Supabase permission denied for TCE using pgsodium

[ani-sha]

Bug report

• I confirm this is a bug with Supabase, not with my own application.
• I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

I am implementing TCE on a table to encrypt some API keys but I am having issues while inserting any record into the table.

ERROR:  42501: permission denied for table key
CONTEXT:  SQL statement "SELECT *                     FROM pgsodium.decrypted_key v
  WHERE id = key_uuid AND key_type = 'aead-det'"
PL/pgSQL function pgsodium.crypto_aead_det_encrypt(bytea,bytea,uuid,bytea) line 5 at SQL statement
PL/pgSQL function api_encrypt_secret_api_key() line 3 at assignment

I tried following some discussions around permission issues #12952 to grant access to these functions.

GRANT EXECUTE ON FUNCTION pgsodium.crypto_aead_det_encrypt (bytea, bytea, uuid, bytea) TO authenticated;
GRANT EXECUTE ON FUNCTION pgsodium.crypto_aead_det_decrypt (bytea, bytea, uuid, bytea) TO authenticated;

This didn't work.

Then I tried following the simple TCE example to apply encryption on a table. But there are some permission issues which didn't resolve even after giving GRANT.

To Reproduce

Steps to reproduce the behavior, please provide code snippets or a repository:

1. Enable pgsodium extension in supabase
2. select * from pgsodium.create_key();
3. select * from pgsodium.crypto_aead_det_encrypt (
   'this is the message', -- a message to encrypt
   'this is associated data', -- some authenticated associated data
   ''::uuid -- key ID
   );

Expected behavior

It should produce encrypted ciphertext using the aead-det algorithm.

Screenshots

System information

• OS: macOs
• Browser (if applies): Chrome

Additional context

Add any other context about the problem here.

[encima]

Hello @ani-sha
Thanks for opening! I am not able to reproduce on Supabase Cloud (version 15.1.1.37)

Can you confirm the version you are running, please? It could be a permissions issue from a previous version and might need to be updated. If it is the latest version, then please open a Support Ticket so an engineer can check the issue.

[ani-sha]

Hi @encima, I recently upgraded to 15.1.1.41 last week because I was unable to enable the pgsodium on the earlier version. But that doesn't help either. I am having the same error.
Where can I open a Support Ticket? Can you share the steps?

[encima]

Sure thing, @ani-sha, you can use https://supabase.help/ to open a ticket! 🙏