Hi all, I am trying to play around with Supabase. ...
# help
r
Hi all, I am trying to play around with Supabase. Appreciate the help. I am using the DivJoy starter. I have a simple setup with two tables,
users
and
items
. I am trying to enable RLS on
items
so that a user can only update their own
items
. My RLS rule is:
Copy code
create policy "Can only update their own items." on items for update using (
  auth.uid() = owner
)
I keep seeing
new row violates row-level security policy for table "items"
however in the NextJS app. I am passing in the owner field in the request.
Copy code
{name: "test1", owner: "b1975ef4-f65c-4db5-8f4b-e63f128cf8c6"}
name: "test1"
owner: "b1975ef4-f65c-4db5-8f4b-e63f128cf8c6"
Copy code
/*** USERS ***/

create table public.users (
  -- UUID from auth.users
  id uuid references auth.users not null primary key,
  -- User data
  email text,
  name text,
  -- Validate data
  constraint email check (char_length(name) >= 3 OR char_length(name) <= 500),
  constraint name check (char_length(name) >= 1 OR char_length(name) <= 144)
);

-- Create security policies
alter table public.users enable row level security;
create policy "Can view their user data" on public.users for select using ( auth.uid() = id );
create policy "Can update their user data" on public.users for update using ( auth.uid() = id );

-- Create a trigger that automatically inserts a new user after signup with Supabase Auth
create or replace function public.handle_new_user() 
returns trigger as $$
begin
  insert into public.users (id, email, name)
  values (new.id, new.email, new.raw_user_meta_data->>'full_name');
  return new;
end;
$$ language plpgsql security definer;
create trigger on_auth_user_created
  after insert on auth.users
  for each row execute procedure public.handle_new_user();


-- Create a trigger that automatically updates a user when their email is changed in Supabase Auth
create or replace function public.handle_update_user() 
returns trigger as $$
begin
  update public.users
  set email = new.email
  where id = new.id;
  return new;
end;
$$ language plpgsql security definer;
create trigger on_auth_user_updated
  after update of email on auth.users
  for each row execute procedure public.handle_update_user();



/*** ITEMS ***/

create table public.items (
  -- Auto-generated UUID
  id uuid primary key default uuid_generate_v4(),
  -- UUID from public.users
  owner uuid references public.users not null,
  -- Item data
  name text,
  featured boolean,
  created_at timestamp with time zone default timezone('utc'::text, now()) not null
  -- Validate data
  constraint name check (char_length(name) >= 1 OR char_length(name) <= 144)
);
That's the DB schema
Nvm figured it out. I think I had something wrong in the policy.
I updated it to all actions instead.
s
The issue was probably because you didn’t have a policy for INSERT, so by default when RLS is turned on and a policy for a certain action isn’t created it will reject entry into the database when that action is performed.
r
Yeah I think that was it ! Thank you.