Permission denied for stored procedure that updates user's email address in auth.users

I created a stored procedure (aka function) in the database that I hoped would allow the user’s email address to be updated from the supabase JS client. When I ran it, I was met with an error message: ‘permission denied for schema auth’

Here’s what my ‘CREATE FUNCTION’ query looks like:

CREATE FUNCTION updateauthemail (new_email text, auth_id text)
RETURNS text AS $updated_data$
	DECLARE
		updated_data text;
	BEGIN
		UPDATE auth.users set email = new_email where id = auth_id;
		RETURN updated_data;
END;
$updated_data$ LANGUAGE plpgsql;

Do I need to add something to the function when creating it, or pass a certain param through the JS client on my Node.js server? Here’s the function I’m calling through the JS client:

const { data: rpcData, error: rpcErr } = await supabase.rpc(
      "updateauthemail",
      {
        auth_id: authId,
        new_email: updatedData.email,
      }
    );

_Originally posted by @dayvista in https://github.com/supabase/supabase/discussions/573#discussioncomment-358474_

[dayvista]

Thanks for the tip, @steve-chavez That almost did it, but I had to compare my declared auth_id variable against id rather than auth.uid(), like so:

UPDATE auth.users set email = new_email where id = auth_id;

That enabled me to pass the id through Node.js like this:

const { data: rpcData, error: rpcErr } = await supabase.rpc(
      "update_auth_email",
      {
        auth_id: authId,
        new_email: updatedData.email,
      }
    );

… and it worked! Thanks a ton to both of you for pointing me in the right direction.

[steve-chavez]

@dayvista The auth.uid() = auth_id; part in the UPDATE looks wrong.

Shouldn’t that be:

UPDATE auth.users set email = new_email where id = auth.uid();