is it possible to define such a rls policy ? I want user to have permission to insert on foobar table but not directly, only through a

supabase.rpc('foobar_function')

How do I set the default value for an enum type, its not accepting a string value?

Hi all! Someone has implemented password recovery with Flutter? Using the

resetPasswordForEmail

I receive a link to my inbox but this link gives an error when opened. Link is somethink like that: https://[myProjectId].supabase.co/auth/v1/verify?token=c91a7fc0[...]ecea7e8&type=recovery&redirect_to=https://[myProjectId].supabase.co When clicking on it, I get redirected to https://[myProjectId].supabase.co/#error=unauthorized_client&error_code=401&error_description=Email+link+is+invalid+or+has+expired with this response:

{
  "message": "No API key found in request",
  "hint": "No apikey request header or url param was found."
}

Example

sql
-- The function that prevents users from seeing the owner of a group
CREATE POLICY "Group members should not be able to see the owners personal ID" 
ON "group" FOR SELECT
USING ( auth.uid() != owner )
WITH (security_barrier = true) 
  AS
    SELECT * FROM public.group
      WHERE owner IS NOT NULL;

Hello everyone, Is there an official guide/tutorial about "How to integrate supabase's user management into my own prisma schema" ? I guess you have to create something like a

Profile

model that is linked to Supabase Auth through the user id PK or something, but just wanted to have a confirmation. Thank you very much for your time. PS : I just want to use Supabase for its auth capabilities as of now.

I'm trying to connect to the database directly with pgadmin but it says the connection is refused, I tried resetting the password, but that didn't help.

I want to create a table where the combination of 2 columns can never be same. Column1 value can be present multiple time. same for columns 2 as well. but the combination of same value in column1 and 2 should be unique. How can i achieve this while creating the table. I edited the columns to make it unique but the uniqueness is getting applying to single column. Please help me.

Hey, Is it possible to add more data to email templates?

What is the difference between the different types of keys provided by Supabase (client API key, service key, anon public key, service role secret, JWT secret) and which one(s) can be safely exposed on the client-side for secure authentication?

In the case of massive data or data stored in a streaming solutions (kafka, redis stream, pulsar, rabbitmq, ...), one could prefer the database to consume the messages and insert them to the database instead of developing a worker that will read from the event stream then push to the database.

I am just sending the

email

and

password

and I keep receiving this CORS

Is there a best practice for this, since they have the jwt token in their cookie?

Using supabase 2.4.1 when I try to initialize supabase for realtime a console error tells me that websockets can't be instantiated with

https

, but only

ws

or

wss

, but I can't find anything in my supabase project that has helped me find a different url.

Hi! I'm migrating from a custom supabase.js v1 implementation in Remix ( https://github.com/arpitdalal/remix-supabase-auth/ ) to auth-helpers-remix and what I currently do is handle login in an actionHandler, the "Remix way". This works but it's gone as soon as I redirect to another page, like the session isn't properly set after a

supabase.auth.signInWithPassword

. The auth-helper-remix has login done client side but I'd rather keep that server-side. Is that possible?

Is there any place where we can run

supabase-js

or any other SDK code inside the Supabase dashboard (just like SQL Editor)? If not, Why?

Picture is attached. Any components I try to render that have an import to the nextjs auth helpers instantly fails with this error. I know it's a test-only issue, but it's not a missing context value, nothing changes when I wrapped my render tests in the Supabase provider.

Each hour, i need restart my project for resolve the problem, but why i have this error ? Project of i have this error: https://github.com/Steellgold/Linkfy

ts
const { data, error } = await supabase
  .from('projects')
  .insert({ title: "Test's" })
  .select()
  .single();

The simple insert above is failing with this error:

{
  code: '42601',
  details: null,
  hint: null,
  message: 'syntax error at or near "s"'
}

For this example, projects is defined as:

ts
type Project = {
  id: uuid;
  title: text;
}

Is there a way, with both email and social signup, to add data to a profile table? Like a referral system for example. I can't tell from the docs

My question is how to best report this because it is difficult to imagine a working example. Here's the most basic description. In our user signup process we are using the user_metadata to set a property called "current_tenant". (I fully understand the security implications of user_metadata. Please don't worry about that.) The SELECT policy causes rows from a table called "user_role" to only retrieve rows where the field, tenant_uid, is equal to the "current_tenant" property of the user_metadata. Here is the policy: CREATE POLICY "All can select user_role for current tenant" ON public.user_role AS PERMISSIVE FOR SELECT TO public USING ((tenant_uid = ((((auth.jwt() ->> 'user_metadata'::text))::json ->> 'current_tenant'::text))::uuid)); (Actually, we do USING with a function like "tenant_uid = get_current_user_tenant()::uuid" but this example puts all the code in place.) The PROBLEM is that this code works perfectly, locally on supabase 1.29.1 and 1.29.2. It fails on 1.29.3 and returns NO ROWS. You have to disable RLS and it returns all rows. I have today tested on every major release of supabase 1.3x.0 and on the latest 1.36.7. The local RLS filter just fails starting with version 1.29.3. So, something happened from 1.29.2 to 1.29.3 as best that I can tell. I am positive with breakpoints that the token contains the correct data and this is true on versions of supabase where it works and where it doesn't. At the point we are expecting the RLS policy to govern what is retrieved from the table, the token is properly set. The only difference is the version of supabase. TODO: 1 - Test against the project in the cloud instead of locally (Postgresql 15.1 on both). 2 - Find the best way to report this error so that it is the necessary details. Thank you for any/all questions/suggestions.

