are reading into here, but since you seem to think I'm here to challenge you rather than help you I will end the conversation here.

Pardon my tone it's just tiring having to deal with new replies on a closed post

Th thread is open for 24 hours, it wasn't closed just to be clear.

<@414972572732489748> random invite links in DMs

will send a warning 👍  (FYI<@&844002158411776011> might be a better tag)

Can you drop his id please? Can't find him :/ <@!281314080923320321>

Is there a way to fake log-in?  I'm using magic links and would be great if I could just fake it somehow without sending myself an email

I don't think you can fake the log-in in such a way. I've read where some people were able to fake the user for tests using a JWT, but haven't seen any related to magic links.

Is there a way to recover deleted storage objects or datatable rows?

Trying to add a description to a column and it gives me the following error: "type text[] does not exist". Any idea what that's about?

Can you show the sql you ran? Or was this with the UI?

<@688067695622881321> it was with the UI. I tried to add a description to a column with text[]

`Failed to create new project: You have reached the limit for the number of free projects you can create`

I have deleted all of my supabase projects which I made for testing, yet getting this when I tried to create a new one.

Any idea anyone?

Solved it by hard refreshing the page in my case

hi, I customized the user table by adding a column, but using `supabase.auth.api.getUser('JWT')` returns all other values apart from the one I added, is this by design?

Ok you shouldn't modify that table at any cost as its inside of a managed schema (`auth, storage, extensions, realtime`), you should only add tables into the `public` schema or create your own schema

The reason for this is that the Supabase team can decide to make a change to these schemas for a new feature or security reasons and you would lose your changes.

To answer your initial question, yes its by design that the function call above only returns certain columns

Slack clone example allows everyone having +admin email address to get control over the app, right? Any plans on fixing that?

I think that's by design, see https://github.com/supabase/supabase/tree/master/examples/nextjs-slack-clone#role-based-access-control-rbac

(it should be +supaadmin, so if it's +admin then yeah - it's a bug)

Well ye i meant supaadmin but nevertheless the boilerplate is not immediately usable

Clones of apps should always be considered a starting point or proof of concept. They're rarely intended to be deployed immediately without some changes.

I think this example app was intended to show what you can do with postgres functions to easily handle signups.
public.handle_new_user() is a great starting point but perhaps it shouldn't be part of the default schema to start with, and maybe something that you can add later as a more advanced step in setting up your supabase project.

Maybe improve the clone to limit emails to a certain domain? Or instead add endpoints for adding roles manually instead of plus-email addresses system

is there a way to automatically set a user’s profile once they signup with github?

got any more context on what your trying to do?

here’s my github url. https://github/thienjs/thien.me

i’m just a novice developer following some tutorials.

i read aalam.in and monica powell’s auth tutorials and supabase materials.

want i’ll want to be able to do is have a trigger where if people sign up with github. it sets it in a profile or account table.

ty anyways if it’s a dumb question haha, it’s not that important. ty for all the great stuff you guys put out. i’m a big fan

Is there something like RLS for stored procedures?
Also is there a way to opt out procedures from rpc?

You can put your procedures in a schema the API does not have access to (see API settings).   You could also do postgres permissions to control access at a broad level.  
For RLS type things you would just do that in the actual stored procedure.

When you create the procedure you can use SECURITY INVOKER or SECURITY DEFINER, both of which will respect RLS I think. https://www.postgresql.org/docs/13/sql-createprocedure.html

> SECURITY INVOKER indicates that the procedure is to be executed with the privileges of the user that calls it. That is the default. SECURITY DEFINER specifies that the procedure is to be executed with the privileges of the user that owns it.

So if SECURITY INVOKER is set, all operations on tables inside the procedure check against the RLS as if the user who invoked the procedure was acting on them directly, correct?

That means I have to manually make sure that procedures with SECURITY DEFINER set are inaccessible from outside the database

That’s my understanding. I have cases where I want a function to run with more permissions that the user invoking it has on the table, so I use DEFINER. But anything you don’t want called via rpc should be in a different schema.

Security invoker is default if you don't specify anything.  You can use security definer to do things on RLS protected tables, but then you need to make sure they do their own protection.  You don't always want SD procedures hidden as they are used on RLS tables many times, just control the result on their own.

An example of when you might want DEFINER: you want to write something to a table but you don’t want to grant the person invoking it INSERT permissions

> You don't always want SD procedures hidden as they are used on RLS tables many times, just control the result on their own.
Waht does this mean?

Like MikeJ said, or say you want to get a count from a protected table, the  user needs access to the function, but does not have read RLS on the table.

