Repository navigation
Failing to update data because of row level security returns [] as response body #1843
Description
Environment
Using Supabase.
Description of issue
Response body of update is just an empty array when failed to perform the update due to row level security.
To Reproduce
Create a sample table:
create table public.sample (
id uuid not null primary key DEFAULT uuid_generate_v4 (),
name text not null
);
alter table public.sample enable row level security;Perform an update
const {data, error} = await postgrestClient.from('sample').update({id: ''})And the error value is []. Under the hood, the raw response body seems to be [].
Expected behavior
Get an error response message saying something like
new row violates row-level security policy for table \"sample\"
Activity
wolfgangwalther commentedon May 5, 2021
This is just how RLS works. There is no error and it makes sense. RLS limits the number of rows a user can "see" on the table. In your example, you are not seeing any rows - so no rows are updated, there is no error and the result is empty. All correct.
There can be a difference between the rows you are seeing and the rows you are allowed to update. This is the difference between
USINGandWITH CHECK. Have a look here at Table 272.On a side note: If you want to do an update where you expect to change exactly one row, not more and not less, you can request a single row via
Acceptheader - see the docs. This would fail in your example, because 0 rows is not "exactly 1 row". Not sure how to do that with the supabase client.