Sorry if I am breaking any guideline/rule with this post... I saw some attempts of breaking in both my database and API without success. I communicated with Supabase support which assured me that if tried consecutively, those would be black-listed. However, I found an active connection to my DB using the user

supabase_admin

through TLS (and it was not from a private IP such as 172.17.X.X) Should I worry or was an internal Supabase employee trying to help the support when I communicated about the former attempts? Best regards

I was doing supabase with svelteKit, but it looks there is some kind of network delay or maybe I am not doing things the way it should be done. But It makes a question in my mind that is there any way that we do all the data insertion updation on client side with the svelte-stores and persist that store with supabase backend database?

Hi guys this is my scenario ... I have Table1 which contains id(PK), Name, Age, Contact, Department_Name. I have Table2 which contains Department_Id, Department_Name. I want to make an RLS policy on Table1 in such a way that... when data is being INSERTed into Table1 eg {'id':001, 'Name': 'Mr.Big', 'Age': 101, 'Contact': 123456, 'Department_Name': 'IT'}.... I want it to 1st check if this Department_Name ie 'IT' exists in Table2's Department_Name column... and if YES ... then it could continue with the insertion. Now i wrote this:

(EXISTS ( SELECT 1
   FROM Table2
  WHERE (Table2.Department_Name = Department_Name )))

but it seems I dont have access to the JSON . How may I form my policy to solve this?

I've created a webhook to push data to Cloudflare. I'm getting a

outcome": "canceled",

in Cloudflare for a POST webhook request. I've replicated the webhook in Postman and it works perfectly everytime, but it last between 600ms and 1300ms. Is there a timeout that's dropping the client request at Supabase? I've checked the doc and it says the timeout is ignored.

I'm trying to create some dummy accounts for testing. They'll have email with @testers.test domain, which obviously does not exist. I'll use https://supabase.com/docs/reference/javascript/auth-signup to sign them up, but I'd need a work around to confirm emails. How would I go about doing it?

Hi there! I have table, and one of the columns of the table is a jsonb[] array. Using the js libary, I am trying to filter through that column such that it only returns objects with a certain key value pair. For example, if the element is:

[
   {
     type: 'Purchase',
     id: 1
   },
   {
     type: 'Withdraw',
     id: 2
   }
]

I want to only get objects that have a type of 'Purchase'

I'm not able to figure our where the versions of the pg extensions are coming from during local development. I am using the lastest version of the Supabase CLI (1.36.7) and I am trying to upgrade the

pg_graphl

extension to its latest version (

1.1.0

) -- instead its installing

0.5.0

after I spin up a local environment and run

SELECT * 
FROM pg_extension;

in the local Studio. I couldn't find a version of that particular extension in the CLI repo and am still confused how these things piece together. Any help on getting 1.1.0 installed locally would be appreciated! Thanks

We are currently starting the subscription onInit in a useEffect in App.tsx, the root component of our React app. However, from reading online, this does not seem to capture events on app start, which seems accurate from my experience of working with it. (We can find an initial session, but it does not fire off a SIGN_IN event or anything.) The bad part about that is that when you click the reset link, it opens it up in a new tab, so that PASSWORD_RECOVERY event would probably happen on page start, which is when we can't react to it. (Unless that's not actually true.) So how do we listen for that reset event and capture it properly? One initial solution that was in there before I started trying to fix some auth bugs was that we passed a redirectTo url to the reset email function which would render a component that would put us into a password recovery global state. That did work, but was really fragile (hence me trying to fix things) and it also allowed you to trigger a reset for any user by just navigating to that url. So that solution doesn't work. The real solution does seem to be reacting to that auth state change, but I'm just not sure how to do it and I've been poking at it all day. Please send help!

I'm using supabase on a sveltekit+typescript project (beginner) to try and make something like a university club website where it contains member profiles. i have simple request

const { data: Members, error } = await supabase.from('Members').select('*')

and it works but then gets overridden by the error for some reason. i tried looking for error or even the code (18) that came with it, but found nothing. In the traceback, there is a mention of Auth but I haven't used auth at all. I have used supabase before with vanilla js and didn't face this problem