supabase / supabase-js

An isomorphic Javascript client for Supabase. Query your Supabase database, subscribe to realtime events, upload and download files, browse typescript examples, invoke postgres functions via rpc, invoke supabase edge functions, query pgvector.
https://supabase.com
MIT License
2.97k stars 230 forks source link

error is always null if delete is not successful due to RLS policy #902

Open danaoairuike opened 8 months ago

danaoairuike commented 8 months ago

Bug report

Describe the bug

There are 2 scenarios to reproduce the bug:

in both scenarios, the delete is not successful, and the error is always null.

It's very easy to reproduce the bug.


 const { error } = await supabase
              .from("my_table")
              .delete()
              .eq("id", id);

console.log(error);// the value is always null

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

  1. Go to '…'
  2. Click on '…'
  3. Scroll down to '…'
  4. See error

Expected behavior

A clear and concise description of what you expected to happen.

Screenshots

If applicable, add screenshots to help explain your problem.

System information

Additional context

Add any other context about the problem here.

jonshung commented 8 months ago

Can you try logging the error inside a then() callback? issue might be on postgrest-js's end Edit: Checking the return status might also be helpful, some responses from postgrest will return a null error

danaoairuike commented 7 months ago

Can you try logging the error inside a then() callback? issue might be on postgrest-js's end Edit: Checking the return status might also be helpful, some responses from postgrest will return a null error

the status is always 200

GaryAustin1 commented 7 months ago

Postgres does not return errors when you don't meet select/using policies. It is like a filter was not matched which also does not error. Delete does not error for not finding rows to delete.

Using DELETE for a policy means that it will apply to DELETE commands. Only rows that pass this policy will be seen by a DELETE command. There can be rows that are visible through a SELECT that are not available for deletion, if they do not pass the USING expression for the DELETE policy.

In most cases a DELETE command also needs to read data from columns in the relation that it is deleting from (e.g., in a WHERE clause or a RETURNING clause). In this case, SELECT rights are also required on the relation, and the appropriate SELECT or ALL policies will be applied in addition to the DELETE policies. Thus the user must have access to the row(s) being deleted through a SELECT or ALL policy in addition to being granted permission to delete the row(s) via a DELETE or ALL policy.

https://www.postgresql.org/docs/current/sql-createpolicy.html

netcamo commented 1 month ago

Hi, I have encountered exactly same problem. At the moment I can not find a way to know if delete succeeded or not. Is there any workaround to check if it has been successful?

Thank you in advance!