I'm currently rocking the *insert into the profiles table when a new user signs up*-trigger, but the stored procedure is in the public schema - so I think I could just create a new schema, and recreate the procedure there and then it would be able to be called by the trigger, but not by users via RPC, right?

Ah, ok
from your original answer I wasn't sure if you ment that RLS itself relies on functions being inside the public schema or smth like that

I'm not positive whether you can run a trigger function or not with rpc, interesting...  It will certainly not have any data passed to it.

It’s not quite the same - but I set a users “name” to their email when they first sign up, like this:

Create a trigger so that when a profile is associated with a user we set a default value for name based on their email address.
--------------------------------------------
CREATE OR REPLACE FUNCTION set_default_profile_name_from_user ()
    RETURNS TRIGGER
    AS $$
BEGIN
    IF NEW.user_id IS NOT NULL AND NEW.name IS NULL THEN
        SELECT
            INTO NEW.name split_part(email, '@', 1) AS name
        FROM
            auth.users
        WHERE
            id = NEW.user_id;
    END IF;
    RETURN NEW;
END;
$$
LANGUAGE plpgsql
SECURITY DEFINER VOLATILE;

--- AND
CREATE TRIGGER create_profile_for_response
    BEFORE INSERT OR UPDATE ON profiles
    FOR EACH ROW
    EXECUTE PROCEDURE set_default_profile_name_from_user ();
    
Don't allow users to null out their name
----------------------------------------
ALTER TABLE profiles
    ADD CONSTRAINT profiles_with_users_cannot_have_null_or_blank_name CHECK (
        user_id IS NULL
        OR COALESCE(TRIM(name), '') <> ''
    )

So MikeJ's function certainly won't work if called from rpc as he checks new.  which won't be there.

ty <@!758445455339946074> for the example

Correct - this was just to show you need DEFINER else RLS would not allow the INSERT

FYI supabase example has the trigger function in public....

yeah i was following that
tbh I completely forgot that schemas exist and that's what I'm going to use now, I think

but it's good to see Mikes example that does input checking etc

My app is a little backwards in that I have profiles for anonymous people that later get assigned to users - they can interact with the app before choosing to sign up.

though I'm really just generating a random username and password client side and giving them later the option to pick their own

If that’s what you’re doing, this might be useful to you:

Function to return a profile as json (or a new id if passed null)
-----------------------------------------------------------------
CREATE OR REPLACE FUNCTION get_profile (profile_id uuid DEFAULT NULL, user_id uuid DEFAULT NULL)
    RETURNS json
    AS $$
    # variable_conflict use_variable
DECLARE
    profile record;
BEGIN
    IF profile_id IS NULL AND user_id IS NULL THEN
        -- If both profile_id and user_id are null, return a new (unsaved) profile
        SELECT
            INTO profile uuid_generate_v4 () AS id;
    END IF;
    IF profile_id IS NOT NULL AND user_id IS NULL THEN
        -- If the profile_id is not null, we return the profile (which may or may not be saved)
        SELECT
            INTO profile *
        FROM
            profiles
        WHERE
            id = profile_id;
        IF NOT found THEN
            SELECT
                INTO profile profile_id AS id;
        END IF;
    END IF;
    IF user_id IS NOT NULL THEN
        -- If there is a user and they have a profile, return that profile
        SELECT
            INTO profile *
        FROM
            profiles
        WHERE
            profiles.user_id = user_id;
        IF NOT found THEN
            -- If the user didn't have a profile,
            -- coalesce a NULL profile_id into a new random value.
            -- Attempt to insert the profile; if it exists then update it
            INSERT INTO profiles (id, user_id)
                VALUES (COALESCE(profile_id, uuid_generate_v4 ()), user_id)
            ON CONFLICT (id)
                DO UPDATE SET
                    user_id = user_id
                RETURNING
                    * INTO profile;
        END IF;
    END IF;
    RETURN row_to_json(profile);
END;
$$
LANGUAGE plpgsql
VOLATILE;

ty, but with the trigger I have guaranteed that each user has a profile, so that is thankfully not an issue

What I’m doing is recording responses to surveys like this one. For the first response, I need a profile (which is then stored in localstorage). For the next response, I use the profile id. Then if the person signs up with their email, I add the profile to the user. https://consensus.j4e.name/poll/967065f5-1145-45da-865d-246bc719a6fc

Was “fun” having to think it through backwards

Yeah, I first thought about doing something like this too, but I concluded that only using the supabase native user table is probably less of a hassle