supabase / splinter

Supabase Postgres Linter
https://supabase.github.io/splinter/
68 stars 6 forks source link

Performance Advisor showing warning for Auth RLS Initialization Plan after policy has been fixed #63

Closed Crypto69 closed 2 months ago

Crypto69 commented 2 months ago

I'm using hosted supabase. After watching the excellent video 8 things you should NEVER do in a Database I decided to check my project.

I had multiple Auth RLS Initialization Plan warnings because my policies we're all written as using ( auth.uid() = user_id ); instead ofusing ( (select auth.uid()) = user_id );

I changed my policy as suggested (and yes I did save the changes).

But the warnings have not gone away. Attached screenshots show the policy and the warning

Screenshot 2024-04-22 at 5 34 14 pm

Screenshot 2024-04-22 at 5 34 27 pm

Screenshot 2024-04-22 at 5 34 58 pm

I tried doing the same for all my warnings but none of them go away. I also tried pressing rerun linter multiple times

I followed the documentation here and even tried creating a new table but had the same result. I'm not sure if I'm doing something wrong or this is a bug?

LukeHosk commented 2 months ago

Ran across the same issue myself, and have just created a minimal reproduction repo and confirmed that the linter flags this there too.

https://github.com/LukeHosk/splinter-rls-initialization-plan-repro


Screenshot 2024-04-22 at 15 22 50 Screenshot 2024-04-22 at 15 21 11
PfernFSU commented 2 months ago

This same thing is happening to me and I also came here to report it. Bad RLS query that was flagged:

( SELECT (EXISTS ( SELECT 1
           FROM admin_users a
          WHERE (auth.uid() = a.id))) AS "exists")

I updated it to the following, saved it, and re-ran the linter and it still fails:

  (EXISTS ( SELECT 1
   FROM admin_users admin
  WHERE (( SELECT auth.uid() AS uid) = admin.id)))
olirice commented 2 months ago

Thanks for the examples, that was helpful

We've identified the issue

Our integration with Studio was consuming the backslashes \ in the regexes that filter the qual and with_check code blocks. The team is working on a fix