Open teddyhartanto opened 1 month ago
do you have other policies on chat_room_members
table?
Nope and RLS not enabled at all:
I don't use RLS & Data API in my project (public
schema)
Should I have enabled RLS and set a policy there too for Realtime Authz to work? I can try that.
(I deleted the previous comment because I tested wrongly and so the result I reported was wrong. Below is the real report)
Okay I tried it out.
I set the RLS real simple: allow all authenticated users to view chat_room_members
I'm still getting the same CHANNEL_ERROR
just for a sanity check, what happens if you have true
on the realtime.messages
table?
i would get SUBSCRIBED
instead of CHANNEL_ERROR
if the RLS for realtime.messages
is simply set to true
.
I've tested from true
-> EXIST (SELECT 1)
-> (EXISTS ( SELECT 1 FROM chat_room_members))
. It is the last one where the channel subscription gives me CHANNEL_ERROR
state with an error Error: "You do not have permissions to read from this Topic"
. Therefore, it seems to be related to the FROM <table>
clause
interesting, can you try to do that query in supabase studio impersonating one of your users to see the output of the select?
I've tested from true -> EXIST (SELECT 1) -> (EXISTS ( SELECT 1 FROM chat_room_members))
@teddyhartanto i was worried it might be an issue with the access token but if the first two are working then it's correct.
can you try the last one again but fully qualify the table name?
(EXISTS ( SELECT 1 FROM public.chat_room_members))
@w3b6x9 yeah i think it's not the access token. I monitored the WS payloads and I could see that the authenticated
JWT token is passed correctly instead of an anon
token on phx_join
. I also tried logging out and in again.
I have also tried using the fully qualified table name, but it doesn't seem to matter. On save, Supabase Realtime would truncate the table name from public.chat_room_members
-> chat_room_members
. Furthermore, if the table name is wrong, Supabase Realtime would error on save.
Eg:
(EXISTS ( SELECT 1 FROM non_existent))
@filipecabaco
(EXISTS ( SELECT 1 FROM chat_room_members))
{"ref":"1","event":"phx_reply","payload":{"status":"error","response":{"reason":"You do not have permissions to read from this Topic"}},"topic":"realtime:19a51893-6168-4b2d-91a6-47b0db323f64"}
(EXISTS ( SELECT 1))
Works fine. Seems like I can listen to the channel.
_I doubt it's related, but, there is a warning for postgres_changes
in the studio (see screenshot). I inspected the WS payload and saw this in the payload config for phx_join
:_
postgres_changes: [{event: "*", schema: "public", table: "*"}]
Whereas in my app, the config is just
postgres_changes: []
In Studio you can disable features by going to Filter messages
and disabling postgres_changes
Regarding the policies, could you open a ticket in our support system? that will make it easier for me to understand what could be happening
Bug report
Describe the bug
I'm building an in-app chat for my application. Chat works fine when the channel is public. But, I can't seem to get it working when I tried making the channels private. Here's my frontend code:
I got the following log in the console:
My RLS:![image](https://github.com/user-attachments/assets/0310668e-b173-4738-8dcf-79dee462f058)
As you can see, it's a simple RLS. Even then, I'm getting a
CHANNEL_ERROR
. The connection would succeed if I removeFROM chat_room_members
in the RLS policy. For some unknown reason, querying from any table in the policy fails the connection. What's happening?I combed over docs, github discussions, github issues, and now Discord and I couldn't find anything. Am I missing something obvious here?
Expected behavior
SUBSCRIBED
instead ofCHANNEL_ERROR
System information