Hello, I am trying to implement custom claims with my web app. How would I go about setting a custom role of a user on signup. for example if a user signs up from the teacher portal their custom claim role becomes "teacher"?

Hello @Sajeev! This thread has been automatically created from your message in #843999948717555735 a few seconds ago. We have already mentioned the @User so that they can see your message and help you as soon as possible! Want to unsubscribe from this thread? Right-click the thread in Discord (or use the ``...`` menu) and select "Leave Thread" to unsubscribe from future updates. Want to change the title? Use the ``/title`` command! We have solved your problem? Click the button below to archive it.

Please take a look at this repo my colleague created showing how to do custom claims with Supabase https://github.com/supabase-community/supabase-custom-claims

yep i looked at that repo, but I am confused on how to set the claim when they first signup. If i try to use: .rpc('set_claim', {uid, claim, value});

I don't think you can do that anyway because the

set_claim

function is checking if you are a admin before allowing you to set claims

yep, but how would the function know to set the role of "teacher" or "student" since the new user will be inserted in the auth.users table regardless of whether they signup from the teacher or student portal

Is there something unique about the teacher portal? You have access to all headers from PostgREST in your rpc function.

I am new to PostgREST so i am not sure which header I would edit and what I would add to it

No is your teacher portal a different URL? Here is an example of the headers on a select call (would be same for RPC) you can get any of these. Deleted the pix as had some info I did not want public.

yea the teacher portal is a different url

So referer might work for you.

oh so if I set the referer to the url and then check the refer on the server I would be able to add the role

I don't think you set the referer, the browser does, so it can't be faked... but could be wrong. https://postgrest.org/en/stable/api.html#http-context

ok

Follow the link I just sent.

oh ok I see it. thank you!

I thought you were doing an rpc call?

oh ok

So on auth signUp you can only pass in the extra data object which goes into user metadata column. The problem is that can be "faked" by the user.

ok so on the client side when the user clicks the signup button what is supposed to happen

You do a normal signUp and then when it is confirmed you would call the rpc call to set their status as user or teacher.

oh ok and I would create the function from the supabase dashboard

Yes and in that function you can see the url in the header to decide which portal it came from and set your "claim" info.

oh ok thank you I will try that now

Is the only difference between your portals a page on the same site? If so what stops a student from using the teacher page?

ok figured it out had to do with referrer policy, which i changed in the app to send the whole url instead of just the partial url and it works now

Thread was archived by @Sajeev. Anyone can send a message to unarchive it.