RLS blocks my own inserts from the app but the dashboard works

Solved · 105 views · asked yesterday by sam_builds · edited

I have a table orders with RLS on. Reading works. Inserting from the app gives the error below, but in the Supabase table editor the insert works fine.

new row violates row-level security policy for table "orders"

The policy Claude Code wrote:

create policy "insert own" on orders for insert with check (auth.uid() = user_id);

What I’ve tried

Enabled the policy Claude Code wrote (it says using (true) on select)
Logged out and in again
Checked that auth.uid() is not null in a select

Comment

Are you inserting from a server action or from the browser client? If it's a server action with createServerClient, check the cookies are actually passed through, otherwise auth.uid() is null there too. jb_supa yesterday · edited

2 answers

Marked as helpful by the asker

mira_devyesterday · edited

The dashboard runs as postgres, which bypasses RLS, so it will always work there. That's why it feels inconsistent.

Your policy is fine. The usual cause is that the insert doesn't include user_id, so auth.uid() = null is false. Check what your app actually sends:

await supabase.from('orders').insert({ ...order, user_id: user.id })

Better: give the column a default so the client can't get it wrong:

alter table orders alter column user_id set default auth.uid();

Comment

That was it. The form never sent user_id, Claude Code had dropped it from the payload when it "cleaned up" the insert. Added it back and it works. sam_builds yesterday · edited

You can also give the column default auth.uid(). Then the client doesn't have to send it at all, and can't send someone else's. hannah_reyes yesterday · edited

Oh that's nicer, doing that. sam_builds yesterday · edited

lena_opsyesterday · edited

Also make sure you are not inserting with the service role key from the browser. If it "works" that way, you have a much bigger problem than a policy.

Comment

Anon key only, I grepped for service_role after reading this. Nothing in the client. sam_builds yesterday · edited

Keyboard shortcuts

RLS blocks my own inserts from the app but the dashboard works

What I’ve tried

2 answers

Your answer

RLS blocks my own inserts from the app but the dashboard works

What I’ve tried

2 answers

Related

Your answer