new Supabase user - query not returning anything (React)

[mohnish7]

Hello,

I have a populated table with row level security enabled in Supabase and I'm hoping to read some of that data into my SPA that I'm building in React. I've (checked) that I've correctly followed the documentation to store my database URL and API key, but when I actually run my query, I'm getting an undefined value for data back despite getting a 200 status.

See below:

useEffect(() => {
  const loadUser = async () => {
    await getUserInformation(currentUser.uid).then((snapshot) => {
          setUserInformation([{"data": snapshot.docs[0].data(), "id": snapshot.docs[0].id}])     
      })
  }


  const formData = async () => {
    let { data, error, status } = await supabase.from('database_name').select('*')
    console.log(status)
    console.log(data)

    if (error) {
      throw Error()
    }

    if (data) {
      setOptions(data)
    }
  }

  loadUser()
  formData()
  setLoading(false)
}, [currentUser]);

Any idea why this may be happening? I can't seem to figure out a way to solve this problem

[dshukertjr]

Hi @mohnish7!

It seems like you are getting empty array, which makes me think the row level security that you are setting is blocking this user from loading any data. Could you show the row level security rule that you applied to your database?

[mohnish7]

@dshukertjr thanks for replying! I probably should have read the docs a bit more to understand how row level security works before asking this question - I did not set any policy and had just enabled RLS, which is probably was causing the problem.

The data that I was hoping to get in the response is okay to be accessible by anybody. In that case, would disabling RLS be any different from enabling RLS but creating a policy that gives everybody read access?

[dshukertjr]

@mohnish7
I'm glad to hear that you were able to make it work!

The data that I was hoping to get in the response is okay to be accessible by anybody. In that case, would disabling RLS be any different from enabling RLS but creating a policy that gives everybody read access?

That is a great question. Even if your database can be publicly accessible, you would still want to enable row level security, because otherwise anyone can insert, update, or delete data stored in your database.

[mohnish7]

Hello @dshukertjr! I have another related question. I'm now hoping to create new policies for inserting/updating data so that I can continue using RLS on my tables. I am not using Supabase for authentication, and instead would only like to limit insert/update access to people with the same company_id (which is stored in the object returned from the authentication service I'm using). How would this be possible?

My query looks like this:
await supabase.from('table_name').select('column').eq('company_id', obj.company_id)

[dshukertjr]

That sounds like a separate issue, so I suggest creating a separate question, but sounds pretty tough.

[robhicks]

I'm suffering from the same problem originally reported by @mohnish7 with the exception that I have the following policy enabled for methods of interacting with public.organizaitons:

(role() = 'authenticated':: text)

I'm using the supabase client in the browser to make requests against table. The return response has a status of 200 but an empty array in the payload.

The related request is being sent with an apikey header that contains the anonymous apikey for the app and also includes an authorization header which contains the session token returned when the user logged in.

Note, I'm using a cookie as described on this site.

Any idea what I'm doing wrong? Also, why would the server return a status code of 200 for an authorized request? Shouldn't it be returning either a 401 or 403?