auth.uid() check not working on insert when using another user's uuid

Bug report

When adding a policy to check that authenticated user uuid is equal to a table uuid, it still accepts the insert if I use another user’s uuid.

To Reproduce

Steps to reproduce the behavior:

1. Create a table Post (id, uuid)
2. Create a policy: create policy "users can insert only own posts" on public.posts for insert with check (auth.uid() = uuid);
3. execute the following on the client: await supabase.from('posts').insert([ { uuid:<another user uid>, }, ])

Expected behavior

The post should not be created as auth.uid() != uuid But it does get created.

System information

• OS: Ubuntu
• Version of supabase-js: latest
• Version of Node.js: nextjs 10.3

[wyozi]

In case someone else stumbles upon this thread and has some issue as @pradeepknowstocode, the table you’re joining from (in this case profile_role) must also be readable according to RLS rules. Took me a while to figure out I forgot to add read permissions for my users table 😃

[patcito]

Nevermind, it works now. Thanks for the help.