name: supabase-cloud-rls-policy-fix

description: Fix Supabase Cloud RLS policy issues causing data not saving in /adm panels

tags:

- supabase

- rls

- security

- commercialrs

Fix Supabase Cloud RLS Policy Issues

When to Use

When a user reports that changes aren't saving in a Supabase Cloud app (especially /adm panels), and the REST API returns no error but the data doesn't persist. Usually caused by missing RLS policies for INSERT/UPDATE/DELETE operations.

Diagnosis Steps

1. Check if RLS is blocking writes — Query the Management API to list existing policies on the table:

`bash

curl -s -X POST 'https://api.supabase.com/v1/projects//database/query' \

-H 'Authorization: Bearer ' \

-H 'Content-Type: application/json' \

-d '{"query": "SELECT policyname, cmd FROM pg_policies WHERE tablename = '\''user_roles'\''"}'

`

2. Common pattern — Only SELECT policy exists (user_roles_read_public), but INSERT/UPDATE/DELETE are missing.

3. If the table returns [] via REST but has data via Management API — confirms RLS is blocking writes.

Fix Steps

1. Ensure RLS is enabled:

`sql

ALTER TABLE user_roles ENABLE ROW LEVEL SECURITY;

`

2. Create missing policies (authenticated role):

`sql

CREATE POLICY user_roles_insert ON public.user_roles FOR INSERT TO authenticated WITH CHECK (true);

CREATE POLICY user_roles_delete ON public.user_roles FOR DELETE TO authenticated USING (true);

CREATE POLICY user_roles_update ON public.user_roles FOR UPDATE TO authenticated USING (true) WITH CHECK (true);

`

3. Verify:

`sql

SELECT policyname, cmd FROM pg_policies WHERE tablename = 'user_roles';

`

Key Insights

• - Use Management API (PAT token, api.supabase.com) not the project REST API — RLS blocks direct REST queries but Management API bypasses it
• - CREATE POLICY syntax for INSERT uses WITH CHECK (not USING)
• - CREATE POLICY syntax for UPDATE uses both USING (for SELECT) and WITH CHECK (for writes)
• - Pattern applies to any table: check pg_policies for missing commands, then add INSERT, UPDATE, DELETE policies

Supabase Credentials (ComercialRS/DocCorretor shared project)

• - Project ref: dauftiqcvgaydddoxqhh
• - Management API PAT: sbp_REDACTED
• - Project API anon key: sbp_REDACTED