RLS not working after sign-in

[tobias-scheepers]

Describe the bug
After signing in a user using supabase-py a user is correctly returned with it's acces_token etc. However if I try to insert or select a row in a table with RLS enabled it seems the client does not correctly send the requests as being authenticated by that user. Only the tables without RLS seem to be working. The error returned by supabase is:

postgrest_py.exceptions.APIError: {'message': 'new row violates row-level security policy for table "machines"', 'code': '42501', 'details': None, 'hint': None}

Is this currently not supported by supabase-py or is this indeed a bug? Also, if not supported how would one best go about accessing secured tables (e.g. using postgres-py directly).

To Reproduce
The minimal example below highlights this for systems

client = create_client(SUPABASE_URL, SUPABASE_KEY)
session = client.auth.sign_in(email=SUPABASE_MAIL, password=SUPABASE_PASS)
user = session.user

data = {
    "user_id": str(user.id)
}

response = client.table("examples").insert(data).execute()

client.auth.sign_out()

[anand2312]

Hi, using the signed-in user's bearer token has not yet been implemented. I am planning on getting to this soon-ish.

[anand2312]

This needs some work to be done on postgrest-py first (as in, it isn't directly supported as such). I'm working on that right now, and it should be done by the end of this week, and when that's done we'll make a new release of postgrest-py and have it work here.

In the meantime you could do something along the lines of:

client = create_client(SUPABASE_URL, SUPABASE_KEY)
session = client.auth.sign_in(email, password)

postgrest_client = client.postgrest
postgrest_client.auth(session.access_token) 

# run queries
client.auth.sign_out()
postgrest_client.auth(SUPABASE_KEY) # go back to using the anon key

[tobias-scheepers]

Thanks @anand2312 this clears things up indeed. The workaround works flawlessly in the mean time!

[timreibe]

+1, coming from #272

edit: I'd like to link #247, since this is an equal issue and to keep track of both!
@anand2312: can you add the storage tag aswell?

[anand2312]

@timreibe 👍🏼 done. Perhaps this issue should be pinned for better visibilty

[nielsrolf]

Are there any updates on this? :)

[J0]

Hey @nielsrolf,

Thanks for the query! Seems like this is related to #272 - let me pin the issue as well

[0xDeadcell]

Any updates on this?

[0xDeadcell]

This needs some work to be done on postgrest-py first (as in, it isn't directly supported as such). I'm working on that right now, and it should be done by the end of this week, and when that's done we'll make a new release of postgrest-py and have it work here.

In the meantime you could do something along the lines of:

client = create_client(SUPABASE_URL, SUPABASE_KEY)
session = client.auth.sign_in(email, password)

postgrest_client = client.postgrest
postgrest_client.auth(session.access_token) 

# run queries
client.auth.sign_out()
postgrest_client.auth(SUPABASE_KEY) # go back to using the anon key

How would this work if I'm using oauth (with google as a provider for example)?

[benjamin-kirkbride]

I have the same question as @0xDeadcell

[ShantanuNair]

@anand2312 Hey just checking up, can I now instantiate a supabase instance with a anon key? I don't want to use a username/pw.

[anand2312]

@anand2312 Hey just checking up, can I now instantiate a supabase instance with a anon key?

You should be able to - does passing the anon key to create_client not work?

[lhausermann]

This oneline do the job

client.postgrest.auth(self.supabase.auth.get_session().access_token)

if client is the variable from `create_client``

As @0xDeadcell mentioned, to have authentication works again, after signout, restore the anon token for your supabase project

client.postgrest.auth(SUPABASE_KEY)

[silentworks]

The latest v1.1.0 release of the supabase-py library fixes this issue.

[peter-voxana]

Awesome than you Andrew!

…

On Sat, Sep 30, 2023 at 9:58 AM Andrew Smith ***@***.***> wrote: The latest v1.1.0 release of the supabase-py library fixes this issue. — Reply to this email directly, view it on GitHub <#185 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BBFFGPW67J7KYLE3ZNGIES3X5BFSNANCNFSM5TCW5IAQ> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>